Service learning and dynamic baseline learning. In service learning, the system learns the service model (protocol type and port number of the traffic destined for the Zone) of the Zone to enable a proper attack defense policy.
The AntiDDoS provides Zones with differentiated defense policies.
When multiple ports are enabled for the Zone and refined defense is required for a certain port, you need to adopt service-based defense to learn about the traffic model and identify Zone services, thereby providing defense policies for given services in the Zone.
With service learning, the AntiDDoS can identify the services of the Zone and figure out TCP and UDP services whose traffic hits the threshold, including the protocol type, port, IP address, and specific traffic value. In this way, the device obtains the service list of the Zone.
In service learning, the AntiDDoS learns statistics on inbound traffic, regardless of normal or abnormal traffic. Therefore, service learning needs to be enabled when Zone traffic is normal. During the learning, if the Zone is abnormal or under attacks, you need to terminate the current service learning task and recover it until Zone traffic resumes normal.