Network Attacks and Defenses

216  ◾  Network Attacks and Defenses: A Hands-on Approach

− Next, create an attack signature, as shown in the fol-

lowing screenshot. An attack signature indicates the

part of the payload data which the Deep Inspection

will be applied. For the security policy (SP#1), the

attack signature states that the payload data of the

Web (HTTP) traffic is inspected to verify whether it

contains the word “bomb.” The attack context (which

is the part of the payload data that will be inspected)

is “HTTP Text and HTML Data”, and the attack pat-

tern (.*bomb.*) is any string that contains the word

“bomb.”

− Next, create an attack group, as shown in the screen- ...