A dynamic DoS attack is a DoS attack that doesn't fit predefined DoS vector criteria. Using dynamic DoS attack detection, such attacks can be detected and mitigated automatically by AFM. Dynamic DoS detection creates vector signatures for attacks based on changing traffic patterns over time. When an attack is detected, a vector signature is created and added to a list of dynamic vectors. All packets are then checked against the dynamic vector, and mitigated according to internal logic. When packet processing on the system falls back to normal levels, the signature no longer appears as an attack, and is removed from the dynamic signature list.

Detection modes

Mitigation Sensitivity

Mitigation sensitivity establishes how aggressively the system mitigates dynamic DoS attacks. You can set this to None, Low, Medium, or High. By default, mitigation sensitivity is set to None. Low sensitivity is the least aggressive, at the risk of allowing more attack packets through. High drops packets more aggressively, even when attack confidence is lower.

Redirection/Scrubbing

You can configure redirection and scrubbing to handle mitigation of dynamic DoS signatures with an IP Intelligence category. The following parameters can be configured for redirection and scrubbing.

Scrubbing Category

You can select an IP Intelligence category for IP addresses blocked by dynamic DoS signatures. By default, the IP intelligence category for scrubbed IP addresses is attacked_ips.

Scrubbing Advertisement Time

This is the duration for which a mitigated IP is advertised to the IP Intelligence mechanism for scrubbing. The default is 300 seconds.

Start Relearning

The Start Relearning option clears historical data, thresholds and signatures for the dynamic DoS detection system. The Dynamic DoS signature baseline is re-established. Relearning occurs for a period of 20 minutes.