Radware DefensePro: Reports and Statistics

Radware DefensePro protects network traffic from attacks and performs behavioural traffic analysis. It automatically detects and blocks attacks in real-time by continuously learning static network traffic. Customers who use this security solution for their services can view detailed information about filtered attacks in the Network services tab in Customer Administration.

Section Description and Report Filter

Log in to Customer Administration at https://admin.masterdc.com/en/. Once logged in, select Network services from the left-hand side menu. Here, you can find the Radware Network Protection service.

Selecting this item will show you the service details and payment information. Next, navigate to the Statistics tab, where you will find options for filtering out blocked or even occurring attacks.

Filtering

• Time Interval/From Date-To Date – The period of which you want to list the attacks.
• Category – The type of attacks.
• Risk – Attack risk classification.
• Action – Any action taken against the attacks, description in Table 1.
• Attack Status – Information about the attack’s current status, description in Table 2.
• Source IP and Port – The attack’s source IP.
• Destination IP and Port – The attack destination IP.

Table 1: Description of Actions Taken Against Attacks.

Table 2: Description of Attack Status.

Once the attacks have been filtered, you will see a detailed description of the threat alongside the basic parameters, including recommendations on what steps to take to eliminate future risks.

Behavioural DoS Attacks

For behavioural DoS attacks, you can view a more detailed report, including the footprint (i.e. automatically generated filter to attack removal), characteristics, and attack graph. Click on the Detail button on the BDoS in the listing to display these details.

Footprint Tab

The Footprint tab contains an automatically generated attack traffic filter generated by the DefensePro behavioural module in the following form:

Table 3 below explains the different values of this figure.

Table 3: Footprint Value Explanation.

Characteristics Tab

Additional attack details are in the Characteristics tab, which overlaps with some of the values in Table 3. However, the tab also contains information about the attack length and strength or the current protection process state. These values are described in Table 4.

Table 4: Characteristics Tab, Values Description.

Footprint Generation States

• Footprint Analysis – BDoS protection has detected an attack and is currently generating an attack footprint.
• Footprint-Applied – BDoS protection is blocking the attack based on the generated footprint. BDoS protection optimizes the footprint rule through a closed-feedback loop operation, achieving the narrowest effective mitigation rule.
• Burst-Footprint-Blocking – BDoS protection blocks the burst attack based on the footprint generated by the previous states. This state remains until the burst attack terminates or the specified Maximum Burst-Attack Period is reached.
• Footprint-Is-Overblocking – BDoS protection started blocking the attack but stopped three times after identifying an overblocking situation. This state remains for 10 minutes, after which BDoS protection generates and implements a new footprint.
• Non-Attack – Nothing was blocked because the traffic was not an attack. No footprint was detected, or the blocking strictness level was not met.

Attack Graph

In the last tab, you will find a generated graphical representation of the attack compared to normal network traffic. You can download the graph in PNG, JPEG, PDF, or SVG format.