Mappings Between Attack Types and Defense Policies

**Table 1** Mapping between attack types and defense policies
Attack Type	Attack Type Displayed on the ATIC	Defense Policy
SYN Flood	SYN flood	error-seq source authentication
		right-seq source authentication
		SYN first-packet check
		SYN-ratio anomaly rate limiting based on the source IP address
ACK Flood	ACK Flood	Session strict mode check
		Session loose mode check
		TCP first-packet check
SYN-ACK Flood	SYN-ACK Flood	Source authentication defense
		SYN-ACK first-packet check
		Abnormal session check
RST/FIN Flood	FIN-RST flood	Session check
RST/FIN Flood	FIN-RST flood	TCP first-packet check
TCP Fragmentation Flood	TCP Fragment flood	TCP fragment attack defense
TCP Connection Flood	TCP Connection flood	New session check based on the source IP address
		Concurrent session check based on the source IP address
		Null connection check
		Retransmission session check
		SockStress check
		ACK session check
		SYN session check
TCP Malformed	TCP Malformed	TCP malformed packet defense
TCP Bandwidth Overflow	TCP Bandwidth Overflow	TCP bandwidth limiting
TCP Fragment Bandwidth Overflow	TCP Fragment Bandwidth Overflow	TCP fragment bandwidth limiting
UDP Flood	UDP Flood	UDP first-packet check
UDP Flood	UDP Flood	Fingerprint defense
UDP Fragment Flood	UDP Fragment Flood	UDP fragment attack defense
UDP Bandwidth Overflow	UDP Bandwidth Overflow	UDP bandwidth limiting
UDP Fragment Bandwidth Overflow	UDP Fragment Bandwidth Overflow	UDP fragment bandwidth limiting
UDP Malformed	UDP Malformed	UDP malformed packet defense
ICMP Flood	ICMP Flood	ICMP rate limiting
Other Flood	Other Flood	Other defense
Other Bandwidth Overflow	Other Bandwidth Overflow	Other bandwidth limiting
DNS Query Flood	DNS Query flood	DNS cache server TCP authentication
		DNS authorization server CNAME authentication
		Passive defense
		DNS first-packet check
DNS Reply Flood	DNS Reply flood	Reply authentication defense
DNS Reply Flood	DNS Reply flood	DNS first-packet check
Source DNS Query Flow Abnormal	Source DNS Query Flow Abnormal	DNS query packet rate limiting based on the source IP address
Source DNS Reply Flow Abnormal	Source DNS Reply Flow Abnormal	DNS reply packet rate limiting based on the source IP address
DNS Query Domain Flow Abnormal	DNS Query Domain Flow Abnormal	DNS query packet rate limiting based on the domain name
DNS Reply Domain Flow Abnormal	DNS Reply Domain Flow Abnormal	DNS reply packet rate limiting based on the domain name
DNS No Such Name	DNS No Such Name	NXDomain query detection
DNS Format Error	DNS Format Error	DNS packet validity check
DNS Size Abnormal	DNS Size Abnormal	DNS query packet length limiting
DNS Size Abnormal	DNS Size Abnormal	DNS reply packet length limiting
SIP Flood	SIP Flood	SIP source detection
SIP Source Rate Abnormity	SIP Source Rate Abnormity	SIP rate limiting based on the source IP address
HTTP Flood	HTTP Flood	302 redirect
		Verification code
		Cookie source authentication
		JavaScript redirect
		HTTP first-packet check
		HTTP fingerprint learning
		Proxy detection
		SYN packet rate limiting
		ACK packet rate limiting
HTTP Slow Attack	HTTP Slow Attack	HTTP low-rate connection attack defense
URI Monitor	URI Monitor	Source IP-based URI behavior monitoring
HTTPS Flood	HTTPS Flood	HTTPS source authentication defense
		SSL defense by checking the number of renegotiation times
		SSL defense session check
Single IP Bandwidth Overflow	Single IP Bandwidth Overflow	Bandwidth limiting for a single destination IP address
Zone Bandwidth Overflow	Zone Bandwidth Overflow	Zone bandwidth limiting
IP Reputation	IP Reputation	IP reputation
Host Traffic Over Flow	Host Traffic Over Flow	Second-level blackhole
Anti-Malware	Anti-Malware	DoS attack tool against malicious traffic filtering
Malicious Domains Attack	Malicious Domains Attack	Domain audit
Location Attack	Location Attack	Location policy
Filter Attack	Filter Attack	Filter
Blacklist	Blacklist	Blacklist
Global TCP Abnormal	Global TCP Abnormal	TCP blocking
		TCP new session rate limiting
		Total new session rate limiting
		Packet discarding by the firewall during packet forwarding
Global TCP Fragment Abnormal	Global TCP Fragment Abnormal	TCP new session rate limiting
		Total new session rate limiting
		Packet discarding by the firewall during packet forwarding
Global UDP Abnormal	Global UDP Abnormal	UDP blocking
		UDP new session rate limiting
		Total new session rate limiting
		Packet discarding by the firewall during packet forwarding
Global UDP Fragment Abnormal	Global UDP Fragment Abnormal	UDP new session rate limiting
		Total new session rate limiting
		Packet discarding by the firewall during packet forwarding
Global ICMP Abnormal	Global ICMP Abnormal	ICMP blocking
		ICMP new session rate limiting
		Total new session rate limiting
		Packet discarding by the firewall during packet forwarding
Global Other Abnormal	Global Other Abnormal	Other blocking
		Other new session rate limiting
		Total new session rate limiting
		Packet discarding by the firewall during packet forwarding