 |
PCA can be used to defend against these zero-day attacks.
It store all received packets as full packet.
When a new pattern of attacks is discovered, it checks stored packets in the PCA.
Through this process, PCA checks that newly discovered attacks have been received in the past.
It can respond to zero-day attacks to some extent through PCA.
But, PCA requires equipment with very large storage capacity. Because it has to store all packets as full packet.
Therefore, PCA is very expensive and the packet storage period is very limited.
Thus, PCA was introduced to store a few packets, not all received packets.
Flow based PCA utilize technologies such as Frist-N to store only some packets in flow.
It increase storage efficiency compared to traditional PCA by reducing the number of packet stores.
However, It isn¡¯t sure which of the packet in flow is matched to the rule.
|
IEEE/ICACT20210179 Slide.04
[Big Slide]