attack-trace probability

Function

The attack-trace probability command configures the threshold for determining the probability of an attack event.

The undo attack-trace probability command deletes the configured threshold for determining the probability of an attack event.

The default parameters for configuring the threshold for determining the probability of an attack event are described in the parameter description.

Format

attack-trace probability { top5-user { determined threshold-value | suspicion threshold-value | notification threshold-value } | top5-source-mac { determined threshold-value | suspicion threshold-value | notification threshold-value } | top5-source-ip { determined threshold-value | suspicion threshold-value | notification threshold-value } | broadcast-flood { determined threshold-value | suspicion threshold-value | notification threshold-value } | app-error-percent { determined threshold-value | suspicion threshold-value | notification threshold-value } }

undo attack-trace probability { top5-user { determined [ threshold-value ] | suspicion [ threshold-value ] | notification [ threshold-value ] } | top5-source-mac { determined [ threshold-value ] | suspicion [ threshold-value ] | notification [ threshold-value ] } | top5-source-ip { determined [ threshold-value ] | suspicion [ threshold-value ] | notification [ threshold-value ] } | broadcast-flood { determined [ threshold-value ] | suspicion [ threshold-value ] | notification [ threshold-value ] } | app-error-percent { determined [ threshold-value ] | suspicion [ threshold-value ] | notification [ threshold-value ] } }

Parameters

Parameter	Description	Value
top5-user	Indicates the top 5 VLAN packets in sampled packets, including single-tagged and double-tagged VLAN packets.	-
determined threshold-value	Specifies the threshold for the percentage of the number of packets with specified characteristics to the total number of sampled packets. If the percentage is greater than or equal to the threshold, an attack event is determined.	If top5-user determined threshold-value is configured, the value is an integer ranging from 80 to 99, and the default value is 80. If top5-source-mac determined threshold-value is configured, the value is an integer ranging from 80 to 99, and the default value is 80. If top5-source-ip determined threshold-value is configured, the value is an integer ranging from 80 to 99, and the default value is 80. If broadcast-flood determined threshold-value is configured, the value is an integer ranging from 90 to 99, and the default value is 90. If app-error-percent determined threshold-value is configured, the value is an integer ranging from 90 to 99, and the default value is 90.
suspicion threshold-value	Specifies the suspicion threshold for the percentage of the number of packets with specified characteristics to the total number of sampled packets. If the percentage is greater than or equal to the threshold, an attack event is suspicious.	If top5-user suspicion threshold-value is configured, the value is an integer ranging from 60 to 80, and the default value is 60. If top5-source-mac suspicion threshold-value is configured, the value is an integer ranging from 60 to 80, and the default value is 60. If top5-source-ip suspicion threshold-value is configured, the value is an integer ranging from 60 to 80, and the default value is 60. If broadcast-flood suspicion threshold-value is configured, the value is an integer ranging from 70 to 90, and the default value is 70. If app-error-percent suspicion threshold-value is configured, the value is an integer ranging from 75 to 90, and the default value is 75.
notification threshold-value	Specifies the notification threshold for the percentage of the number of packets with specified characteristics to the total number of sampled packets. If the percentage is greater than or equal to the threshold, the system displays a possible attack event. If the percentage is lower than the threshold, no action is required. notification indicates a lower probability of an attack event than suspicion.	If top5-user notification threshold-value is configured, the value is an integer ranging from 40 to 60, and the default value is 40. If top5-source-mac notification threshold-value is configured, the value is an integer ranging from 40 to 60, and the default value is 40. If top5-source-ip notification threshold-value is configured, the value is an integer ranging from 40 to 60, and the default value is 40. If broadcast-flood notification threshold-value is configured, the value is an integer ranging from 50 to 70, and the default value is 50. If app-error-percent notification threshold-value is configured, the value is an integer ranging from 60 to 75, and the default value is 60.
top5-source-mac	Indicates the top 5 packets listed by source MAC addresses in sampled packets.	-
top5-source-ip	Indicates the top 5 packets listed by source IP addresses in sampled packets.	-
broadcast-flood	Indicates the broadcast packets in sampled packets.	-
app-error-percent	Indicates the invalid packets and sessions on a protocol module.	-

Views

SOC view

Default Level

2: Configuration level

Task Name and Operations

Task Name	Operations
soc	write

Usage Guidelines

Usage Scenario

If the threshold for determining the probability of an attack event does not satisfy the existing network conditions, and attack event reports present incorrect or missing decisions on attack events, run the attack-trace probability command to adjust the threshold for determining the probability of an attack event based on actual conditions to allow attack source tracing to function precisely.

NOTE:

top5-user, top5-source-mac, top5-source-ip, broadcast-flood, and app-error-percent parameters can be separately configured in different command instances, and the configurations do not override.

Configuration Impact

Inappropriate attack source tracing thresholds may cause incorrect or missing decisions on attack events.

Precautions

It is recommended that you run this command with assistance from Huawei engineers.

In VS mode, this command is supported only by the admin VS.

Example

# Configure the threshold for the percentage of top 5 packets listed by source MAC addresses in sampled packets to the total number of sampled packets as 95, and the attack event is determined if the percentage is greater than or equal to 95.

<HUAWEI> system-view
[~HUAWEI] soc
[*HUAWEI-soc] attack-trace probability top5-source-mac determined 95