Cisco Cisco IPS 4520 Sensor Libro bianco

Page 1 of 6

White Paper

Global Correlation on Cisco IPS Sensors

Intrusion prevention systems (IPSs) use protocol-based decoding engines and regular-expression-based

signatures to detect and stop incoming threats. These traditional techniques are the “workhorses” of the IPS

sensor, but there are several deployment situations in which the techniques can be augmented to improve a

sensor’s ability to detect threats. Cisco Remote Management Services’ experience has shown that network

reputation can be combined with traditional IPS techniques to stop incoming threats effectively.

Cisco

IPS sensors are context-aware. They take into account the network reputation of the source of an incoming

flow, the value to the organization of the target, the operating system of the target, and the user identity associated

with the flow. The network reputation component of the context comes from Cisco Security Intelligence Operations

(SIO), a cloud-based service that collects real-time flow telemetry from more than 1.5 million Cisco IPS sensors,

firewalls, email gateways, and secure web gateways that are deployed worldwide. Cisco SIO produces reputation

scores for various traffic sources (networks) and then downloads the scores to Cisco IPS sensors that have been

configured to receive them. These scores form the basis of the Cisco IPS Global Correlation feature.

The Global Correlation feature uses network reputation scores in two different but complementary ways. First, the

reputation of the source of a new flow is tested and the flow is denied without further processing if the reputation is

bad. Second, the flow is passed through traditional IPS inspection engines. These engines determine the threat

potential of the flow based on the sensor’s policy configuration, and assign a risk rating to the flow. The risk rating

is then modified to take into account the reputation of the flow’s source. If the resultant risk rating is above a

threshold, the flow is denied (or an alternate action is taken, depending on the policy configuration). This process

is depicted in

Figure 1

Figure 1. Global Correlation on Cisco IPS

Thus, bad traffic denied by a Cisco IPS sensor falls into three categories: