 PC USA's Intrusion Protection utilizes a database of over 2,000 rules to detect
patterns indicating : |
 Hostile probing, port scans, backdoor probes, illegitimate interrogations, host
sweeps and other activities. |
| Denial of service (DoS) attacks like SYN flood. |
Protocol exploitations, leveraging weaknesses in DNS, FTP, ICMP, IMAP, POP3,
SNMP, x11 and other network protocols. |
Application attacks, exploiting programming errors in internally developed
software and CGI scripts, and in popular applications. |
Targeted attacks that exploit the vulnerability of messaging and traffic and
Peer-2-Peer (p2p) networking. |
Hostile probing, port scans, backdoor probes, illegitimate interrogations, host
sweeps and other activities. |
| Denial of service (DoS) attacks like SYN flood. |
Protocol exploitations, leveraging weaknesses in DNS, FTP,ICMP,IMAP,POP3,RPC,
SNMP,x11 and other network protocols. |
Application attacks, exploiting programming errors in internally developed
software and CGI scripts, and in popular applications and databases such as
Oracle, MySQL server, Coldfusion and Frontpage. |
Targeted attacks that exploit the vulnerability of messaging and chat traffic and
Peer-2-Peer (P2P) networking. |
| |
 |
PC USA performs intrusion detection by identifying suspicious behavior and notifying
the system administrator about incidents. The software can also provide intrusion
prevention by working with the firewall to immediately block incoming traffic
associated with instructions : |
| Intrusion detection and prevention can be employed simultaneously. |
| Threat Patterns are updated automatically. |
| |
 |
By putting intrusion protection in-line with the firewall, PC USA's Intrusion Protection
ensures that all Internet and VPN traffic is inspected, and that there are no delays as traffic is routed to a separate sensor. PC USA can also tailor testing to each network
and server by: |
| Enabling or disabling any of the over 1,500 rules. |
| Customizing existing rules or creating new ones. |
Performing certain classes of tests only on specific networks or traffic form specific servers (for example, executing email-related tests only on traffic to and from
email servers). |
| |
| Probes and attacks : |
Application and services : |
Protocols : |
| Backdoor Software |
Messaging and chat |
DNS |
| Denial of service |
MySQL Server database |
FTP |
| Distributed denial of service |
Oracle database |
ICMP |
| Network scanning |
CGI scripts |
IMAP |
| Unwanted traffic |
P2P networks (Napster, Kazaa) |
NetBIOS |
| |
Coldfusion |
NNTP |
| |
FrontPage |
P2P |
| |
Microsoft IIS |
POP2 |
| |
Multimedia streaming Software |
POP3 |
| |
|
RPC |
| |
|
SMTP |
| |
|
SQL |
| |
|
TFTP |
| |
|
X11 |
|
| |
