Description

Dynamic Baseline Learning

In attack detection, the detection device collects statistics on traffic and then compares the traffic with the pre-defined threshold. If the traffic hits the threshold, the device considers that an anomaly occurs and reports the anomaly to the ATIC. Therefore, attack judgment is subject to the specified threshold; however, different networks have diversified applications, each of which is equipped with its actual bandwidth.

• If the threshold is set to a smaller value, the system enables attack defense even if no attack occurs.
• If the threshold is set to a larger value, the system cannot enable attack defense in a timely manner.

Therefore, before you configure the threshold, learn about the basic traffic model first.

The abnormal traffic cleaning solution supports dynamic baseline learning of traffic. In dynamic baseline learning, the anti-DDoS device collects network traffic statistics in a specified period of time, learning the peak volume of traffic, and presents the curve chart in the management center to the administrator.

You are advised not to set the defense threshold before the dynamic baseline learning period ends. After dynamic baseline learning is complete, you can manually deliver the learning result as the defense threshold. The threshold must be set to a value higher than normal peak traffic.

The dynamic baseline can be learned repeatedly to cope with the changes of network traffic models.

Baseline Learning Types

The AntiDDoS and AntiDDoS1820-N provide baseline learning for common defense policies. You can learn the baselines to understand the routine baseline values of various protocol traffic on the live network, so that you can configure appropriate defense policies. Table 1 lists the baseline learning types supported by the AntiDDoS. Table 2 lists the baseline learning types supported by the AntiDDoS1820-N.