Cisco Cisco Catalyst 6500 Cisco 7600 Router Traffic Anomaly Detector Module 数据表

Data Sheet

Page 1 of 10

Cisco Traffic Anomaly Detector Module

The Cisco

Traffic Anomaly Detector Module is an integrated services module for Cisco

Catalyst

6500 Series switches and Cisco 7600 Series routers that helps large

organizations protect against distributed denial of-service (DDoS) attacks or other

network attacks by enabling users to quickly initiate mitigation services and block the

attacks before business is adversely affected.

Based on a unique, patented multiverification process architecture, the Cisco Traffic Anomaly

Detector Module (Figure 1) uses the latest behavioral analysis and attack recognition technology

to proactively detect and identify all types of online attacks. By constantly monitoring traffic

destined for a protected device, such as a Web or e-commerce application server, the Cisco

Traffic Anomaly Detector Module compiles detailed profiles that indicate how individual devices

behave under “normal” operating conditions. If the Cisco Traffic Anomaly Detector Module detects

any per-flow deviations from the profile, it considers the anomalous behavior a potential attack and

responds based on user preference—by sending an operator alert to initiate a manual response,

by triggering an existing management system, or by launching the Cisco Anomaly Guard Module

to immediately begin mitigation services.

Figure 1. Cisco Traffic Anomaly Detector Module

Combined with the Cisco Anomaly Guard Module, the Cisco Traffic Anomaly Detector Module

contributes to the industry’s most comprehensive DDoS defense system. Through the

multiverification process architecture, the Cisco Traffic Anomaly Detector Module and Cisco

Anomaly Guard Module detect, divert, isolate, and remove malicious attack flows without affecting

legitimate transactions, delivering robust protection to networks and business-critical traffic.

How It Works

DDoS attacks represent the fastest-growing form of threats facing online businesses today. These

attacks, which have evolved from simple acts of publicity-seeking vandalism to highly focused

events designed to disrupt an organization’s business operations, have become increasingly

relentless and malicious, causing significant harm to many businesses.

Attack techniques are also growing more sophisticated. Attackers mimic valid requests, spoof

source identification, and use armies of compromised “zombie” hosts to overwhelm Internet data

centers and existing defenses, making identification and blocking of the malicious traffic flows

virtually impossible.