Threat intelligence

This help contains the following topics:

IP reputation

Introduction

IP reputation uses the IP address information on the local IP reputation to filter network traffic. The local IP reputation includes the IP reputation signature library loaded on the device and the historical query results from the cloud server, that is, the local IP reputation cache.

IP reputation signature library

The IP reputation signature library contains the attack category, suggested action, and logging information for IP addresses with potential risks of attacks, such as DDoS, command injection attacks, Trojan virus download attacks, or port scan.

Cloud server

The cloud server provides the device with IP reputation cloud query to enhance the locally loaded IP reputation signature library. When the IP reputation signature library cannot match the IP address information in the packet, IP reputation cloud query can be used to send the IP address information to the cloud server for query. After the cloud server completes the detection, it sends the detection results to the device. Then, the device will save the results to the local IP reputation cache. This allows subsequent packets to be directly matched against IP reputation information locally, without the need for further cloud server queries.

Attack category and action

The device takes an action (drop or permit) when the source IP address or destination IP address of a packet has a hit on the local IP reputation. Logging for the packet is also supported.

On the local IP reputation, an IP address might belong to multiple attack categories. Each attack category has an associated action.

If an IP address belongs to only one attack category, the action that the device takes on matching packets is consistent with the action of the attack category. If an IP address belongs to multiple attack categories, the device takes an action that has highest priority among all actions of the attack categories. The drop action has higher priority than the permit action.

If logging is enabled for any one of attack categories to which the IP address belongs, the device generates a log for the matching packets.

Exception IP list

A packet is forwarded if its source IP address or destination IP address has a match on the exception IP list. The device does not perform IP reputation check on subsequent IP packets with this source or destination IP address.

Blacklist operation

The device supports adding IP addresses on the local IP reputation to or removing them from the blacklist. An IP address on the local IP reputation can be added to the source address blacklist or destination address blacklist, depending on direction attribute of the IP address.

All IP addresses on the local IP reputation are public addresses. The VRF is public network for blacklist entries that are added based on IP reputation.

The default aging time for blacklist entries is 7 days. To modify the aging time, access the Policies > Active Defense > Blacklist page.

For more information about the blacklist, see the attack defense help.

IP reputation workflow

Figure-1 describes the IP reputation workflow.

Figure-1 IP reputation workflow

IP reputation processes a packet as follows:

  1. The device determines whether the source IP address or destination IP address has a match on the exception IP list. If a match is found, the packet is passed through. If no match exists, the device proceeds to the next step.

  2. The device determines whether the source IP address or destination IP address has a match on the local IP reputation. IP addresses on the local IP reputation has the direction attribute, including source, destination, and bidirection. The match succeeds only when the IP address in the packet has the same direction attribute as the IP address on the local IP reputation. If the direction attribute of an IP address is bidirection, the match succeeds if the source or destination IP address is the same as the IP address on the local IP reputation.

    • If a match is found, the device takes an action based on the attack category of the IP address. If no match exists, the device forwards the packet. The device supports the following actions:

      • Permit—Allows packets to pass through.

      • Drop—Drops packets.

      • Logging—Generates IP reputation logs.

    • If no match is found, the device identifies whether cloud query is enabled. If cloud query is enabled, the device will permit the packet to pass through and send the IP address information to the cloud server for query. The device will then save the query results from the server to the local IP reputation cache. This allows subsequent packets to be matched locally against the IP reputation, without the need for further cloud server query. If cloud query is not enabled, the device will directly permit the packet to pass through.

vSystem support information

Support of non-default vSystems for this feature depends on the device model. This feature is available on the Web interface only if it is supported.

Licensing requirements

To use IP reputation, you must purchase a threat intelligence license and install it correctly. When the license expires, the existing IP reputation signature library is still available. However, you cannot upgrade the signature library to the version released after the license expires and the cloud query feature is unavailable. For more information about licensing, see the license management help.

Restrictions and guidelines

Configure IP reputation

Prerequisites

Complete the following tasks before you configure this feature:

Enable IP reputation

  1. Click the Policies tab.

  2. In the navigation pane, select Active Defense > Threat Intelligence > IP Reputation.

  3. Enable IP reputation.

    Figure-2 IP reputation

  4. To query an IP address, click IP address search, enter the IP address, and click Search. Information about the IP address is displayed. You can add the IP address to or remove it from the blacklist or exception IP list.

    Figure-3 Querying an IP address

Enable cloud query for IP reputation

  1. Click the Policies tab.

  2. In the navigation pane, select Active Defense > Threat Intelligence

  3. In the IP reputation section, enable IP reputation.

  4. In the IP reputation section, enable Cloud query for IP reputation.

    Figure-4 Cloud query for IP reputation

Enable top hit statistics collection

  1. Click the Policies tab.

  2. In the navigation pane, select Active Defense > Threat Intelligence > IP Reputation.

  3. Enable IP reputation.

  4. Enable IP address hit statistics.

    Figure-5 IP address hit statististics

  5. To open the Top Hit Statistics page, click Top hit statistics. To view top hit statistics ranking information, configure statistics conditions. You can also add an IP address to or remove it from the blacklist or exception IP list.

    Figure-6 Top hit statistics

Configure the action for an attack category

  1. Click the Policies tab.

  2. In the navigation pane, select Active Defense > Threat Intelligence > IP Reputation.

  3. Enable IP reputation.

  4. In the Action configuration area, configure an action for an attack category. The following actions are supported.

    • Permit—Allows packets to pass through.

    • Drop—Drops packets.

  5. To restore the default configuration, click Restore default.

    Figure-7 Action configuration

  6. Click Apply.

Configure the exception IP list

  1. Click the Policies tab.

  2. In the navigation pane, select Active Defense > Threat Intelligence > IP Reputation.

  3. Enable IP reputation.

  4. In the Exception IP list area, enter IP addresses. Each IP address occupies a line.

    Figure-8 Exception IP list

  5. Click Apply.

URL reputation

Introduction

URL reputation restricts user online behaviors by blocking access to malicious URLs based on the URL reputation signature library. The local URL reputation includes the URL reputation signature library loaded on the device and the historical query results from the cloud server, that is, the local URL reputation cache.

URL reputation signature library

The signature library is a collection of malicious URLs, including the attack category to which each URL belongs and the actions for an attack category.

Cloud server

The cloud server provides the device with URL reputation cloud query to enhance the locally loaded URL reputation signature library. When the URL reputation signature library cannot match the URL information in the packet, URL reputation cloud query can be used to send the URL information to the cloud server for query. After the cloud server completes the detection, it sends the detection results to the device. Then, the device will save the results to the local URL reputation cache. This allows subsequent packets to be directly matched against URL reputation information locally, without the need for further cloud server queries.

vSystem support information

Support of non-default vSystems for this feature depends on the device model. This feature is available on the Web interface only if it is supported.

Licensing requirements

To use URL reputation, you must purchase a threat intelligence license and install it correctly. When the license expires, the existing URL reputation signature library is still available but you cannot upgrade the signature library to the version released after the license expires. For more information about licensing, see the license management help.

Restrictions and guidelines

A threat intelligence license is required for URL reputation. If the license expires, the existing URL reputation signature library is still available but you cannot upgrade the library on the device. For more information about licenses, see license online help.

Configure URL reputation

Prerequisites

Complete the following tasks before you configure this feature:

Enable URL reputation

  1. Click the Objects tab.

  2. In the navigation pane, select APP Security > URL Filtering > Profiles.

  3. Create or edit a URL filtering profile.

    1. To create a URL filtering profile, click Create. On the dialog box that opens, specify a name for the URL filtering profile. To edit an existing URL filtering profile, click Edit for that URL filtering profile. On the dialog box that opens, edit the URL filtering profile.

    2. Configure the actions for individual attack categories in the URL reputation signature library. When the device receives a packet, it extracts the URL of the packet and determines whether the URL matches an attack category in the URL reputation signature library. If yes, the device takes the action specified for the attack category on the packet.

    3. Turn on the Enable URL reputation feature.

      Figure-9 URL reputation

  4. Click OK.

Domain reputation

Introduction

Domain reputation uses the domain name information in the local domain reputation to filter network traffic. The local domain reputation includes the domain reputation signature library loaded on the device and the historical query results from the cloud server, that is, the local domain reputation cache.

Domain reputation signature library

The domain reputation signature library contains domain names with risks such as zombie host DDoS attacks, command injection attacks, Trojan virus download attacks, or port scan. The signature library contains information such as the attack type of each domain name, the recommended action, and whether to record logs. For more information, see the signature upgrade help.

Cloud server

The cloud server provides the device with domain reputation cloud query to enhance the locally loaded domain reputation signature library. When the domain reputation signature library cannot match the IP address information in the packet, domain reputation cloud query can be used to send the domain name information to the cloud server for query. After the cloud server completes the detection, it sends the detection results to the device. Then, the device will save the results to the local domain reputation cache. This allows subsequent packets to be directly matched against domain reputation information locally, without the need for further cloud server queries.

Attack category and action

The device takes an action (drop or permit) when the domain name of a DNS packet has a hit in the local domain reputation. Logging for the packet is also supported.

In the domain reputation signature library, a domain name might belong to multiple attack categories. Each attack category has an associated action.

If a domain name belongs to only one attack category, the device takes the action of the attack category on the packet. If a domain name belongs to multiple attack categories, the device takes an action that has the highest priority among all actions of the attack categories. The drop action has higher priority than the permit action.

If logging is enabled for any one of attack categories to which the domain name belongs, the device generates a log for the matching packets.

Domain reputation workflow

Figure-10 describes the domain reputation workflow.

Figure-10 Domain reputation workflow

Domain reputation processes a packet as follows:

  1. The device determines whether the domain name in the packet has a match on the domain name exception list. If a match is found, the packet is forwarded directly. If no match exists, the device proceeds to the next step.

  2. The device determines whether the domain name has a match in the local domain reputation and takes the corresponding action.

    • If a match is found, the device takes the action of the matching attack category.

    • If more than one match is found, the device takes the action that has the highest priority among all the actions of the attack categories.

      The following actions are supported:

      • Permit—Allows packets to pass through.

      • Drop—Drops packets.

      • Logging—Generates domain reputation logs.

    • If no match is found, the device identifies whether cloud query is enabled. If cloud query is enabled, the device will permit the packet to pass through and send the domain name information to the cloud server for query. The device will then save the query results from the server to the local domain reputation cache. This allows subsequent packets to be matched locally against the domain reputation, without the need for further cloud server query. If cloud query is not enabled, the device will directly permit the packet to pass through.

Domain name exception list

A packet is forwarded directly if it contains a domain name on the domain name exception list. The device does not perform domain reputation check on the packet.

vSystem support information

Support of non-default vSystems for this feature depends on the device model. This feature is available on the Web interface only if it is supported.

Licensing requirements

To use domain reputation, you must purchase a license and install it correctly. When the license expires, the existing domain reputation signature library is still available. However, you cannot upgrade the signature library to the version released after the license expires and the cloud query feature is unavailable. For more information about licensing, see the license management help.

Restrictions and guidelines

Configure domain reputation

Prerequisites

Complete the following tasks before you configure this feature:

Enable domain reputation

  1. Click the Policies tab.

  2. In the navigation pane, select Active Defense > Threat Intelligence > Domain Reputation.

  3. Enable Domain Reputation.

    Figure-11 Domain reputation

  4. To search for a domain name, click Domain name search, enter the domain name, and click Search. Information about the matching domain name is displayed. You can add the domain name to or remove it from the domain name exception list.

    Figure-12 Searching for a domain name

  5. Enable Cloud query for domain name reputation.

    Figure-13 Cloud query for domain name reputation

  6. Enable Domain name hit statistics.

    Figure-14 Domain name hit statistics

  7. To open the Top Hit Statistics page, click Top hit statistics. To view top hit statistics ranking information, configure statistics conditions. You can also add a domain name to or remove it from the domain name exception list.

    Figure-15 Top hit statistics

  8. In the Action configuration area, configure an action for an attack category. The following actions are supported:

    • Permit—Allows packets to pass through.

    • Drop—Drops packets.

  9. To restore the default configuration, click Restore default.

    Figure-16 Action configuration

  10. Click Apply.

Configure the domain name exception list

  1. Click the Policies tab.

  2. In the navigation pane, select Active Defense > Threat Intelligence > Domain Reputation.

  3. In the Advanced settings area, enter exceptional domain names. Each domain name occupies a line.

    Figure-17 Exceptional domain names

  4. Click Apply.

Intelligences from the threat management platform

Introduction

The device supports receiving intelligences from the threat management platform (Threat Discovery and Security Operations Platform), including IP reputation, URL reputation, domain reputation, and MD5 reputation. The intelligences supplement the locally loaded reputation and antivirus signature libraries, improving security for internal network users.

vSystem support information

Support of non-default vSystems for this feature depends on the device model. This feature is available on the Web interface only if it is supported.

Restrictions and guidelines