Mappings Between Attack Types and Defense Policies

**Table 1** Mapping between attack types and defense policies
Attack Type	Attack Type Displayed on the ATIC	Defense Policy
SYN Flood	SYN flood	error-seq source authentication
		right-seq source authentication
		First-packet check
		SYN-ratio anomaly rate limiting based on the source IP address
ACK Flood	ACK flood	Session strict mode check
		Session loose mode check
		ACK first-packet check
SYN-ACK Flood	SYN-ACK Flood	Source authentication defense
		TCP first-packet check
		Abnormal session check
RST/FIN Flood	FIN-RST flood	Session check
RST/FIN Flood	FIN-RST flood	TCP first-packet check
TCP Fragmentation Flood	TCP fragment flood	TCP fragment attack defense
TCP Connection Flood	TCP connection flood	New session check based on the source IP address
		Concurrent session check based on the source IP address
		Null connection check
		Retransmission session check
		SockStress check
		ACK session check
		SYN session check
TCP Malformed	TCP Malformed	TCP malformed packet defense
TCP Bandwidth Overflow	TCP Bandwidth Overflow	TCP bandwidth limiting
TCP Fragment Bandwidth Overflow	TCP Fragment Bandwidth Overflow	TCP fragment bandwidth limiting
UDP Flood	UDP Flood	Fingerprint defense
UDP Fragment Flood	UDP Fragment Flood	UDP fragment attack defense
UDP Bandwidth Overflow	UDP Bandwidth Overflow	UDP bandwidth limiting
UDP Fragment Bandwidth Overflow	UDP Fragment Bandwidth Overflow	UDP fragment bandwidth limiting
UDP Malformed	UDP Malformed	UDP malformed packet defense
ICMP Flood	ICMP Flood	ICMP rate limiting
Other Flood	Other Flood	Other defense
Other Bandwidth Overflow	Other Bandwidth Overflow	Other bandwidth limiting
DNS Query Flood	DNS Query Flood	DNS cache server TCP authentication
		DNS authorization server CNAME authentication
		Passive defense
DNS Reply Flood	DNS Reply flood	Reply authentication defense
Source DNS Query Flow Abnormal	Source DNS Query Flow Abnormal	DNS query packet rate limiting based on the source IP address
Source DNS Reply Flow Abnormal	Source DNS Reply Flow Abnormal	DNS reply packet rate limiting based on the source IP address
DNS Query Domain Flow Abnormal	DNS Query Domain Flow Abnormal	DNS query packet rate limiting based on the domain name
DNS Reply Domain Flow Abnormal	DNS Reply Domain Flow Abnormal	DNS reply packet rate limiting based on the domain name
DNS No Such Name	DNS No Such Name	NXDomain request detection
DNS Format Error	DNS Format Error	DNS packet validity check
DNS Size Abnormal	DNS Size Abnormal	DNS query packet length limiting
DNS Size Abnormal	DNS Size Abnormal	DNS reply packet length limiting
SIP Flood	SIP Flood	SIP source detection
SIP Source Rate Abnormity	SIP Source Rate Abnormity	SIP rate limiting based on the source IP address
HTTP Flood	HTTP Flood	302 redirect
		Verification code
		Cookie source authentication
		JavaScript redirect
		HTTP first-packet check
		HTTP fingerprint learning
		Proxy detection
		SYN packet rate limiting
		ACK packet rate limiting
		Large resource detection
		High frequency requests detection
		Single URI detection
HTTP Connection Flood	HTTP Connection Flood	HTTP slow attack detection
HTTP Connection Flood	HTTP Connection Flood	Abnormal connections detection
HTTPS Flood	HTTPS Flood	HTTPS source authentication defense
		Large resource detection
		High frequency requests detection
		Fixed resource monitoring
TLS Connection Flood	TLS Connection Flood	TLS defense by checking the number of renegotiation times
		TLS defense session check
		Null connection detection
Single IP Bandwidth Overflow	Single IP Bandwidth Overflow	Bandwidth limiting for a single destination IP address
Zone Bandwidth Overflow	Zone Bandwidth Overflow	Zone bandwidth limiting
IP Reputation	IP Reputation	IP reputation
Host Traffic Over Flow	Host Traffic Over Flow	Second-level blackhole
Malicious Domains Attack	Malicious Domains Attack	Domain audit
Location Attack	Location Attack	Location policy
Filter Attack	Filter Attack	Filter
Blacklist	Blacklist	Blacklist
Global TCP Abnormal	Global TCP Abnormal	TCP blocking
Global TCP Abnormal	Global TCP Abnormal	TCP new session rate limiting
Global TCP Fragment Abnormal	Global TCP Abnormal	TCP fragment blocking
Global UDP Abnormal	Global UDP Abnormal	UDP blocking
Global UDP Abnormal	Global UDP Abnormal	UDP new session rate limiting
Global Other Abnormal	Global Other Abnormal	Other blocking
Global Other Abnormal	Global Other Abnormal	Other new session rate limiting