Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual page 411

Copyright © 2010, Juniper Networks, Inc.
Configuring an Attack Pattern
You configure the attack pattern as a member of a compound attack object as you would
an attack pattern in a signature attack object. For details, see "Configuring Attack
Detection Properties" on page 352.
To add an attack pattern to the compound attack object, click the Add icon and select
Signature.
Pattern—Specify the pattern to match. You construct the attack pattern just as you
would when creating a new signature attack object. To negate the pattern, enable
Negate.
Context—Specify the context in which to locate the pattern. The context displays only
contexts that are appropriate for the specified Service. If you selected a service binding
of Any, you are restricted to the service contexts packet, first data packet, and first
packet.
Direction—Specify whether the security device should match the pattern in traffic
flowing in any direction, from client to server, or from server to client.
Adding a Predefined Protocol Anomaly Attack Object
To add a protocol anomaly to the compound attack object, click the Add icon and select
protocol anomaly. In the Attack Properties area, select an anomaly from the Key menu.
The menu only displays protocol anomalies appropriate for the Service you selected.
If you selected a service binding of any, you are restricted to the IP-based protocol anomaly
attack objects.
Configuring an Attack Object Ordered Match
Use the oAND Boolean operator to create a compound attack object that must match
each member signature or protocol anomaly in the order you specify. If you do not specify
an ordered match, the compound attack object still must match all members, but the
attack pattern or protocol anomalies can appear in the attack in random order.
To configure an ordered match, use the oAND Boolean operator in the Boolean Expression
field to match a more complex arrangement of attack patterns. For example, if you have
created signatures m1 and m2, and you know that attack m1 is always followed by m2,
the Boolean expression that you create would be
Configuring a Boolean Expression
The Boolean Expression field makes use of the Member Names created in the lower part
of the dialog.
NSM supports three Boolean operators: or, and, and oand (ordered and). NSM also
supports the use of parenthesis to determine precedence.
NSM supports three Boolean operators: or, and, and oand (ordered and). NSM also
supports the use of parenthesis to determine precedence.
Boolean operators:
or—If either of the member name patterns match, the expression matches.
Chapter 8: Configuring Objects
.
m1 oAND m2
361