CCNP Security IPS 642-627 Official Cert Guide

Chapter 11. Deploying Anomaly-Based Operation

This chapter describes the functions and operations of anomaly detection in the sensor. This covers the following:

• Anomaly Detection Components: The ingredients that go into the recipe called anomaly detection.

• Configuring Anomaly Detection: Putting the anomaly detection system to work and customizing for the needs of your network.

• Verifying Anomaly Detection: Making sure that anomaly detection is working and creating the results intended.

Overview

The anomaly detection built in to the Cisco Intrusion Prevention System (IPS) has the ability to identify some self-propagating worms in the network. This allows the sensor to take actions to prevent spreading of a worm across the entire network. ...