MITRE D3FENDdefensive technique

D3-ISVA Inbound Session Volume Analysis

Official page ↗
Tactic
Detect

Definition

Analyzing inbound network session or connection attempt volume.

How it works

How it works Network appliances are configured to alert on certain packets that typically are involved in DoS attacks. Typical packets include ICMP packets and SYN requests that are commonly used to flood networks. A sampling period is used to define a time window in which collected counts of the identified packets can be measured. If the collected number of packets exceeds a predefined limit then an alert is generated. Considerations Scalability as volume of attacks increase; single servers may not have the memory and storage resources to handle high volumes of network traffic.

Related

Counters · MITRE ATT&CK (12)

  • T0819 Exploit Public-Facing Application technique
  • T0822 External Remote Services technique
  • T0865 Spearphishing Attachment technique
  • T1498.001 Direct Network Flood sub-technique
  • T1498.002 Reflection Amplification sub-technique
  • T1566 Phishing technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1499.002 Service Exhaustion Flood sub-technique
  • T1499 Endpoint Denial of Service technique
  • T1498 Network Denial of Service technique
  • T1190 Exploit Public-Facing Application technique

Child of · MITRE D3FEND (1)

  • D3-NTA Network Traffic Analysis defensive technique

References