Security::ProfileDoS¶

Introduced : BIG-IP_v11.3.0

The ProfileDoS interface enables you to manipulate a DoS profile. Use this interface to prevent Denial of Service (DoS) attacks. DoS profile consists of three parts (layers): Application Security, Protocol (DNS) Security and Protocol SIP Security. Each part can be enabled or disabled by means of creating or deleting the corresponding sub-profile. In Application Security you can configure: - The circumstances under which the system considers traffic to be a DoS attack. - How the system handles a DoS attack. The system considers traffic to be an Application DoS attack based on the following calculations: - Transaction rate detection interval: The average number of requests per second sent for a specific URL, or by a specific IP address. This number is calculated by the system, by default, every minute and updated every second. - Transaction rate history interval: The average number of requests per second sent for a specific URL, or by a specific IP address. This number is calculated by the system, by default, every hour and updated every minute. - Latency detection interval: The average time it takes for the system to respond to a request for a specific URL, over the last minute. This average is updated every second. - Latency history interval: The average time it takes for the system to respond to a request for a specific URL, over the last hour. This average is updated every minute. In this sub-profile you must select whether the system prevents DoS attacks based on the client side (TPS-based anomaly) or/and the server side (Latency-based anomaly). The system&aposs DoS attack prevention works differently for every anomaly you select. - In TPS-based anomaly: If the ratio of the transaction rate detection interval to the transaction rate history interval is greater than the specific percentage you configure in this sub-profile (the TPS increase rate), the system detects the URL to be under attack, or the IP address to be attacking. In order to stop the attack, the system drops some requests from the detected IP address and/to the attacked URL. - In Latency-based anomaly: If the ratio of the transaction rate detection interval to the transaction rate history interval is greater than the specific percentage you configure in this sub-profile (the TPS increase rate), the system suspects the URL to be under attack, or the IP address to be suspicious. If the ratio of the latency detection interval to the latency history interval is greater than the specific percentage you configure in this sub-profile (the latency increase rate), the system detects that this URL is under attack. In order to stop the attack, the system drops some requests from the suspicious IP address and/or to the suspicious URL. The Protocol DNS Security sub-profile allows you to specify DNS Query Vectors to be considered for DoS attack detection. You can also select whether or not to consider Malformed and Malicious DNS packets for DoS attack detection, and configure values at which to start dropping these packets. A Protocol SIP Security sub-profile allows the user to configure SIP Attack Vectors that are to be considered for DoS attack detection. It also provides the capability to enable detection of Malformed SIP packet DoS attacks. The detection sensitivity for each of the configured DoS vectors can also be set.