{"id":22611,"date":"2023-01-06T08:21:24","date_gmt":"2023-01-06T08:21:24","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=22611"},"modified":"2026-04-17T18:07:42","modified_gmt":"2026-04-17T18:07:42","slug":"nips-v5-6r10-rule-types","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/nips-v5-6r10-rule-types\/","title":{"rendered":"NIPS V5.6R10 Rule Types"},"content":{"rendered":"\n

NIPS V5.6R10 has five types of rules to detect DDoS attacks, local privilege elevation, information gathering, suspicious network behaviors, and network monitoring events, respectively. They are described as follows.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

1. Information gathering<\/h2>\n\n\n\n

Information gathering is the first step of network intrusion. Attackers use various methods to scan and probe target hosts and identify paths to discover vulnerabilities on target servers. NIPS rule database contains rules for detecting directory traversal, information leak vulnerability exploitation, port scan, and so on.<\/p>\n\n\n\n

Note that directory traversal vulnerability detection is strongly associated with web applications. If some web application signatures match IPS built-in vulnerability detection rules, legitimate traffic may trigger alerts. Handle alerts according to the actual situation.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

2. Local privilege elevation<\/h2>\n\n\n\n

Attackers exploit the vulnerabilities on compromised hosts to start intrusion and obtain the server privilege for global control. NIPS rule database contains rules for detecting remote code execution, SQL injection, file inclusion, file upload, XSS, overflow attack, and other attacks.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

3. Suspicious network behavior<\/h2>\n\n\n\n

Generally, trojans or worms on compromised hosts perform suspicious network behaviors, such as malicious connections to external targets and cryptomining. NIPS rule database contains rules for detecting trojan communication, trojan file upload, worm, cryptomining, and other attacks. NIPS can detect HTTP\/SMTP file upload behaviors of trojans and worms.<\/p>\n\n\n\n

Note that suspicious network events are critical ones. If such events are alerted, trace back the source IP and check the server for a trojan infection.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

4. DDoS attacks<\/h2>\n\n\n\n

In a DDoS attack, attackers overflow the server with massive connection requests or exhaust the server’s resources or bandwidth to make it unresponsive to legitimate access.<\/p>\n\n\n\n

NIPS rule database contains rules for detecting flood, port scan, and DDoS vulnerability exploit of common components, such as buffer overflows and memory leaks.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Notes: <\/p>\n\n\n\n