# embeddings_queue

created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 3f2386f6-027b-48af-933b-53df013fc592
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 105, "full_page_content": "106 \n \n \nOne example of a stealth virus was discussed earlier: a virus that uses compression \nso that the infected program is exactly the same length as an uninfected version. Far more \nsophisticated techniques are possible. For example, a virus can place intercept logic in \ndisk I/O routines, so that when there is an attempt to read suspected portions of the disk \nusing these routines, the virus will present back the original, uninfected program.  \nA polymorphic virus creates copies during replication that are functionally equivalent \nbut have distinctly different bit patterns. As with a stealth virus, the purpose is to defeat \nprograms that scan for viruses. A more effective approach is to use encryption. A portion \nof the virus, generally called a mutation engine, creates a random encryption key to \nencrypt the remainder of the virus. The key is stored with the virus, and the mutation \nengine itself is altered.  \n3.4.4 Macro Viruses \nMacro viruses are particularly threatening for a number of reasons: \n1. A macro virus is platform independent. Virtually all of the macro viruses infect \nMicrosoft Word documents. Any hardware platform and operating system that supports \nWord can be infected. \n2. Macro viruses infect documents, not executable portions of code. Most of the \ninformation  \nintroduced onto a computer system is in the form of a document rather than a program. \n 3. Macro viruses are easily spread. A very common method is by electronic mail. \n \nMacro viruses take advantage of a feature found in Word and other office applications \nsuch as Microsoft Excel, namely the macro. In essence, a macro is an executable program \nembedded in a word processing document or other type of file. Typically, users employ \nmacros to automate repetitive tasks and thereby save keystrokes.  \n \nSuccessive releases of Word provide increased protection against macro viruses. For \nexample, Microsoft offers an optional Macro Virus Protection tool that detects suspicious \nWord files and alerts the customer to the potential risk of opening a file with macros.  \n3.4.5 E-mail Viruses \n \nA more recent development in malicious software is the e-mail virus. The first rapidly \nspreading e-mail viruses, such as Melissa, made use of a Microsoft Word macro \nembedded in an attachment. If the recipient opens the e-mail attachment, the Word macro \nis activated. Then \n1. The e-mail virus sends itself to everyone on the mailing list in the user's e-mail package. \n2. The virus does local damage. \n \nThus we see a new generation of malware that arrives via e-mail and uses e-mail \nsoftware features to replicate itself across the Internet. The virus propagates itself as soon \nas activated (either by opening an e-mail attachment of by opening the e-mail) to all of \nthe e-mail addresses known to the infected host. As a result, whereas viruses used to take \nmonths or years to propagate, they now do so in hours.  \n3.4.6 Worms", "chunk_id": "f648c092-11a9-4bfa-82a8-74ec47212d43", "chroma:document": "Microsoft Word documents. Any hardware platform and operating system that supports \nWord can be infected. \n2. Macro viruses infect documents, not executable portions of code. Most of the \ninformation  \nintroduced onto a computer system is in the form of a document rather than a program. \n 3. Macro viruses are easily spread. A very common method is by electronic mail."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 8d34a194-4e2c-4b60-b5ee-d65bcc8e319e
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 105, "full_page_content": "106 \n \n \nOne example of a stealth virus was discussed earlier: a virus that uses compression \nso that the infected program is exactly the same length as an uninfected version. Far more \nsophisticated techniques are possible. For example, a virus can place intercept logic in \ndisk I/O routines, so that when there is an attempt to read suspected portions of the disk \nusing these routines, the virus will present back the original, uninfected program.  \nA polymorphic virus creates copies during replication that are functionally equivalent \nbut have distinctly different bit patterns. As with a stealth virus, the purpose is to defeat \nprograms that scan for viruses. A more effective approach is to use encryption. A portion \nof the virus, generally called a mutation engine, creates a random encryption key to \nencrypt the remainder of the virus. The key is stored with the virus, and the mutation \nengine itself is altered.  \n3.4.4 Macro Viruses \nMacro viruses are particularly threatening for a number of reasons: \n1. A macro virus is platform independent. Virtually all of the macro viruses infect \nMicrosoft Word documents. Any hardware platform and operating system that supports \nWord can be infected. \n2. Macro viruses infect documents, not executable portions of code. Most of the \ninformation  \nintroduced onto a computer system is in the form of a document rather than a program. \n 3. Macro viruses are easily spread. A very common method is by electronic mail. \n \nMacro viruses take advantage of a feature found in Word and other office applications \nsuch as Microsoft Excel, namely the macro. In essence, a macro is an executable program \nembedded in a word processing document or other type of file. Typically, users employ \nmacros to automate repetitive tasks and thereby save keystrokes.  \n \nSuccessive releases of Word provide increased protection against macro viruses. For \nexample, Microsoft offers an optional Macro Virus Protection tool that detects suspicious \nWord files and alerts the customer to the potential risk of opening a file with macros.  \n3.4.5 E-mail Viruses \n \nA more recent development in malicious software is the e-mail virus. The first rapidly \nspreading e-mail viruses, such as Melissa, made use of a Microsoft Word macro \nembedded in an attachment. If the recipient opens the e-mail attachment, the Word macro \nis activated. Then \n1. The e-mail virus sends itself to everyone on the mailing list in the user's e-mail package. \n2. The virus does local damage. \n \nThus we see a new generation of malware that arrives via e-mail and uses e-mail \nsoftware features to replicate itself across the Internet. The virus propagates itself as soon \nas activated (either by opening an e-mail attachment of by opening the e-mail) to all of \nthe e-mail addresses known to the infected host. As a result, whereas viruses used to take \nmonths or years to propagate, they now do so in hours.  \n3.4.6 Worms", "chunk_id": "e06cfb98-950b-47f4-91e1-ebc483943d00", "chroma:document": "Macro viruses take advantage of a feature found in Word and other office applications \nsuch as Microsoft Excel, namely the macro. In essence, a macro is an executable program \nembedded in a word processing document or other type of file. Typically, users employ \nmacros to automate repetitive tasks and thereby save keystrokes."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 379fa39b-84c6-416b-b8ad-3ba3d5a31039
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 105, "full_page_content": "106 \n \n \nOne example of a stealth virus was discussed earlier: a virus that uses compression \nso that the infected program is exactly the same length as an uninfected version. Far more \nsophisticated techniques are possible. For example, a virus can place intercept logic in \ndisk I/O routines, so that when there is an attempt to read suspected portions of the disk \nusing these routines, the virus will present back the original, uninfected program.  \nA polymorphic virus creates copies during replication that are functionally equivalent \nbut have distinctly different bit patterns. As with a stealth virus, the purpose is to defeat \nprograms that scan for viruses. A more effective approach is to use encryption. A portion \nof the virus, generally called a mutation engine, creates a random encryption key to \nencrypt the remainder of the virus. The key is stored with the virus, and the mutation \nengine itself is altered.  \n3.4.4 Macro Viruses \nMacro viruses are particularly threatening for a number of reasons: \n1. A macro virus is platform independent. Virtually all of the macro viruses infect \nMicrosoft Word documents. Any hardware platform and operating system that supports \nWord can be infected. \n2. Macro viruses infect documents, not executable portions of code. Most of the \ninformation  \nintroduced onto a computer system is in the form of a document rather than a program. \n 3. Macro viruses are easily spread. A very common method is by electronic mail. \n \nMacro viruses take advantage of a feature found in Word and other office applications \nsuch as Microsoft Excel, namely the macro. In essence, a macro is an executable program \nembedded in a word processing document or other type of file. Typically, users employ \nmacros to automate repetitive tasks and thereby save keystrokes.  \n \nSuccessive releases of Word provide increased protection against macro viruses. For \nexample, Microsoft offers an optional Macro Virus Protection tool that detects suspicious \nWord files and alerts the customer to the potential risk of opening a file with macros.  \n3.4.5 E-mail Viruses \n \nA more recent development in malicious software is the e-mail virus. The first rapidly \nspreading e-mail viruses, such as Melissa, made use of a Microsoft Word macro \nembedded in an attachment. If the recipient opens the e-mail attachment, the Word macro \nis activated. Then \n1. The e-mail virus sends itself to everyone on the mailing list in the user's e-mail package. \n2. The virus does local damage. \n \nThus we see a new generation of malware that arrives via e-mail and uses e-mail \nsoftware features to replicate itself across the Internet. The virus propagates itself as soon \nas activated (either by opening an e-mail attachment of by opening the e-mail) to all of \nthe e-mail addresses known to the infected host. As a result, whereas viruses used to take \nmonths or years to propagate, they now do so in hours.  \n3.4.6 Worms", "chunk_id": "9dd75160-7f37-4aa8-8269-1c9aa2939636", "chroma:document": "Successive releases of Word provide increased protection against macro viruses. For \nexample, Microsoft offers an optional Macro Virus Protection tool that detects suspicious \nWord files and alerts the customer to the potential risk of opening a file with macros.  \n3.4.5 E-mail Viruses \n \nA more recent development in malicious software is the e-mail virus. The first rapidly"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 3909305c-6c73-4d4f-a801-c9e27f08a5bd
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 105, "full_page_content": "106 \n \n \nOne example of a stealth virus was discussed earlier: a virus that uses compression \nso that the infected program is exactly the same length as an uninfected version. Far more \nsophisticated techniques are possible. For example, a virus can place intercept logic in \ndisk I/O routines, so that when there is an attempt to read suspected portions of the disk \nusing these routines, the virus will present back the original, uninfected program.  \nA polymorphic virus creates copies during replication that are functionally equivalent \nbut have distinctly different bit patterns. As with a stealth virus, the purpose is to defeat \nprograms that scan for viruses. A more effective approach is to use encryption. A portion \nof the virus, generally called a mutation engine, creates a random encryption key to \nencrypt the remainder of the virus. The key is stored with the virus, and the mutation \nengine itself is altered.  \n3.4.4 Macro Viruses \nMacro viruses are particularly threatening for a number of reasons: \n1. A macro virus is platform independent. Virtually all of the macro viruses infect \nMicrosoft Word documents. Any hardware platform and operating system that supports \nWord can be infected. \n2. Macro viruses infect documents, not executable portions of code. Most of the \ninformation  \nintroduced onto a computer system is in the form of a document rather than a program. \n 3. Macro viruses are easily spread. A very common method is by electronic mail. \n \nMacro viruses take advantage of a feature found in Word and other office applications \nsuch as Microsoft Excel, namely the macro. In essence, a macro is an executable program \nembedded in a word processing document or other type of file. Typically, users employ \nmacros to automate repetitive tasks and thereby save keystrokes.  \n \nSuccessive releases of Word provide increased protection against macro viruses. For \nexample, Microsoft offers an optional Macro Virus Protection tool that detects suspicious \nWord files and alerts the customer to the potential risk of opening a file with macros.  \n3.4.5 E-mail Viruses \n \nA more recent development in malicious software is the e-mail virus. The first rapidly \nspreading e-mail viruses, such as Melissa, made use of a Microsoft Word macro \nembedded in an attachment. If the recipient opens the e-mail attachment, the Word macro \nis activated. Then \n1. The e-mail virus sends itself to everyone on the mailing list in the user's e-mail package. \n2. The virus does local damage. \n \nThus we see a new generation of malware that arrives via e-mail and uses e-mail \nsoftware features to replicate itself across the Internet. The virus propagates itself as soon \nas activated (either by opening an e-mail attachment of by opening the e-mail) to all of \nthe e-mail addresses known to the infected host. As a result, whereas viruses used to take \nmonths or years to propagate, they now do so in hours.  \n3.4.6 Worms", "chunk_id": "614ca98a-d454-4768-b690-9dc9d9c476f6", "chroma:document": "spreading e-mail viruses, such as Melissa, made use of a Microsoft Word macro \nembedded in an attachment. If the recipient opens the e-mail attachment, the Word macro \nis activated. Then \n1. The e-mail virus sends itself to everyone on the mailing list in the user's e-mail package. \n2. The virus does local damage."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 8230fadc-f64c-4aba-9bce-9f5254980386
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 105, "full_page_content": "106 \n \n \nOne example of a stealth virus was discussed earlier: a virus that uses compression \nso that the infected program is exactly the same length as an uninfected version. Far more \nsophisticated techniques are possible. For example, a virus can place intercept logic in \ndisk I/O routines, so that when there is an attempt to read suspected portions of the disk \nusing these routines, the virus will present back the original, uninfected program.  \nA polymorphic virus creates copies during replication that are functionally equivalent \nbut have distinctly different bit patterns. As with a stealth virus, the purpose is to defeat \nprograms that scan for viruses. A more effective approach is to use encryption. A portion \nof the virus, generally called a mutation engine, creates a random encryption key to \nencrypt the remainder of the virus. The key is stored with the virus, and the mutation \nengine itself is altered.  \n3.4.4 Macro Viruses \nMacro viruses are particularly threatening for a number of reasons: \n1. A macro virus is platform independent. Virtually all of the macro viruses infect \nMicrosoft Word documents. Any hardware platform and operating system that supports \nWord can be infected. \n2. Macro viruses infect documents, not executable portions of code. Most of the \ninformation  \nintroduced onto a computer system is in the form of a document rather than a program. \n 3. Macro viruses are easily spread. A very common method is by electronic mail. \n \nMacro viruses take advantage of a feature found in Word and other office applications \nsuch as Microsoft Excel, namely the macro. In essence, a macro is an executable program \nembedded in a word processing document or other type of file. Typically, users employ \nmacros to automate repetitive tasks and thereby save keystrokes.  \n \nSuccessive releases of Word provide increased protection against macro viruses. For \nexample, Microsoft offers an optional Macro Virus Protection tool that detects suspicious \nWord files and alerts the customer to the potential risk of opening a file with macros.  \n3.4.5 E-mail Viruses \n \nA more recent development in malicious software is the e-mail virus. The first rapidly \nspreading e-mail viruses, such as Melissa, made use of a Microsoft Word macro \nembedded in an attachment. If the recipient opens the e-mail attachment, the Word macro \nis activated. Then \n1. The e-mail virus sends itself to everyone on the mailing list in the user's e-mail package. \n2. The virus does local damage. \n \nThus we see a new generation of malware that arrives via e-mail and uses e-mail \nsoftware features to replicate itself across the Internet. The virus propagates itself as soon \nas activated (either by opening an e-mail attachment of by opening the e-mail) to all of \nthe e-mail addresses known to the infected host. As a result, whereas viruses used to take \nmonths or years to propagate, they now do so in hours.  \n3.4.6 Worms", "chunk_id": "d2643fef-d0f1-4a4e-ad41-76828b1516e1", "chroma:document": "Thus we see a new generation of malware that arrives via e-mail and uses e-mail \nsoftware features to replicate itself across the Internet. The virus propagates itself as soon \nas activated (either by opening an e-mail attachment of by opening the e-mail) to all of \nthe e-mail addresses known to the infected host. As a result, whereas viruses used to take"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: b1383771-bef0-4414-baf3-1cc692cd6a29
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 105, "full_page_content": "106 \n \n \nOne example of a stealth virus was discussed earlier: a virus that uses compression \nso that the infected program is exactly the same length as an uninfected version. Far more \nsophisticated techniques are possible. For example, a virus can place intercept logic in \ndisk I/O routines, so that when there is an attempt to read suspected portions of the disk \nusing these routines, the virus will present back the original, uninfected program.  \nA polymorphic virus creates copies during replication that are functionally equivalent \nbut have distinctly different bit patterns. As with a stealth virus, the purpose is to defeat \nprograms that scan for viruses. A more effective approach is to use encryption. A portion \nof the virus, generally called a mutation engine, creates a random encryption key to \nencrypt the remainder of the virus. The key is stored with the virus, and the mutation \nengine itself is altered.  \n3.4.4 Macro Viruses \nMacro viruses are particularly threatening for a number of reasons: \n1. A macro virus is platform independent. Virtually all of the macro viruses infect \nMicrosoft Word documents. Any hardware platform and operating system that supports \nWord can be infected. \n2. Macro viruses infect documents, not executable portions of code. Most of the \ninformation  \nintroduced onto a computer system is in the form of a document rather than a program. \n 3. Macro viruses are easily spread. A very common method is by electronic mail. \n \nMacro viruses take advantage of a feature found in Word and other office applications \nsuch as Microsoft Excel, namely the macro. In essence, a macro is an executable program \nembedded in a word processing document or other type of file. Typically, users employ \nmacros to automate repetitive tasks and thereby save keystrokes.  \n \nSuccessive releases of Word provide increased protection against macro viruses. For \nexample, Microsoft offers an optional Macro Virus Protection tool that detects suspicious \nWord files and alerts the customer to the potential risk of opening a file with macros.  \n3.4.5 E-mail Viruses \n \nA more recent development in malicious software is the e-mail virus. The first rapidly \nspreading e-mail viruses, such as Melissa, made use of a Microsoft Word macro \nembedded in an attachment. If the recipient opens the e-mail attachment, the Word macro \nis activated. Then \n1. The e-mail virus sends itself to everyone on the mailing list in the user's e-mail package. \n2. The virus does local damage. \n \nThus we see a new generation of malware that arrives via e-mail and uses e-mail \nsoftware features to replicate itself across the Internet. The virus propagates itself as soon \nas activated (either by opening an e-mail attachment of by opening the e-mail) to all of \nthe e-mail addresses known to the infected host. As a result, whereas viruses used to take \nmonths or years to propagate, they now do so in hours.  \n3.4.6 Worms", "chunk_id": "c4f72664-626b-4d0b-b4c6-631149f79f43", "chroma:document": "months or years to propagate, they now do so in hours.  \n3.4.6 Worms"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: a8ec185e-d15e-417d-a7d2-38a3410ad141
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 106, "full_page_content": "107 \n \n \nA worm is a program that can replicate itself and send copies from computer to \ncomputer across network connections. Upon arrival, the worm may be activated to \nreplicate and propagate again. In addition to propagation, the worm usually performs \nsome unwanted function. An e-mail virus has some of the characteristics of a worm, \nbecause it propagates itself from system to system.  \n \nNetwork worm programs use network connections to spread from system to system. \nOnce active within a system, a network worm can behave as a computer virus or bacteria, \nor it could implant Trojan horse programs or perform any number of disruptive or \ndestructive actions. \nTo replicate itself, a network worm uses some sort of network vehicle. Examples include \nthe following: \n\u2022 Electronic mail facility: A worm mails a copy of itself to other systems. \n\u25cf Remote execution capability: A worm executes a copy of itself on another \nsystem. \n\u25cf Remote login capability: A worm logs onto a remote system as a user and then \nuses  \ncommands to copy itself from one system to the other. \n3.4.6.1 The Morris Worm \n \nThe Morris worm was designed to spread on UNIX systems and used a number of \ndifferent techniques for propagation. When a copy began execution, its first task was to \ndiscover other hosts known to this host that would allow entry from this host. The worm \nperformed this task by examining a variety of lists and tables, including system tables \nthat declared which other machines were trusted by this host, users' mail forwarding files, \ntables by which users gave themselves permission for access to remote accounts, and \nfrom a program that reported the status of network connections. For each discovered host, \nthe worm tried a number of methods for gaining access: \n1. It attempted to log on to a remote host as a legitimate user. In this method, the worm \nfirst attempted to crack the local password file, and then used the discovered passwords \nand corresponding user IDs. The assumption was that many users would use the same \npassword on different systems. To obtain the passwords, the worm ran a password-\ncracking program that tried \na. Each user's account name and simple permutations of it \nb.  All the words in the local system directory  \n2. It exploited a bug in the finger protocol, which reports the whereabouts of a remote \nuser. \n 3. It exploited a trapdoor in the debug option of the remote process that receives and \nsends mail.  \n 3.4.6.2 Recent Worm Attacks \n    \nCode Red exploits a security hole in the Microsoft Internet Information Server \n(IIS) to penetrate and spread. It also disables the system file checker in Windows. The \nworm probes random IP addresses to spread to other hosts. During a certain period of", "chunk_id": "6c39444c-af59-4a04-945a-ec6275426233", "chroma:document": "107 \n \n \nA worm is a program that can replicate itself and send copies from computer to \ncomputer across network connections. Upon arrival, the worm may be activated to \nreplicate and propagate again. In addition to propagation, the worm usually performs \nsome unwanted function. An e-mail virus has some of the characteristics of a worm,"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: da7bdbaf-3bb4-4695-b410-651718ec9585
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 106, "full_page_content": "107 \n \n \nA worm is a program that can replicate itself and send copies from computer to \ncomputer across network connections. Upon arrival, the worm may be activated to \nreplicate and propagate again. In addition to propagation, the worm usually performs \nsome unwanted function. An e-mail virus has some of the characteristics of a worm, \nbecause it propagates itself from system to system.  \n \nNetwork worm programs use network connections to spread from system to system. \nOnce active within a system, a network worm can behave as a computer virus or bacteria, \nor it could implant Trojan horse programs or perform any number of disruptive or \ndestructive actions. \nTo replicate itself, a network worm uses some sort of network vehicle. Examples include \nthe following: \n\u2022 Electronic mail facility: A worm mails a copy of itself to other systems. \n\u25cf Remote execution capability: A worm executes a copy of itself on another \nsystem. \n\u25cf Remote login capability: A worm logs onto a remote system as a user and then \nuses  \ncommands to copy itself from one system to the other. \n3.4.6.1 The Morris Worm \n \nThe Morris worm was designed to spread on UNIX systems and used a number of \ndifferent techniques for propagation. When a copy began execution, its first task was to \ndiscover other hosts known to this host that would allow entry from this host. The worm \nperformed this task by examining a variety of lists and tables, including system tables \nthat declared which other machines were trusted by this host, users' mail forwarding files, \ntables by which users gave themselves permission for access to remote accounts, and \nfrom a program that reported the status of network connections. For each discovered host, \nthe worm tried a number of methods for gaining access: \n1. It attempted to log on to a remote host as a legitimate user. In this method, the worm \nfirst attempted to crack the local password file, and then used the discovered passwords \nand corresponding user IDs. The assumption was that many users would use the same \npassword on different systems. To obtain the passwords, the worm ran a password-\ncracking program that tried \na. Each user's account name and simple permutations of it \nb.  All the words in the local system directory  \n2. It exploited a bug in the finger protocol, which reports the whereabouts of a remote \nuser. \n 3. It exploited a trapdoor in the debug option of the remote process that receives and \nsends mail.  \n 3.4.6.2 Recent Worm Attacks \n    \nCode Red exploits a security hole in the Microsoft Internet Information Server \n(IIS) to penetrate and spread. It also disables the system file checker in Windows. The \nworm probes random IP addresses to spread to other hosts. During a certain period of", "chunk_id": "271866b0-1670-48b9-8554-4f5d694474fc", "chroma:document": "because it propagates itself from system to system.  \n \nNetwork worm programs use network connections to spread from system to system. \nOnce active within a system, a network worm can behave as a computer virus or bacteria, \nor it could implant Trojan horse programs or perform any number of disruptive or \ndestructive actions."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 91a03e57-c998-4a05-93bf-b52fa86fbd80
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 106, "full_page_content": "107 \n \n \nA worm is a program that can replicate itself and send copies from computer to \ncomputer across network connections. Upon arrival, the worm may be activated to \nreplicate and propagate again. In addition to propagation, the worm usually performs \nsome unwanted function. An e-mail virus has some of the characteristics of a worm, \nbecause it propagates itself from system to system.  \n \nNetwork worm programs use network connections to spread from system to system. \nOnce active within a system, a network worm can behave as a computer virus or bacteria, \nor it could implant Trojan horse programs or perform any number of disruptive or \ndestructive actions. \nTo replicate itself, a network worm uses some sort of network vehicle. Examples include \nthe following: \n\u2022 Electronic mail facility: A worm mails a copy of itself to other systems. \n\u25cf Remote execution capability: A worm executes a copy of itself on another \nsystem. \n\u25cf Remote login capability: A worm logs onto a remote system as a user and then \nuses  \ncommands to copy itself from one system to the other. \n3.4.6.1 The Morris Worm \n \nThe Morris worm was designed to spread on UNIX systems and used a number of \ndifferent techniques for propagation. When a copy began execution, its first task was to \ndiscover other hosts known to this host that would allow entry from this host. The worm \nperformed this task by examining a variety of lists and tables, including system tables \nthat declared which other machines were trusted by this host, users' mail forwarding files, \ntables by which users gave themselves permission for access to remote accounts, and \nfrom a program that reported the status of network connections. For each discovered host, \nthe worm tried a number of methods for gaining access: \n1. It attempted to log on to a remote host as a legitimate user. In this method, the worm \nfirst attempted to crack the local password file, and then used the discovered passwords \nand corresponding user IDs. The assumption was that many users would use the same \npassword on different systems. To obtain the passwords, the worm ran a password-\ncracking program that tried \na. Each user's account name and simple permutations of it \nb.  All the words in the local system directory  \n2. It exploited a bug in the finger protocol, which reports the whereabouts of a remote \nuser. \n 3. It exploited a trapdoor in the debug option of the remote process that receives and \nsends mail.  \n 3.4.6.2 Recent Worm Attacks \n    \nCode Red exploits a security hole in the Microsoft Internet Information Server \n(IIS) to penetrate and spread. It also disables the system file checker in Windows. The \nworm probes random IP addresses to spread to other hosts. During a certain period of", "chunk_id": "7510eb63-5f5d-49ea-9a93-98f96b3b68cc", "chroma:document": "To replicate itself, a network worm uses some sort of network vehicle. Examples include \nthe following: \n\u2022 Electronic mail facility: A worm mails a copy of itself to other systems. \n\u25cf Remote execution capability: A worm executes a copy of itself on another \nsystem. \n\u25cf Remote login capability: A worm logs onto a remote system as a user and then \nuses"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ec21af50-2dfd-49f5-8425-e837338f092b
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 106, "full_page_content": "107 \n \n \nA worm is a program that can replicate itself and send copies from computer to \ncomputer across network connections. Upon arrival, the worm may be activated to \nreplicate and propagate again. In addition to propagation, the worm usually performs \nsome unwanted function. An e-mail virus has some of the characteristics of a worm, \nbecause it propagates itself from system to system.  \n \nNetwork worm programs use network connections to spread from system to system. \nOnce active within a system, a network worm can behave as a computer virus or bacteria, \nor it could implant Trojan horse programs or perform any number of disruptive or \ndestructive actions. \nTo replicate itself, a network worm uses some sort of network vehicle. Examples include \nthe following: \n\u2022 Electronic mail facility: A worm mails a copy of itself to other systems. \n\u25cf Remote execution capability: A worm executes a copy of itself on another \nsystem. \n\u25cf Remote login capability: A worm logs onto a remote system as a user and then \nuses  \ncommands to copy itself from one system to the other. \n3.4.6.1 The Morris Worm \n \nThe Morris worm was designed to spread on UNIX systems and used a number of \ndifferent techniques for propagation. When a copy began execution, its first task was to \ndiscover other hosts known to this host that would allow entry from this host. The worm \nperformed this task by examining a variety of lists and tables, including system tables \nthat declared which other machines were trusted by this host, users' mail forwarding files, \ntables by which users gave themselves permission for access to remote accounts, and \nfrom a program that reported the status of network connections. For each discovered host, \nthe worm tried a number of methods for gaining access: \n1. It attempted to log on to a remote host as a legitimate user. In this method, the worm \nfirst attempted to crack the local password file, and then used the discovered passwords \nand corresponding user IDs. The assumption was that many users would use the same \npassword on different systems. To obtain the passwords, the worm ran a password-\ncracking program that tried \na. Each user's account name and simple permutations of it \nb.  All the words in the local system directory  \n2. It exploited a bug in the finger protocol, which reports the whereabouts of a remote \nuser. \n 3. It exploited a trapdoor in the debug option of the remote process that receives and \nsends mail.  \n 3.4.6.2 Recent Worm Attacks \n    \nCode Red exploits a security hole in the Microsoft Internet Information Server \n(IIS) to penetrate and spread. It also disables the system file checker in Windows. The \nworm probes random IP addresses to spread to other hosts. During a certain period of", "chunk_id": "afba5d40-209a-4851-abef-69122f3f009c", "chroma:document": "uses  \ncommands to copy itself from one system to the other. \n3.4.6.1 The Morris Worm \n \nThe Morris worm was designed to spread on UNIX systems and used a number of \ndifferent techniques for propagation. When a copy began execution, its first task was to \ndiscover other hosts known to this host that would allow entry from this host. The worm"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 0a9341b0-44dc-4987-94a0-15dcc8e3f81f
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 106, "full_page_content": "107 \n \n \nA worm is a program that can replicate itself and send copies from computer to \ncomputer across network connections. Upon arrival, the worm may be activated to \nreplicate and propagate again. In addition to propagation, the worm usually performs \nsome unwanted function. An e-mail virus has some of the characteristics of a worm, \nbecause it propagates itself from system to system.  \n \nNetwork worm programs use network connections to spread from system to system. \nOnce active within a system, a network worm can behave as a computer virus or bacteria, \nor it could implant Trojan horse programs or perform any number of disruptive or \ndestructive actions. \nTo replicate itself, a network worm uses some sort of network vehicle. Examples include \nthe following: \n\u2022 Electronic mail facility: A worm mails a copy of itself to other systems. \n\u25cf Remote execution capability: A worm executes a copy of itself on another \nsystem. \n\u25cf Remote login capability: A worm logs onto a remote system as a user and then \nuses  \ncommands to copy itself from one system to the other. \n3.4.6.1 The Morris Worm \n \nThe Morris worm was designed to spread on UNIX systems and used a number of \ndifferent techniques for propagation. When a copy began execution, its first task was to \ndiscover other hosts known to this host that would allow entry from this host. The worm \nperformed this task by examining a variety of lists and tables, including system tables \nthat declared which other machines were trusted by this host, users' mail forwarding files, \ntables by which users gave themselves permission for access to remote accounts, and \nfrom a program that reported the status of network connections. For each discovered host, \nthe worm tried a number of methods for gaining access: \n1. It attempted to log on to a remote host as a legitimate user. In this method, the worm \nfirst attempted to crack the local password file, and then used the discovered passwords \nand corresponding user IDs. The assumption was that many users would use the same \npassword on different systems. To obtain the passwords, the worm ran a password-\ncracking program that tried \na. Each user's account name and simple permutations of it \nb.  All the words in the local system directory  \n2. It exploited a bug in the finger protocol, which reports the whereabouts of a remote \nuser. \n 3. It exploited a trapdoor in the debug option of the remote process that receives and \nsends mail.  \n 3.4.6.2 Recent Worm Attacks \n    \nCode Red exploits a security hole in the Microsoft Internet Information Server \n(IIS) to penetrate and spread. It also disables the system file checker in Windows. The \nworm probes random IP addresses to spread to other hosts. During a certain period of", "chunk_id": "bf3e3097-a5e2-4356-8a92-054c57c9872c", "chroma:document": "performed this task by examining a variety of lists and tables, including system tables \nthat declared which other machines were trusted by this host, users' mail forwarding files, \ntables by which users gave themselves permission for access to remote accounts, and \nfrom a program that reported the status of network connections. For each discovered host,"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 23e4141e-cd98-4564-9f12-911e5f4eaba8
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 106, "full_page_content": "107 \n \n \nA worm is a program that can replicate itself and send copies from computer to \ncomputer across network connections. Upon arrival, the worm may be activated to \nreplicate and propagate again. In addition to propagation, the worm usually performs \nsome unwanted function. An e-mail virus has some of the characteristics of a worm, \nbecause it propagates itself from system to system.  \n \nNetwork worm programs use network connections to spread from system to system. \nOnce active within a system, a network worm can behave as a computer virus or bacteria, \nor it could implant Trojan horse programs or perform any number of disruptive or \ndestructive actions. \nTo replicate itself, a network worm uses some sort of network vehicle. Examples include \nthe following: \n\u2022 Electronic mail facility: A worm mails a copy of itself to other systems. \n\u25cf Remote execution capability: A worm executes a copy of itself on another \nsystem. \n\u25cf Remote login capability: A worm logs onto a remote system as a user and then \nuses  \ncommands to copy itself from one system to the other. \n3.4.6.1 The Morris Worm \n \nThe Morris worm was designed to spread on UNIX systems and used a number of \ndifferent techniques for propagation. When a copy began execution, its first task was to \ndiscover other hosts known to this host that would allow entry from this host. The worm \nperformed this task by examining a variety of lists and tables, including system tables \nthat declared which other machines were trusted by this host, users' mail forwarding files, \ntables by which users gave themselves permission for access to remote accounts, and \nfrom a program that reported the status of network connections. For each discovered host, \nthe worm tried a number of methods for gaining access: \n1. It attempted to log on to a remote host as a legitimate user. In this method, the worm \nfirst attempted to crack the local password file, and then used the discovered passwords \nand corresponding user IDs. The assumption was that many users would use the same \npassword on different systems. To obtain the passwords, the worm ran a password-\ncracking program that tried \na. Each user's account name and simple permutations of it \nb.  All the words in the local system directory  \n2. It exploited a bug in the finger protocol, which reports the whereabouts of a remote \nuser. \n 3. It exploited a trapdoor in the debug option of the remote process that receives and \nsends mail.  \n 3.4.6.2 Recent Worm Attacks \n    \nCode Red exploits a security hole in the Microsoft Internet Information Server \n(IIS) to penetrate and spread. It also disables the system file checker in Windows. The \nworm probes random IP addresses to spread to other hosts. During a certain period of", "chunk_id": "98c28b79-e152-48d8-9b72-047a96009a59", "chroma:document": "the worm tried a number of methods for gaining access: \n1. It attempted to log on to a remote host as a legitimate user. In this method, the worm \nfirst attempted to crack the local password file, and then used the discovered passwords \nand corresponding user IDs. The assumption was that many users would use the same"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: b760086b-9e5c-4bfe-9f29-ce95f8dd746b
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 106, "full_page_content": "107 \n \n \nA worm is a program that can replicate itself and send copies from computer to \ncomputer across network connections. Upon arrival, the worm may be activated to \nreplicate and propagate again. In addition to propagation, the worm usually performs \nsome unwanted function. An e-mail virus has some of the characteristics of a worm, \nbecause it propagates itself from system to system.  \n \nNetwork worm programs use network connections to spread from system to system. \nOnce active within a system, a network worm can behave as a computer virus or bacteria, \nor it could implant Trojan horse programs or perform any number of disruptive or \ndestructive actions. \nTo replicate itself, a network worm uses some sort of network vehicle. Examples include \nthe following: \n\u2022 Electronic mail facility: A worm mails a copy of itself to other systems. \n\u25cf Remote execution capability: A worm executes a copy of itself on another \nsystem. \n\u25cf Remote login capability: A worm logs onto a remote system as a user and then \nuses  \ncommands to copy itself from one system to the other. \n3.4.6.1 The Morris Worm \n \nThe Morris worm was designed to spread on UNIX systems and used a number of \ndifferent techniques for propagation. When a copy began execution, its first task was to \ndiscover other hosts known to this host that would allow entry from this host. The worm \nperformed this task by examining a variety of lists and tables, including system tables \nthat declared which other machines were trusted by this host, users' mail forwarding files, \ntables by which users gave themselves permission for access to remote accounts, and \nfrom a program that reported the status of network connections. For each discovered host, \nthe worm tried a number of methods for gaining access: \n1. It attempted to log on to a remote host as a legitimate user. In this method, the worm \nfirst attempted to crack the local password file, and then used the discovered passwords \nand corresponding user IDs. The assumption was that many users would use the same \npassword on different systems. To obtain the passwords, the worm ran a password-\ncracking program that tried \na. Each user's account name and simple permutations of it \nb.  All the words in the local system directory  \n2. It exploited a bug in the finger protocol, which reports the whereabouts of a remote \nuser. \n 3. It exploited a trapdoor in the debug option of the remote process that receives and \nsends mail.  \n 3.4.6.2 Recent Worm Attacks \n    \nCode Red exploits a security hole in the Microsoft Internet Information Server \n(IIS) to penetrate and spread. It also disables the system file checker in Windows. The \nworm probes random IP addresses to spread to other hosts. During a certain period of", "chunk_id": "c0ab9835-28e2-44b8-a8b4-bdd6baba54d4", "chroma:document": "password on different systems. To obtain the passwords, the worm ran a password-\ncracking program that tried \na. Each user's account name and simple permutations of it \nb.  All the words in the local system directory  \n2. It exploited a bug in the finger protocol, which reports the whereabouts of a remote \nuser."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: aac59e23-4594-4ee4-9a3f-5d55d9cce1d9
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 106, "full_page_content": "107 \n \n \nA worm is a program that can replicate itself and send copies from computer to \ncomputer across network connections. Upon arrival, the worm may be activated to \nreplicate and propagate again. In addition to propagation, the worm usually performs \nsome unwanted function. An e-mail virus has some of the characteristics of a worm, \nbecause it propagates itself from system to system.  \n \nNetwork worm programs use network connections to spread from system to system. \nOnce active within a system, a network worm can behave as a computer virus or bacteria, \nor it could implant Trojan horse programs or perform any number of disruptive or \ndestructive actions. \nTo replicate itself, a network worm uses some sort of network vehicle. Examples include \nthe following: \n\u2022 Electronic mail facility: A worm mails a copy of itself to other systems. \n\u25cf Remote execution capability: A worm executes a copy of itself on another \nsystem. \n\u25cf Remote login capability: A worm logs onto a remote system as a user and then \nuses  \ncommands to copy itself from one system to the other. \n3.4.6.1 The Morris Worm \n \nThe Morris worm was designed to spread on UNIX systems and used a number of \ndifferent techniques for propagation. When a copy began execution, its first task was to \ndiscover other hosts known to this host that would allow entry from this host. The worm \nperformed this task by examining a variety of lists and tables, including system tables \nthat declared which other machines were trusted by this host, users' mail forwarding files, \ntables by which users gave themselves permission for access to remote accounts, and \nfrom a program that reported the status of network connections. For each discovered host, \nthe worm tried a number of methods for gaining access: \n1. It attempted to log on to a remote host as a legitimate user. In this method, the worm \nfirst attempted to crack the local password file, and then used the discovered passwords \nand corresponding user IDs. The assumption was that many users would use the same \npassword on different systems. To obtain the passwords, the worm ran a password-\ncracking program that tried \na. Each user's account name and simple permutations of it \nb.  All the words in the local system directory  \n2. It exploited a bug in the finger protocol, which reports the whereabouts of a remote \nuser. \n 3. It exploited a trapdoor in the debug option of the remote process that receives and \nsends mail.  \n 3.4.6.2 Recent Worm Attacks \n    \nCode Red exploits a security hole in the Microsoft Internet Information Server \n(IIS) to penetrate and spread. It also disables the system file checker in Windows. The \nworm probes random IP addresses to spread to other hosts. During a certain period of", "chunk_id": "1ee8385f-e7c1-497b-85bb-f07c9ab5106c", "chroma:document": "user. \n 3. It exploited a trapdoor in the debug option of the remote process that receives and \nsends mail.  \n 3.4.6.2 Recent Worm Attacks \n    \nCode Red exploits a security hole in the Microsoft Internet Information Server \n(IIS) to penetrate and spread. It also disables the system file checker in Windows. The"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: e7db1be7-d375-4396-a3e7-0f3380e8ae32
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 106, "full_page_content": "107 \n \n \nA worm is a program that can replicate itself and send copies from computer to \ncomputer across network connections. Upon arrival, the worm may be activated to \nreplicate and propagate again. In addition to propagation, the worm usually performs \nsome unwanted function. An e-mail virus has some of the characteristics of a worm, \nbecause it propagates itself from system to system.  \n \nNetwork worm programs use network connections to spread from system to system. \nOnce active within a system, a network worm can behave as a computer virus or bacteria, \nor it could implant Trojan horse programs or perform any number of disruptive or \ndestructive actions. \nTo replicate itself, a network worm uses some sort of network vehicle. Examples include \nthe following: \n\u2022 Electronic mail facility: A worm mails a copy of itself to other systems. \n\u25cf Remote execution capability: A worm executes a copy of itself on another \nsystem. \n\u25cf Remote login capability: A worm logs onto a remote system as a user and then \nuses  \ncommands to copy itself from one system to the other. \n3.4.6.1 The Morris Worm \n \nThe Morris worm was designed to spread on UNIX systems and used a number of \ndifferent techniques for propagation. When a copy began execution, its first task was to \ndiscover other hosts known to this host that would allow entry from this host. The worm \nperformed this task by examining a variety of lists and tables, including system tables \nthat declared which other machines were trusted by this host, users' mail forwarding files, \ntables by which users gave themselves permission for access to remote accounts, and \nfrom a program that reported the status of network connections. For each discovered host, \nthe worm tried a number of methods for gaining access: \n1. It attempted to log on to a remote host as a legitimate user. In this method, the worm \nfirst attempted to crack the local password file, and then used the discovered passwords \nand corresponding user IDs. The assumption was that many users would use the same \npassword on different systems. To obtain the passwords, the worm ran a password-\ncracking program that tried \na. Each user's account name and simple permutations of it \nb.  All the words in the local system directory  \n2. It exploited a bug in the finger protocol, which reports the whereabouts of a remote \nuser. \n 3. It exploited a trapdoor in the debug option of the remote process that receives and \nsends mail.  \n 3.4.6.2 Recent Worm Attacks \n    \nCode Red exploits a security hole in the Microsoft Internet Information Server \n(IIS) to penetrate and spread. It also disables the system file checker in Windows. The \nworm probes random IP addresses to spread to other hosts. During a certain period of", "chunk_id": "f256af66-051b-42f6-a9e1-a9ab5c5c27bc", "chroma:document": "worm probes random IP addresses to spread to other hosts. During a certain period of"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 6e91beb2-f7cc-450e-9772-1e0a08593fd5
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 107, "full_page_content": "108 \n \ntime, it only spreads. It then initiates a denial-of-service attack against a government Web \nsite by flooding the site with packets from numerous hosts.  \n  \nThe worm then suspends activities and reactivates periodically. In the second \nwave of attack, Code Red infected nearly 360,000 servers in 14 hours. In addition to the \nhavoc it causes at the targeted server, Code Red can consume enormous amounts of \nInternet capacity, disrupting service. \n In late 2001, a more versatile worm appeared, known as Nimda. Nimda spreads by \nmultiple  \nmechanisms: \n\u25cf from client to client via e-mail \n\u25cf from client to client via open network shares from Web server to client via \nbrowsing of compromised Web sites \n\u25cf from client to Web server via active scanning for and exploitation of various \nMicrosoft IIS 4.0 / 5.0 directory traversal vulnerabilities \n\u25cf from client to Web server via scanning for the back doors left behind by the \"Code \nRed II\" worms The worm modifies Web documents (e.g., .htm, .html, and .asp files) and \ncertain executable files found on the systems it infects and creates numerous copies of \nitself under various filenames. \n3.4.7 State of Worm Technology \n     The state of the art in worm technology includes the following: \n\u25cf Multiplatform: Newer worms are not limited to Windows machines but can attack a variety \nof  \nplatforms, especially the popular varieties of UNIX. \n\u25cf Multiexploit: New worms penetrate systems in a variety of ways, using exploits against \nWeb  \nservers, browsers, e-mail, file sharing, and other network-based applications. \n\u25cf Ultrafast spreading: One technique to accelerate the spread of a worm is to conduct a prior  \nInternet scan to accumulate Internet addresses of vulnerable machines. \n\u25cf Polymorphic: To evade detection, skip past filters, and foil real-time analysis, worms adopt \nthe  \nvirus polymorphic technique. Each copy of the worm has new code generated on the fly using  \nfunctionally equivalent instructions and encryption techniques. \n\u25cf Metamorphic: In addition to changing their appearance, metamorphic worms have a \nrepertoire  \nof behavior patterns that are unleashed at different stages of propagation. \n\u25cf Transport vehicles: Because worms can rapidly compromise a large number of systems, \nthey  \nare ideal for spreading other distributed attack tools, such as distributed denial of service  \nzombies. \n\u25cf Zero-day exploit: To achieve maximum surprise and distribution, a worm should exploit \nan  \nunknown vulnerability that is only discovered by the general network community when the \nworm  \nis launched. \n3.5 Virus Countermeasures", "chunk_id": "f10da8f3-ea1f-48a7-9822-3749b7df4384", "chroma:document": "108 \n \ntime, it only spreads. It then initiates a denial-of-service attack against a government Web \nsite by flooding the site with packets from numerous hosts.  \n  \nThe worm then suspends activities and reactivates periodically. In the second \nwave of attack, Code Red infected nearly 360,000 servers in 14 hours. In addition to the"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: a268910f-65de-4c1a-bf91-8e15e124e8da
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 107, "full_page_content": "108 \n \ntime, it only spreads. It then initiates a denial-of-service attack against a government Web \nsite by flooding the site with packets from numerous hosts.  \n  \nThe worm then suspends activities and reactivates periodically. In the second \nwave of attack, Code Red infected nearly 360,000 servers in 14 hours. In addition to the \nhavoc it causes at the targeted server, Code Red can consume enormous amounts of \nInternet capacity, disrupting service. \n In late 2001, a more versatile worm appeared, known as Nimda. Nimda spreads by \nmultiple  \nmechanisms: \n\u25cf from client to client via e-mail \n\u25cf from client to client via open network shares from Web server to client via \nbrowsing of compromised Web sites \n\u25cf from client to Web server via active scanning for and exploitation of various \nMicrosoft IIS 4.0 / 5.0 directory traversal vulnerabilities \n\u25cf from client to Web server via scanning for the back doors left behind by the \"Code \nRed II\" worms The worm modifies Web documents (e.g., .htm, .html, and .asp files) and \ncertain executable files found on the systems it infects and creates numerous copies of \nitself under various filenames. \n3.4.7 State of Worm Technology \n     The state of the art in worm technology includes the following: \n\u25cf Multiplatform: Newer worms are not limited to Windows machines but can attack a variety \nof  \nplatforms, especially the popular varieties of UNIX. \n\u25cf Multiexploit: New worms penetrate systems in a variety of ways, using exploits against \nWeb  \nservers, browsers, e-mail, file sharing, and other network-based applications. \n\u25cf Ultrafast spreading: One technique to accelerate the spread of a worm is to conduct a prior  \nInternet scan to accumulate Internet addresses of vulnerable machines. \n\u25cf Polymorphic: To evade detection, skip past filters, and foil real-time analysis, worms adopt \nthe  \nvirus polymorphic technique. Each copy of the worm has new code generated on the fly using  \nfunctionally equivalent instructions and encryption techniques. \n\u25cf Metamorphic: In addition to changing their appearance, metamorphic worms have a \nrepertoire  \nof behavior patterns that are unleashed at different stages of propagation. \n\u25cf Transport vehicles: Because worms can rapidly compromise a large number of systems, \nthey  \nare ideal for spreading other distributed attack tools, such as distributed denial of service  \nzombies. \n\u25cf Zero-day exploit: To achieve maximum surprise and distribution, a worm should exploit \nan  \nunknown vulnerability that is only discovered by the general network community when the \nworm  \nis launched. \n3.5 Virus Countermeasures", "chunk_id": "c84766f4-5cfe-4e59-8373-fcbd1a3615e8", "chroma:document": "havoc it causes at the targeted server, Code Red can consume enormous amounts of \nInternet capacity, disrupting service. \n In late 2001, a more versatile worm appeared, known as Nimda. Nimda spreads by \nmultiple  \nmechanisms: \n\u25cf from client to client via e-mail \n\u25cf from client to client via open network shares from Web server to client via \nbrowsing of compromised Web sites"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 4739110a-1ade-49b1-93ed-2b30dc79d587
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 107, "full_page_content": "108 \n \ntime, it only spreads. It then initiates a denial-of-service attack against a government Web \nsite by flooding the site with packets from numerous hosts.  \n  \nThe worm then suspends activities and reactivates periodically. In the second \nwave of attack, Code Red infected nearly 360,000 servers in 14 hours. In addition to the \nhavoc it causes at the targeted server, Code Red can consume enormous amounts of \nInternet capacity, disrupting service. \n In late 2001, a more versatile worm appeared, known as Nimda. Nimda spreads by \nmultiple  \nmechanisms: \n\u25cf from client to client via e-mail \n\u25cf from client to client via open network shares from Web server to client via \nbrowsing of compromised Web sites \n\u25cf from client to Web server via active scanning for and exploitation of various \nMicrosoft IIS 4.0 / 5.0 directory traversal vulnerabilities \n\u25cf from client to Web server via scanning for the back doors left behind by the \"Code \nRed II\" worms The worm modifies Web documents (e.g., .htm, .html, and .asp files) and \ncertain executable files found on the systems it infects and creates numerous copies of \nitself under various filenames. \n3.4.7 State of Worm Technology \n     The state of the art in worm technology includes the following: \n\u25cf Multiplatform: Newer worms are not limited to Windows machines but can attack a variety \nof  \nplatforms, especially the popular varieties of UNIX. \n\u25cf Multiexploit: New worms penetrate systems in a variety of ways, using exploits against \nWeb  \nservers, browsers, e-mail, file sharing, and other network-based applications. \n\u25cf Ultrafast spreading: One technique to accelerate the spread of a worm is to conduct a prior  \nInternet scan to accumulate Internet addresses of vulnerable machines. \n\u25cf Polymorphic: To evade detection, skip past filters, and foil real-time analysis, worms adopt \nthe  \nvirus polymorphic technique. Each copy of the worm has new code generated on the fly using  \nfunctionally equivalent instructions and encryption techniques. \n\u25cf Metamorphic: In addition to changing their appearance, metamorphic worms have a \nrepertoire  \nof behavior patterns that are unleashed at different stages of propagation. \n\u25cf Transport vehicles: Because worms can rapidly compromise a large number of systems, \nthey  \nare ideal for spreading other distributed attack tools, such as distributed denial of service  \nzombies. \n\u25cf Zero-day exploit: To achieve maximum surprise and distribution, a worm should exploit \nan  \nunknown vulnerability that is only discovered by the general network community when the \nworm  \nis launched. \n3.5 Virus Countermeasures", "chunk_id": "63f65590-f2f8-4a71-8428-cfaec2cbf476", "chroma:document": "\u25cf from client to Web server via active scanning for and exploitation of various \nMicrosoft IIS 4.0 / 5.0 directory traversal vulnerabilities \n\u25cf from client to Web server via scanning for the back doors left behind by the \"Code \nRed II\" worms The worm modifies Web documents (e.g., .htm, .html, and .asp files) and"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: dede47c0-2cb9-460f-95e9-8f1953d150b3
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 107, "full_page_content": "108 \n \ntime, it only spreads. It then initiates a denial-of-service attack against a government Web \nsite by flooding the site with packets from numerous hosts.  \n  \nThe worm then suspends activities and reactivates periodically. In the second \nwave of attack, Code Red infected nearly 360,000 servers in 14 hours. In addition to the \nhavoc it causes at the targeted server, Code Red can consume enormous amounts of \nInternet capacity, disrupting service. \n In late 2001, a more versatile worm appeared, known as Nimda. Nimda spreads by \nmultiple  \nmechanisms: \n\u25cf from client to client via e-mail \n\u25cf from client to client via open network shares from Web server to client via \nbrowsing of compromised Web sites \n\u25cf from client to Web server via active scanning for and exploitation of various \nMicrosoft IIS 4.0 / 5.0 directory traversal vulnerabilities \n\u25cf from client to Web server via scanning for the back doors left behind by the \"Code \nRed II\" worms The worm modifies Web documents (e.g., .htm, .html, and .asp files) and \ncertain executable files found on the systems it infects and creates numerous copies of \nitself under various filenames. \n3.4.7 State of Worm Technology \n     The state of the art in worm technology includes the following: \n\u25cf Multiplatform: Newer worms are not limited to Windows machines but can attack a variety \nof  \nplatforms, especially the popular varieties of UNIX. \n\u25cf Multiexploit: New worms penetrate systems in a variety of ways, using exploits against \nWeb  \nservers, browsers, e-mail, file sharing, and other network-based applications. \n\u25cf Ultrafast spreading: One technique to accelerate the spread of a worm is to conduct a prior  \nInternet scan to accumulate Internet addresses of vulnerable machines. \n\u25cf Polymorphic: To evade detection, skip past filters, and foil real-time analysis, worms adopt \nthe  \nvirus polymorphic technique. Each copy of the worm has new code generated on the fly using  \nfunctionally equivalent instructions and encryption techniques. \n\u25cf Metamorphic: In addition to changing their appearance, metamorphic worms have a \nrepertoire  \nof behavior patterns that are unleashed at different stages of propagation. \n\u25cf Transport vehicles: Because worms can rapidly compromise a large number of systems, \nthey  \nare ideal for spreading other distributed attack tools, such as distributed denial of service  \nzombies. \n\u25cf Zero-day exploit: To achieve maximum surprise and distribution, a worm should exploit \nan  \nunknown vulnerability that is only discovered by the general network community when the \nworm  \nis launched. \n3.5 Virus Countermeasures", "chunk_id": "ec88c0e2-eb78-45d6-81b3-741f8ea2d231", "chroma:document": "certain executable files found on the systems it infects and creates numerous copies of \nitself under various filenames. \n3.4.7 State of Worm Technology \n     The state of the art in worm technology includes the following: \n\u25cf Multiplatform: Newer worms are not limited to Windows machines but can attack a variety \nof  \nplatforms, especially the popular varieties of UNIX."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 70c2a7fb-4547-452e-a567-3606bacccdc0
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 107, "full_page_content": "108 \n \ntime, it only spreads. It then initiates a denial-of-service attack against a government Web \nsite by flooding the site with packets from numerous hosts.  \n  \nThe worm then suspends activities and reactivates periodically. In the second \nwave of attack, Code Red infected nearly 360,000 servers in 14 hours. In addition to the \nhavoc it causes at the targeted server, Code Red can consume enormous amounts of \nInternet capacity, disrupting service. \n In late 2001, a more versatile worm appeared, known as Nimda. Nimda spreads by \nmultiple  \nmechanisms: \n\u25cf from client to client via e-mail \n\u25cf from client to client via open network shares from Web server to client via \nbrowsing of compromised Web sites \n\u25cf from client to Web server via active scanning for and exploitation of various \nMicrosoft IIS 4.0 / 5.0 directory traversal vulnerabilities \n\u25cf from client to Web server via scanning for the back doors left behind by the \"Code \nRed II\" worms The worm modifies Web documents (e.g., .htm, .html, and .asp files) and \ncertain executable files found on the systems it infects and creates numerous copies of \nitself under various filenames. \n3.4.7 State of Worm Technology \n     The state of the art in worm technology includes the following: \n\u25cf Multiplatform: Newer worms are not limited to Windows machines but can attack a variety \nof  \nplatforms, especially the popular varieties of UNIX. \n\u25cf Multiexploit: New worms penetrate systems in a variety of ways, using exploits against \nWeb  \nservers, browsers, e-mail, file sharing, and other network-based applications. \n\u25cf Ultrafast spreading: One technique to accelerate the spread of a worm is to conduct a prior  \nInternet scan to accumulate Internet addresses of vulnerable machines. \n\u25cf Polymorphic: To evade detection, skip past filters, and foil real-time analysis, worms adopt \nthe  \nvirus polymorphic technique. Each copy of the worm has new code generated on the fly using  \nfunctionally equivalent instructions and encryption techniques. \n\u25cf Metamorphic: In addition to changing their appearance, metamorphic worms have a \nrepertoire  \nof behavior patterns that are unleashed at different stages of propagation. \n\u25cf Transport vehicles: Because worms can rapidly compromise a large number of systems, \nthey  \nare ideal for spreading other distributed attack tools, such as distributed denial of service  \nzombies. \n\u25cf Zero-day exploit: To achieve maximum surprise and distribution, a worm should exploit \nan  \nunknown vulnerability that is only discovered by the general network community when the \nworm  \nis launched. \n3.5 Virus Countermeasures", "chunk_id": "ec5de7ae-21b0-44d0-a083-a6561b2a78af", "chroma:document": "\u25cf Multiexploit: New worms penetrate systems in a variety of ways, using exploits against \nWeb  \nservers, browsers, e-mail, file sharing, and other network-based applications. \n\u25cf Ultrafast spreading: One technique to accelerate the spread of a worm is to conduct a prior  \nInternet scan to accumulate Internet addresses of vulnerable machines."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 63a0c9ea-6b2c-4fcd-aefa-414953762b95
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 107, "full_page_content": "108 \n \ntime, it only spreads. It then initiates a denial-of-service attack against a government Web \nsite by flooding the site with packets from numerous hosts.  \n  \nThe worm then suspends activities and reactivates periodically. In the second \nwave of attack, Code Red infected nearly 360,000 servers in 14 hours. In addition to the \nhavoc it causes at the targeted server, Code Red can consume enormous amounts of \nInternet capacity, disrupting service. \n In late 2001, a more versatile worm appeared, known as Nimda. Nimda spreads by \nmultiple  \nmechanisms: \n\u25cf from client to client via e-mail \n\u25cf from client to client via open network shares from Web server to client via \nbrowsing of compromised Web sites \n\u25cf from client to Web server via active scanning for and exploitation of various \nMicrosoft IIS 4.0 / 5.0 directory traversal vulnerabilities \n\u25cf from client to Web server via scanning for the back doors left behind by the \"Code \nRed II\" worms The worm modifies Web documents (e.g., .htm, .html, and .asp files) and \ncertain executable files found on the systems it infects and creates numerous copies of \nitself under various filenames. \n3.4.7 State of Worm Technology \n     The state of the art in worm technology includes the following: \n\u25cf Multiplatform: Newer worms are not limited to Windows machines but can attack a variety \nof  \nplatforms, especially the popular varieties of UNIX. \n\u25cf Multiexploit: New worms penetrate systems in a variety of ways, using exploits against \nWeb  \nservers, browsers, e-mail, file sharing, and other network-based applications. \n\u25cf Ultrafast spreading: One technique to accelerate the spread of a worm is to conduct a prior  \nInternet scan to accumulate Internet addresses of vulnerable machines. \n\u25cf Polymorphic: To evade detection, skip past filters, and foil real-time analysis, worms adopt \nthe  \nvirus polymorphic technique. Each copy of the worm has new code generated on the fly using  \nfunctionally equivalent instructions and encryption techniques. \n\u25cf Metamorphic: In addition to changing their appearance, metamorphic worms have a \nrepertoire  \nof behavior patterns that are unleashed at different stages of propagation. \n\u25cf Transport vehicles: Because worms can rapidly compromise a large number of systems, \nthey  \nare ideal for spreading other distributed attack tools, such as distributed denial of service  \nzombies. \n\u25cf Zero-day exploit: To achieve maximum surprise and distribution, a worm should exploit \nan  \nunknown vulnerability that is only discovered by the general network community when the \nworm  \nis launched. \n3.5 Virus Countermeasures", "chunk_id": "8bb111ad-2bb0-43a9-b0f4-f9844d5bc267", "chroma:document": "\u25cf Polymorphic: To evade detection, skip past filters, and foil real-time analysis, worms adopt \nthe  \nvirus polymorphic technique. Each copy of the worm has new code generated on the fly using  \nfunctionally equivalent instructions and encryption techniques. \n\u25cf Metamorphic: In addition to changing their appearance, metamorphic worms have a \nrepertoire"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: acaef658-6d2c-47ff-bad4-a58a45cedefa
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 107, "full_page_content": "108 \n \ntime, it only spreads. It then initiates a denial-of-service attack against a government Web \nsite by flooding the site with packets from numerous hosts.  \n  \nThe worm then suspends activities and reactivates periodically. In the second \nwave of attack, Code Red infected nearly 360,000 servers in 14 hours. In addition to the \nhavoc it causes at the targeted server, Code Red can consume enormous amounts of \nInternet capacity, disrupting service. \n In late 2001, a more versatile worm appeared, known as Nimda. Nimda spreads by \nmultiple  \nmechanisms: \n\u25cf from client to client via e-mail \n\u25cf from client to client via open network shares from Web server to client via \nbrowsing of compromised Web sites \n\u25cf from client to Web server via active scanning for and exploitation of various \nMicrosoft IIS 4.0 / 5.0 directory traversal vulnerabilities \n\u25cf from client to Web server via scanning for the back doors left behind by the \"Code \nRed II\" worms The worm modifies Web documents (e.g., .htm, .html, and .asp files) and \ncertain executable files found on the systems it infects and creates numerous copies of \nitself under various filenames. \n3.4.7 State of Worm Technology \n     The state of the art in worm technology includes the following: \n\u25cf Multiplatform: Newer worms are not limited to Windows machines but can attack a variety \nof  \nplatforms, especially the popular varieties of UNIX. \n\u25cf Multiexploit: New worms penetrate systems in a variety of ways, using exploits against \nWeb  \nservers, browsers, e-mail, file sharing, and other network-based applications. \n\u25cf Ultrafast spreading: One technique to accelerate the spread of a worm is to conduct a prior  \nInternet scan to accumulate Internet addresses of vulnerable machines. \n\u25cf Polymorphic: To evade detection, skip past filters, and foil real-time analysis, worms adopt \nthe  \nvirus polymorphic technique. Each copy of the worm has new code generated on the fly using  \nfunctionally equivalent instructions and encryption techniques. \n\u25cf Metamorphic: In addition to changing their appearance, metamorphic worms have a \nrepertoire  \nof behavior patterns that are unleashed at different stages of propagation. \n\u25cf Transport vehicles: Because worms can rapidly compromise a large number of systems, \nthey  \nare ideal for spreading other distributed attack tools, such as distributed denial of service  \nzombies. \n\u25cf Zero-day exploit: To achieve maximum surprise and distribution, a worm should exploit \nan  \nunknown vulnerability that is only discovered by the general network community when the \nworm  \nis launched. \n3.5 Virus Countermeasures", "chunk_id": "c3a5ff2a-6fc9-48fd-bd8d-0b15a0989f29", "chroma:document": "repertoire  \nof behavior patterns that are unleashed at different stages of propagation. \n\u25cf Transport vehicles: Because worms can rapidly compromise a large number of systems, \nthey  \nare ideal for spreading other distributed attack tools, such as distributed denial of service  \nzombies. \n\u25cf Zero-day exploit: To achieve maximum surprise and distribution, a worm should exploit \nan"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: b8dd7193-0128-4b53-89aa-6f01b639a6b4
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 107, "full_page_content": "108 \n \ntime, it only spreads. It then initiates a denial-of-service attack against a government Web \nsite by flooding the site with packets from numerous hosts.  \n  \nThe worm then suspends activities and reactivates periodically. In the second \nwave of attack, Code Red infected nearly 360,000 servers in 14 hours. In addition to the \nhavoc it causes at the targeted server, Code Red can consume enormous amounts of \nInternet capacity, disrupting service. \n In late 2001, a more versatile worm appeared, known as Nimda. Nimda spreads by \nmultiple  \nmechanisms: \n\u25cf from client to client via e-mail \n\u25cf from client to client via open network shares from Web server to client via \nbrowsing of compromised Web sites \n\u25cf from client to Web server via active scanning for and exploitation of various \nMicrosoft IIS 4.0 / 5.0 directory traversal vulnerabilities \n\u25cf from client to Web server via scanning for the back doors left behind by the \"Code \nRed II\" worms The worm modifies Web documents (e.g., .htm, .html, and .asp files) and \ncertain executable files found on the systems it infects and creates numerous copies of \nitself under various filenames. \n3.4.7 State of Worm Technology \n     The state of the art in worm technology includes the following: \n\u25cf Multiplatform: Newer worms are not limited to Windows machines but can attack a variety \nof  \nplatforms, especially the popular varieties of UNIX. \n\u25cf Multiexploit: New worms penetrate systems in a variety of ways, using exploits against \nWeb  \nservers, browsers, e-mail, file sharing, and other network-based applications. \n\u25cf Ultrafast spreading: One technique to accelerate the spread of a worm is to conduct a prior  \nInternet scan to accumulate Internet addresses of vulnerable machines. \n\u25cf Polymorphic: To evade detection, skip past filters, and foil real-time analysis, worms adopt \nthe  \nvirus polymorphic technique. Each copy of the worm has new code generated on the fly using  \nfunctionally equivalent instructions and encryption techniques. \n\u25cf Metamorphic: In addition to changing their appearance, metamorphic worms have a \nrepertoire  \nof behavior patterns that are unleashed at different stages of propagation. \n\u25cf Transport vehicles: Because worms can rapidly compromise a large number of systems, \nthey  \nare ideal for spreading other distributed attack tools, such as distributed denial of service  \nzombies. \n\u25cf Zero-day exploit: To achieve maximum surprise and distribution, a worm should exploit \nan  \nunknown vulnerability that is only discovered by the general network community when the \nworm  \nis launched. \n3.5 Virus Countermeasures", "chunk_id": "3995d228-59f1-4499-bc16-a60660291018", "chroma:document": "an  \nunknown vulnerability that is only discovered by the general network community when the \nworm  \nis launched. \n3.5 Virus Countermeasures"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 07e2efbb-0d4f-48e0-a42b-2ce16faaac50
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 108, "full_page_content": "109 \n \n3.5.1 Antivirus Approaches \nThe ideal solution to the threat of viruses is prevention: Do not allow a virus to get into the \nsystemin  \nthe first place. This goal is, in general, impossible to achieve, although prevention can reduce \nthe  \nnumber of successful viral attacks. The next best approach is to be able to do the following: \n\u25cf Detection: Once the infection has occurred, determine that it has occurred and locate the \nvirus. \n\u25cf Identification: Once detection has been achieved, identify the specific virus that has \ninfected a  \nprogram. \n\u25cf Removal: Once the specific virus has been identified, remove all traces of the virus from \nthe  \ninfected program and restore it to its original state. Remove the virus from all infected \nsystems  \nso that the disease cannot spread further. \nFour generations of antivirus software: \n\u25cf First generation: simple scanners \n\u25cf Second generation: heuristic scanners \n\u25cf Third generation: activity traps \n\u25cf Fourth generation: full-featured protection \nA first-generation scanner requires a virus signature to identify a virus. The virus may \ncontain  \n\"wildcards\" but has essentially the same structure and bit pattern in all copies. Such \nsignature-specific scanners are limited to the detection of known viruses. Another type \nof first-generation scanner maintains a record of the length of programs and looks for \nchanges in length. \nA second-generation scanner does not rely on a specific signature. Rather, the \nscanner uses heuristic rules to search for probable virus infection. One class of such \nscanners looks for fragments of code that are often associated with viruses. For example, \na scanner may look for the beginning of an encryption loop used in a polymorphic virus \nand discover the encryption key. Once the key is discovered, the scanner can decrypt the \nvirus to identify it, then remove the infection and return the program to service. \nThird-generation programs are memory-resident programs that identify a virus by \nits actions rather than its structure in an infected program. Such programs have the \nadvantage that it is not necessary to develop signatures and heuristics for a wide array of \nviruses. Rather, it is necessary only to identify the small set of actions that indicate an \ninfection is being attempted and then to intervene. \n Fourth-generation products are packages consisting of a variety of antivirus \ntechniques used in conjunction. These include scanning and activity trap components. In \naddition, such a package includes access control capability, which limits the ability of \nviruses to penetrate a system and then limits the ability of a virus to update files in order \nto pass on the infection.", "chunk_id": "3cf6d4dd-24f9-4f4a-ab86-b212a5c88339", "chroma:document": "109 \n \n3.5.1 Antivirus Approaches \nThe ideal solution to the threat of viruses is prevention: Do not allow a virus to get into the \nsystemin  \nthe first place. This goal is, in general, impossible to achieve, although prevention can reduce \nthe  \nnumber of successful viral attacks. The next best approach is to be able to do the following:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: f0afeae2-41d5-45b7-b0d7-cbdc8fd903f8
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 108, "full_page_content": "109 \n \n3.5.1 Antivirus Approaches \nThe ideal solution to the threat of viruses is prevention: Do not allow a virus to get into the \nsystemin  \nthe first place. This goal is, in general, impossible to achieve, although prevention can reduce \nthe  \nnumber of successful viral attacks. The next best approach is to be able to do the following: \n\u25cf Detection: Once the infection has occurred, determine that it has occurred and locate the \nvirus. \n\u25cf Identification: Once detection has been achieved, identify the specific virus that has \ninfected a  \nprogram. \n\u25cf Removal: Once the specific virus has been identified, remove all traces of the virus from \nthe  \ninfected program and restore it to its original state. Remove the virus from all infected \nsystems  \nso that the disease cannot spread further. \nFour generations of antivirus software: \n\u25cf First generation: simple scanners \n\u25cf Second generation: heuristic scanners \n\u25cf Third generation: activity traps \n\u25cf Fourth generation: full-featured protection \nA first-generation scanner requires a virus signature to identify a virus. The virus may \ncontain  \n\"wildcards\" but has essentially the same structure and bit pattern in all copies. Such \nsignature-specific scanners are limited to the detection of known viruses. Another type \nof first-generation scanner maintains a record of the length of programs and looks for \nchanges in length. \nA second-generation scanner does not rely on a specific signature. Rather, the \nscanner uses heuristic rules to search for probable virus infection. One class of such \nscanners looks for fragments of code that are often associated with viruses. For example, \na scanner may look for the beginning of an encryption loop used in a polymorphic virus \nand discover the encryption key. Once the key is discovered, the scanner can decrypt the \nvirus to identify it, then remove the infection and return the program to service. \nThird-generation programs are memory-resident programs that identify a virus by \nits actions rather than its structure in an infected program. Such programs have the \nadvantage that it is not necessary to develop signatures and heuristics for a wide array of \nviruses. Rather, it is necessary only to identify the small set of actions that indicate an \ninfection is being attempted and then to intervene. \n Fourth-generation products are packages consisting of a variety of antivirus \ntechniques used in conjunction. These include scanning and activity trap components. In \naddition, such a package includes access control capability, which limits the ability of \nviruses to penetrate a system and then limits the ability of a virus to update files in order \nto pass on the infection.", "chunk_id": "eb8e0838-2d15-4dae-a740-c36b93301898", "chroma:document": "\u25cf Detection: Once the infection has occurred, determine that it has occurred and locate the \nvirus. \n\u25cf Identification: Once detection has been achieved, identify the specific virus that has \ninfected a  \nprogram. \n\u25cf Removal: Once the specific virus has been identified, remove all traces of the virus from \nthe"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: f803195a-615f-4129-b14c-9183235a1383
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 108, "full_page_content": "109 \n \n3.5.1 Antivirus Approaches \nThe ideal solution to the threat of viruses is prevention: Do not allow a virus to get into the \nsystemin  \nthe first place. This goal is, in general, impossible to achieve, although prevention can reduce \nthe  \nnumber of successful viral attacks. The next best approach is to be able to do the following: \n\u25cf Detection: Once the infection has occurred, determine that it has occurred and locate the \nvirus. \n\u25cf Identification: Once detection has been achieved, identify the specific virus that has \ninfected a  \nprogram. \n\u25cf Removal: Once the specific virus has been identified, remove all traces of the virus from \nthe  \ninfected program and restore it to its original state. Remove the virus from all infected \nsystems  \nso that the disease cannot spread further. \nFour generations of antivirus software: \n\u25cf First generation: simple scanners \n\u25cf Second generation: heuristic scanners \n\u25cf Third generation: activity traps \n\u25cf Fourth generation: full-featured protection \nA first-generation scanner requires a virus signature to identify a virus. The virus may \ncontain  \n\"wildcards\" but has essentially the same structure and bit pattern in all copies. Such \nsignature-specific scanners are limited to the detection of known viruses. Another type \nof first-generation scanner maintains a record of the length of programs and looks for \nchanges in length. \nA second-generation scanner does not rely on a specific signature. Rather, the \nscanner uses heuristic rules to search for probable virus infection. One class of such \nscanners looks for fragments of code that are often associated with viruses. For example, \na scanner may look for the beginning of an encryption loop used in a polymorphic virus \nand discover the encryption key. Once the key is discovered, the scanner can decrypt the \nvirus to identify it, then remove the infection and return the program to service. \nThird-generation programs are memory-resident programs that identify a virus by \nits actions rather than its structure in an infected program. Such programs have the \nadvantage that it is not necessary to develop signatures and heuristics for a wide array of \nviruses. Rather, it is necessary only to identify the small set of actions that indicate an \ninfection is being attempted and then to intervene. \n Fourth-generation products are packages consisting of a variety of antivirus \ntechniques used in conjunction. These include scanning and activity trap components. In \naddition, such a package includes access control capability, which limits the ability of \nviruses to penetrate a system and then limits the ability of a virus to update files in order \nto pass on the infection.", "chunk_id": "ac77052d-ed9b-4a95-bb4f-1d4db539b547", "chroma:document": "the  \ninfected program and restore it to its original state. Remove the virus from all infected \nsystems  \nso that the disease cannot spread further. \nFour generations of antivirus software: \n\u25cf First generation: simple scanners \n\u25cf Second generation: heuristic scanners \n\u25cf Third generation: activity traps \n\u25cf Fourth generation: full-featured protection"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 672b3762-e2fa-4888-b670-c8a235a186ca
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 108, "full_page_content": "109 \n \n3.5.1 Antivirus Approaches \nThe ideal solution to the threat of viruses is prevention: Do not allow a virus to get into the \nsystemin  \nthe first place. This goal is, in general, impossible to achieve, although prevention can reduce \nthe  \nnumber of successful viral attacks. The next best approach is to be able to do the following: \n\u25cf Detection: Once the infection has occurred, determine that it has occurred and locate the \nvirus. \n\u25cf Identification: Once detection has been achieved, identify the specific virus that has \ninfected a  \nprogram. \n\u25cf Removal: Once the specific virus has been identified, remove all traces of the virus from \nthe  \ninfected program and restore it to its original state. Remove the virus from all infected \nsystems  \nso that the disease cannot spread further. \nFour generations of antivirus software: \n\u25cf First generation: simple scanners \n\u25cf Second generation: heuristic scanners \n\u25cf Third generation: activity traps \n\u25cf Fourth generation: full-featured protection \nA first-generation scanner requires a virus signature to identify a virus. The virus may \ncontain  \n\"wildcards\" but has essentially the same structure and bit pattern in all copies. Such \nsignature-specific scanners are limited to the detection of known viruses. Another type \nof first-generation scanner maintains a record of the length of programs and looks for \nchanges in length. \nA second-generation scanner does not rely on a specific signature. Rather, the \nscanner uses heuristic rules to search for probable virus infection. One class of such \nscanners looks for fragments of code that are often associated with viruses. For example, \na scanner may look for the beginning of an encryption loop used in a polymorphic virus \nand discover the encryption key. Once the key is discovered, the scanner can decrypt the \nvirus to identify it, then remove the infection and return the program to service. \nThird-generation programs are memory-resident programs that identify a virus by \nits actions rather than its structure in an infected program. Such programs have the \nadvantage that it is not necessary to develop signatures and heuristics for a wide array of \nviruses. Rather, it is necessary only to identify the small set of actions that indicate an \ninfection is being attempted and then to intervene. \n Fourth-generation products are packages consisting of a variety of antivirus \ntechniques used in conjunction. These include scanning and activity trap components. In \naddition, such a package includes access control capability, which limits the ability of \nviruses to penetrate a system and then limits the ability of a virus to update files in order \nto pass on the infection.", "chunk_id": "4d1b0f98-5d67-42bf-b57d-b3fa8487139f", "chroma:document": "A first-generation scanner requires a virus signature to identify a virus. The virus may \ncontain  \n\"wildcards\" but has essentially the same structure and bit pattern in all copies. Such \nsignature-specific scanners are limited to the detection of known viruses. Another type \nof first-generation scanner maintains a record of the length of programs and looks for"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: dfb43c6f-33ba-4332-9fcc-5c1f95b2548b
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 108, "full_page_content": "109 \n \n3.5.1 Antivirus Approaches \nThe ideal solution to the threat of viruses is prevention: Do not allow a virus to get into the \nsystemin  \nthe first place. This goal is, in general, impossible to achieve, although prevention can reduce \nthe  \nnumber of successful viral attacks. The next best approach is to be able to do the following: \n\u25cf Detection: Once the infection has occurred, determine that it has occurred and locate the \nvirus. \n\u25cf Identification: Once detection has been achieved, identify the specific virus that has \ninfected a  \nprogram. \n\u25cf Removal: Once the specific virus has been identified, remove all traces of the virus from \nthe  \ninfected program and restore it to its original state. Remove the virus from all infected \nsystems  \nso that the disease cannot spread further. \nFour generations of antivirus software: \n\u25cf First generation: simple scanners \n\u25cf Second generation: heuristic scanners \n\u25cf Third generation: activity traps \n\u25cf Fourth generation: full-featured protection \nA first-generation scanner requires a virus signature to identify a virus. The virus may \ncontain  \n\"wildcards\" but has essentially the same structure and bit pattern in all copies. Such \nsignature-specific scanners are limited to the detection of known viruses. Another type \nof first-generation scanner maintains a record of the length of programs and looks for \nchanges in length. \nA second-generation scanner does not rely on a specific signature. Rather, the \nscanner uses heuristic rules to search for probable virus infection. One class of such \nscanners looks for fragments of code that are often associated with viruses. For example, \na scanner may look for the beginning of an encryption loop used in a polymorphic virus \nand discover the encryption key. Once the key is discovered, the scanner can decrypt the \nvirus to identify it, then remove the infection and return the program to service. \nThird-generation programs are memory-resident programs that identify a virus by \nits actions rather than its structure in an infected program. Such programs have the \nadvantage that it is not necessary to develop signatures and heuristics for a wide array of \nviruses. Rather, it is necessary only to identify the small set of actions that indicate an \ninfection is being attempted and then to intervene. \n Fourth-generation products are packages consisting of a variety of antivirus \ntechniques used in conjunction. These include scanning and activity trap components. In \naddition, such a package includes access control capability, which limits the ability of \nviruses to penetrate a system and then limits the ability of a virus to update files in order \nto pass on the infection.", "chunk_id": "ef79312a-97d2-411a-979c-89e5e9d09653", "chroma:document": "changes in length. \nA second-generation scanner does not rely on a specific signature. Rather, the \nscanner uses heuristic rules to search for probable virus infection. One class of such \nscanners looks for fragments of code that are often associated with viruses. For example, \na scanner may look for the beginning of an encryption loop used in a polymorphic virus"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 6108dedc-7f2d-420a-bb8c-ae0e25e9455a
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 108, "full_page_content": "109 \n \n3.5.1 Antivirus Approaches \nThe ideal solution to the threat of viruses is prevention: Do not allow a virus to get into the \nsystemin  \nthe first place. This goal is, in general, impossible to achieve, although prevention can reduce \nthe  \nnumber of successful viral attacks. The next best approach is to be able to do the following: \n\u25cf Detection: Once the infection has occurred, determine that it has occurred and locate the \nvirus. \n\u25cf Identification: Once detection has been achieved, identify the specific virus that has \ninfected a  \nprogram. \n\u25cf Removal: Once the specific virus has been identified, remove all traces of the virus from \nthe  \ninfected program and restore it to its original state. Remove the virus from all infected \nsystems  \nso that the disease cannot spread further. \nFour generations of antivirus software: \n\u25cf First generation: simple scanners \n\u25cf Second generation: heuristic scanners \n\u25cf Third generation: activity traps \n\u25cf Fourth generation: full-featured protection \nA first-generation scanner requires a virus signature to identify a virus. The virus may \ncontain  \n\"wildcards\" but has essentially the same structure and bit pattern in all copies. Such \nsignature-specific scanners are limited to the detection of known viruses. Another type \nof first-generation scanner maintains a record of the length of programs and looks for \nchanges in length. \nA second-generation scanner does not rely on a specific signature. Rather, the \nscanner uses heuristic rules to search for probable virus infection. One class of such \nscanners looks for fragments of code that are often associated with viruses. For example, \na scanner may look for the beginning of an encryption loop used in a polymorphic virus \nand discover the encryption key. Once the key is discovered, the scanner can decrypt the \nvirus to identify it, then remove the infection and return the program to service. \nThird-generation programs are memory-resident programs that identify a virus by \nits actions rather than its structure in an infected program. Such programs have the \nadvantage that it is not necessary to develop signatures and heuristics for a wide array of \nviruses. Rather, it is necessary only to identify the small set of actions that indicate an \ninfection is being attempted and then to intervene. \n Fourth-generation products are packages consisting of a variety of antivirus \ntechniques used in conjunction. These include scanning and activity trap components. In \naddition, such a package includes access control capability, which limits the ability of \nviruses to penetrate a system and then limits the ability of a virus to update files in order \nto pass on the infection.", "chunk_id": "e3c1ba37-9061-4065-b0c6-7f5c3670b84c", "chroma:document": "and discover the encryption key. Once the key is discovered, the scanner can decrypt the \nvirus to identify it, then remove the infection and return the program to service. \nThird-generation programs are memory-resident programs that identify a virus by \nits actions rather than its structure in an infected program. Such programs have the"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: d791802c-72c5-4373-9be0-dd3661969ce6
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 108, "full_page_content": "109 \n \n3.5.1 Antivirus Approaches \nThe ideal solution to the threat of viruses is prevention: Do not allow a virus to get into the \nsystemin  \nthe first place. This goal is, in general, impossible to achieve, although prevention can reduce \nthe  \nnumber of successful viral attacks. The next best approach is to be able to do the following: \n\u25cf Detection: Once the infection has occurred, determine that it has occurred and locate the \nvirus. \n\u25cf Identification: Once detection has been achieved, identify the specific virus that has \ninfected a  \nprogram. \n\u25cf Removal: Once the specific virus has been identified, remove all traces of the virus from \nthe  \ninfected program and restore it to its original state. Remove the virus from all infected \nsystems  \nso that the disease cannot spread further. \nFour generations of antivirus software: \n\u25cf First generation: simple scanners \n\u25cf Second generation: heuristic scanners \n\u25cf Third generation: activity traps \n\u25cf Fourth generation: full-featured protection \nA first-generation scanner requires a virus signature to identify a virus. The virus may \ncontain  \n\"wildcards\" but has essentially the same structure and bit pattern in all copies. Such \nsignature-specific scanners are limited to the detection of known viruses. Another type \nof first-generation scanner maintains a record of the length of programs and looks for \nchanges in length. \nA second-generation scanner does not rely on a specific signature. Rather, the \nscanner uses heuristic rules to search for probable virus infection. One class of such \nscanners looks for fragments of code that are often associated with viruses. For example, \na scanner may look for the beginning of an encryption loop used in a polymorphic virus \nand discover the encryption key. Once the key is discovered, the scanner can decrypt the \nvirus to identify it, then remove the infection and return the program to service. \nThird-generation programs are memory-resident programs that identify a virus by \nits actions rather than its structure in an infected program. Such programs have the \nadvantage that it is not necessary to develop signatures and heuristics for a wide array of \nviruses. Rather, it is necessary only to identify the small set of actions that indicate an \ninfection is being attempted and then to intervene. \n Fourth-generation products are packages consisting of a variety of antivirus \ntechniques used in conjunction. These include scanning and activity trap components. In \naddition, such a package includes access control capability, which limits the ability of \nviruses to penetrate a system and then limits the ability of a virus to update files in order \nto pass on the infection.", "chunk_id": "a5c74be1-9a00-4134-aaa2-fbaf3a5bda92", "chroma:document": "advantage that it is not necessary to develop signatures and heuristics for a wide array of \nviruses. Rather, it is necessary only to identify the small set of actions that indicate an \ninfection is being attempted and then to intervene. \n Fourth-generation products are packages consisting of a variety of antivirus"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 85eae820-091b-49e6-baab-5839e006c0dd
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 108, "full_page_content": "109 \n \n3.5.1 Antivirus Approaches \nThe ideal solution to the threat of viruses is prevention: Do not allow a virus to get into the \nsystemin  \nthe first place. This goal is, in general, impossible to achieve, although prevention can reduce \nthe  \nnumber of successful viral attacks. The next best approach is to be able to do the following: \n\u25cf Detection: Once the infection has occurred, determine that it has occurred and locate the \nvirus. \n\u25cf Identification: Once detection has been achieved, identify the specific virus that has \ninfected a  \nprogram. \n\u25cf Removal: Once the specific virus has been identified, remove all traces of the virus from \nthe  \ninfected program and restore it to its original state. Remove the virus from all infected \nsystems  \nso that the disease cannot spread further. \nFour generations of antivirus software: \n\u25cf First generation: simple scanners \n\u25cf Second generation: heuristic scanners \n\u25cf Third generation: activity traps \n\u25cf Fourth generation: full-featured protection \nA first-generation scanner requires a virus signature to identify a virus. The virus may \ncontain  \n\"wildcards\" but has essentially the same structure and bit pattern in all copies. Such \nsignature-specific scanners are limited to the detection of known viruses. Another type \nof first-generation scanner maintains a record of the length of programs and looks for \nchanges in length. \nA second-generation scanner does not rely on a specific signature. Rather, the \nscanner uses heuristic rules to search for probable virus infection. One class of such \nscanners looks for fragments of code that are often associated with viruses. For example, \na scanner may look for the beginning of an encryption loop used in a polymorphic virus \nand discover the encryption key. Once the key is discovered, the scanner can decrypt the \nvirus to identify it, then remove the infection and return the program to service. \nThird-generation programs are memory-resident programs that identify a virus by \nits actions rather than its structure in an infected program. Such programs have the \nadvantage that it is not necessary to develop signatures and heuristics for a wide array of \nviruses. Rather, it is necessary only to identify the small set of actions that indicate an \ninfection is being attempted and then to intervene. \n Fourth-generation products are packages consisting of a variety of antivirus \ntechniques used in conjunction. These include scanning and activity trap components. In \naddition, such a package includes access control capability, which limits the ability of \nviruses to penetrate a system and then limits the ability of a virus to update files in order \nto pass on the infection.", "chunk_id": "85ae474b-5006-411f-8440-bb84bcb80336", "chroma:document": "techniques used in conjunction. These include scanning and activity trap components. In \naddition, such a package includes access control capability, which limits the ability of \nviruses to penetrate a system and then limits the ability of a virus to update files in order \nto pass on the infection."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 10e14a17-b538-496a-850e-2e9f81f86cf4
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 109, "full_page_content": "110 \n \n3.5.2 Advanced Antivirus Techniques \nMore sophisticated antivirus approaches and products continue to appear.  \nGeneric Decryption \n  Generic decryption (GD) technology enables the antivirus program to easily detect even \nthe most complex polymorphic viruses, while maintaining fast scanning speeds \n[NACH97]. Recall that when a file containing a polymorphic virus is executed, the virus \nmust decrypt itself to activate. In order to detect such a structure, executable files are run \nthrough a GD scanner, which contains the following elements: \n\u25cf CPU emulator: A software-based virtual computer. Instructions in an executable \nfile are interpreted by the emulator rather than executed on the underlying processor. The \nemulator  \nincludes software versions of all registers and other processor hardware, so that the \nunderlying processor is unaffected by programs interpreted on the emulator. \n\u25cf Virus signature scanner: A module that scans the target code looking for known \nvirus  \nsignatures. \n\u25cf Emulation control module: Controls the execution of the target code \nDigital Immune System \nThe digital immune system is a comprehensive approach to virus protection \ndeveloped by IBM. The motivation for this development has been the rising threat of \nInternet-based virus propagation. Two major trends in Internet technology have had an \nincreasing impact on the rate of virus propagation in recent years: \n\u2022 \nIntegrated mail systems: Systems such as Lotus Notes and Microsoft Outlook \nmake it very simple to send anything to anyone and to work with objects that are received. \n\u25cf Mobile-program systems: Capabilities such as Java and ActiveX allow programs \nto move on their own from one system to another. \nIn response to the threat posed by these Internet-based capabilities, IBM has \ndeveloped a prototype digital immune system.The objective of this system is to provide \nrapid response time so that viruses can be stamped out almost as soon as they are \nintroduced. When a new virus enters an organization, the immune system automatically \ncaptures it, analyzes it, adds detection and shielding for it, removes it, and passes \ninformation about that virus to systems running IBM AntiVirus so that it can be detected \nbefore it is allowed to run elsewhere. Figure 3.8 illustrates the typical steps in digital \nimmune system operation:", "chunk_id": "ba8574fe-937f-476a-8e85-c56bd91db550", "chroma:document": "110 \n \n3.5.2 Advanced Antivirus Techniques \nMore sophisticated antivirus approaches and products continue to appear.  \nGeneric Decryption \n  Generic decryption (GD) technology enables the antivirus program to easily detect even \nthe most complex polymorphic viruses, while maintaining fast scanning speeds"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 2e6f8d4e-e88d-4076-9d42-c077a7dc218e
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 109, "full_page_content": "110 \n \n3.5.2 Advanced Antivirus Techniques \nMore sophisticated antivirus approaches and products continue to appear.  \nGeneric Decryption \n  Generic decryption (GD) technology enables the antivirus program to easily detect even \nthe most complex polymorphic viruses, while maintaining fast scanning speeds \n[NACH97]. Recall that when a file containing a polymorphic virus is executed, the virus \nmust decrypt itself to activate. In order to detect such a structure, executable files are run \nthrough a GD scanner, which contains the following elements: \n\u25cf CPU emulator: A software-based virtual computer. Instructions in an executable \nfile are interpreted by the emulator rather than executed on the underlying processor. The \nemulator  \nincludes software versions of all registers and other processor hardware, so that the \nunderlying processor is unaffected by programs interpreted on the emulator. \n\u25cf Virus signature scanner: A module that scans the target code looking for known \nvirus  \nsignatures. \n\u25cf Emulation control module: Controls the execution of the target code \nDigital Immune System \nThe digital immune system is a comprehensive approach to virus protection \ndeveloped by IBM. The motivation for this development has been the rising threat of \nInternet-based virus propagation. Two major trends in Internet technology have had an \nincreasing impact on the rate of virus propagation in recent years: \n\u2022 \nIntegrated mail systems: Systems such as Lotus Notes and Microsoft Outlook \nmake it very simple to send anything to anyone and to work with objects that are received. \n\u25cf Mobile-program systems: Capabilities such as Java and ActiveX allow programs \nto move on their own from one system to another. \nIn response to the threat posed by these Internet-based capabilities, IBM has \ndeveloped a prototype digital immune system.The objective of this system is to provide \nrapid response time so that viruses can be stamped out almost as soon as they are \nintroduced. When a new virus enters an organization, the immune system automatically \ncaptures it, analyzes it, adds detection and shielding for it, removes it, and passes \ninformation about that virus to systems running IBM AntiVirus so that it can be detected \nbefore it is allowed to run elsewhere. Figure 3.8 illustrates the typical steps in digital \nimmune system operation:", "chunk_id": "c6fe9ef6-d5c0-4da3-ba20-ca4fe2a97275", "chroma:document": "[NACH97]. Recall that when a file containing a polymorphic virus is executed, the virus \nmust decrypt itself to activate. In order to detect such a structure, executable files are run \nthrough a GD scanner, which contains the following elements: \n\u25cf CPU emulator: A software-based virtual computer. Instructions in an executable"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: d0ae5a69-fb36-496e-a9d0-9bfb28edaa67
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 109, "full_page_content": "110 \n \n3.5.2 Advanced Antivirus Techniques \nMore sophisticated antivirus approaches and products continue to appear.  \nGeneric Decryption \n  Generic decryption (GD) technology enables the antivirus program to easily detect even \nthe most complex polymorphic viruses, while maintaining fast scanning speeds \n[NACH97]. Recall that when a file containing a polymorphic virus is executed, the virus \nmust decrypt itself to activate. In order to detect such a structure, executable files are run \nthrough a GD scanner, which contains the following elements: \n\u25cf CPU emulator: A software-based virtual computer. Instructions in an executable \nfile are interpreted by the emulator rather than executed on the underlying processor. The \nemulator  \nincludes software versions of all registers and other processor hardware, so that the \nunderlying processor is unaffected by programs interpreted on the emulator. \n\u25cf Virus signature scanner: A module that scans the target code looking for known \nvirus  \nsignatures. \n\u25cf Emulation control module: Controls the execution of the target code \nDigital Immune System \nThe digital immune system is a comprehensive approach to virus protection \ndeveloped by IBM. The motivation for this development has been the rising threat of \nInternet-based virus propagation. Two major trends in Internet technology have had an \nincreasing impact on the rate of virus propagation in recent years: \n\u2022 \nIntegrated mail systems: Systems such as Lotus Notes and Microsoft Outlook \nmake it very simple to send anything to anyone and to work with objects that are received. \n\u25cf Mobile-program systems: Capabilities such as Java and ActiveX allow programs \nto move on their own from one system to another. \nIn response to the threat posed by these Internet-based capabilities, IBM has \ndeveloped a prototype digital immune system.The objective of this system is to provide \nrapid response time so that viruses can be stamped out almost as soon as they are \nintroduced. When a new virus enters an organization, the immune system automatically \ncaptures it, analyzes it, adds detection and shielding for it, removes it, and passes \ninformation about that virus to systems running IBM AntiVirus so that it can be detected \nbefore it is allowed to run elsewhere. Figure 3.8 illustrates the typical steps in digital \nimmune system operation:", "chunk_id": "c7074126-379f-429d-92ae-fb4f53d0946c", "chroma:document": "file are interpreted by the emulator rather than executed on the underlying processor. The \nemulator  \nincludes software versions of all registers and other processor hardware, so that the \nunderlying processor is unaffected by programs interpreted on the emulator. \n\u25cf Virus signature scanner: A module that scans the target code looking for known \nvirus  \nsignatures."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 75f0bb4e-de31-4391-b9cc-a60947732b42
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 109, "full_page_content": "110 \n \n3.5.2 Advanced Antivirus Techniques \nMore sophisticated antivirus approaches and products continue to appear.  \nGeneric Decryption \n  Generic decryption (GD) technology enables the antivirus program to easily detect even \nthe most complex polymorphic viruses, while maintaining fast scanning speeds \n[NACH97]. Recall that when a file containing a polymorphic virus is executed, the virus \nmust decrypt itself to activate. In order to detect such a structure, executable files are run \nthrough a GD scanner, which contains the following elements: \n\u25cf CPU emulator: A software-based virtual computer. Instructions in an executable \nfile are interpreted by the emulator rather than executed on the underlying processor. The \nemulator  \nincludes software versions of all registers and other processor hardware, so that the \nunderlying processor is unaffected by programs interpreted on the emulator. \n\u25cf Virus signature scanner: A module that scans the target code looking for known \nvirus  \nsignatures. \n\u25cf Emulation control module: Controls the execution of the target code \nDigital Immune System \nThe digital immune system is a comprehensive approach to virus protection \ndeveloped by IBM. The motivation for this development has been the rising threat of \nInternet-based virus propagation. Two major trends in Internet technology have had an \nincreasing impact on the rate of virus propagation in recent years: \n\u2022 \nIntegrated mail systems: Systems such as Lotus Notes and Microsoft Outlook \nmake it very simple to send anything to anyone and to work with objects that are received. \n\u25cf Mobile-program systems: Capabilities such as Java and ActiveX allow programs \nto move on their own from one system to another. \nIn response to the threat posed by these Internet-based capabilities, IBM has \ndeveloped a prototype digital immune system.The objective of this system is to provide \nrapid response time so that viruses can be stamped out almost as soon as they are \nintroduced. When a new virus enters an organization, the immune system automatically \ncaptures it, analyzes it, adds detection and shielding for it, removes it, and passes \ninformation about that virus to systems running IBM AntiVirus so that it can be detected \nbefore it is allowed to run elsewhere. Figure 3.8 illustrates the typical steps in digital \nimmune system operation:", "chunk_id": "a344706e-0c5d-4a5b-8eec-0f27252dc1dd", "chroma:document": "signatures. \n\u25cf Emulation control module: Controls the execution of the target code \nDigital Immune System \nThe digital immune system is a comprehensive approach to virus protection \ndeveloped by IBM. The motivation for this development has been the rising threat of \nInternet-based virus propagation. Two major trends in Internet technology have had an"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 4dda5e79-f6f9-4e17-9078-156659836c4b
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 109, "full_page_content": "110 \n \n3.5.2 Advanced Antivirus Techniques \nMore sophisticated antivirus approaches and products continue to appear.  \nGeneric Decryption \n  Generic decryption (GD) technology enables the antivirus program to easily detect even \nthe most complex polymorphic viruses, while maintaining fast scanning speeds \n[NACH97]. Recall that when a file containing a polymorphic virus is executed, the virus \nmust decrypt itself to activate. In order to detect such a structure, executable files are run \nthrough a GD scanner, which contains the following elements: \n\u25cf CPU emulator: A software-based virtual computer. Instructions in an executable \nfile are interpreted by the emulator rather than executed on the underlying processor. The \nemulator  \nincludes software versions of all registers and other processor hardware, so that the \nunderlying processor is unaffected by programs interpreted on the emulator. \n\u25cf Virus signature scanner: A module that scans the target code looking for known \nvirus  \nsignatures. \n\u25cf Emulation control module: Controls the execution of the target code \nDigital Immune System \nThe digital immune system is a comprehensive approach to virus protection \ndeveloped by IBM. The motivation for this development has been the rising threat of \nInternet-based virus propagation. Two major trends in Internet technology have had an \nincreasing impact on the rate of virus propagation in recent years: \n\u2022 \nIntegrated mail systems: Systems such as Lotus Notes and Microsoft Outlook \nmake it very simple to send anything to anyone and to work with objects that are received. \n\u25cf Mobile-program systems: Capabilities such as Java and ActiveX allow programs \nto move on their own from one system to another. \nIn response to the threat posed by these Internet-based capabilities, IBM has \ndeveloped a prototype digital immune system.The objective of this system is to provide \nrapid response time so that viruses can be stamped out almost as soon as they are \nintroduced. When a new virus enters an organization, the immune system automatically \ncaptures it, analyzes it, adds detection and shielding for it, removes it, and passes \ninformation about that virus to systems running IBM AntiVirus so that it can be detected \nbefore it is allowed to run elsewhere. Figure 3.8 illustrates the typical steps in digital \nimmune system operation:", "chunk_id": "b076ef9e-b053-4e4c-b086-ce46459bd932", "chroma:document": "increasing impact on the rate of virus propagation in recent years: \n\u2022 \nIntegrated mail systems: Systems such as Lotus Notes and Microsoft Outlook \nmake it very simple to send anything to anyone and to work with objects that are received. \n\u25cf Mobile-program systems: Capabilities such as Java and ActiveX allow programs \nto move on their own from one system to another."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 38e0ca71-4247-4fe8-8d92-f41d2cf02800
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 109, "full_page_content": "110 \n \n3.5.2 Advanced Antivirus Techniques \nMore sophisticated antivirus approaches and products continue to appear.  \nGeneric Decryption \n  Generic decryption (GD) technology enables the antivirus program to easily detect even \nthe most complex polymorphic viruses, while maintaining fast scanning speeds \n[NACH97]. Recall that when a file containing a polymorphic virus is executed, the virus \nmust decrypt itself to activate. In order to detect such a structure, executable files are run \nthrough a GD scanner, which contains the following elements: \n\u25cf CPU emulator: A software-based virtual computer. Instructions in an executable \nfile are interpreted by the emulator rather than executed on the underlying processor. The \nemulator  \nincludes software versions of all registers and other processor hardware, so that the \nunderlying processor is unaffected by programs interpreted on the emulator. \n\u25cf Virus signature scanner: A module that scans the target code looking for known \nvirus  \nsignatures. \n\u25cf Emulation control module: Controls the execution of the target code \nDigital Immune System \nThe digital immune system is a comprehensive approach to virus protection \ndeveloped by IBM. The motivation for this development has been the rising threat of \nInternet-based virus propagation. Two major trends in Internet technology have had an \nincreasing impact on the rate of virus propagation in recent years: \n\u2022 \nIntegrated mail systems: Systems such as Lotus Notes and Microsoft Outlook \nmake it very simple to send anything to anyone and to work with objects that are received. \n\u25cf Mobile-program systems: Capabilities such as Java and ActiveX allow programs \nto move on their own from one system to another. \nIn response to the threat posed by these Internet-based capabilities, IBM has \ndeveloped a prototype digital immune system.The objective of this system is to provide \nrapid response time so that viruses can be stamped out almost as soon as they are \nintroduced. When a new virus enters an organization, the immune system automatically \ncaptures it, analyzes it, adds detection and shielding for it, removes it, and passes \ninformation about that virus to systems running IBM AntiVirus so that it can be detected \nbefore it is allowed to run elsewhere. Figure 3.8 illustrates the typical steps in digital \nimmune system operation:", "chunk_id": "633157bf-a237-409f-afee-2eaa7ab768ad", "chroma:document": "In response to the threat posed by these Internet-based capabilities, IBM has \ndeveloped a prototype digital immune system.The objective of this system is to provide \nrapid response time so that viruses can be stamped out almost as soon as they are \nintroduced. When a new virus enters an organization, the immune system automatically"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 0f7b90fa-c10a-4faf-b52b-2976b6d36506
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 109, "full_page_content": "110 \n \n3.5.2 Advanced Antivirus Techniques \nMore sophisticated antivirus approaches and products continue to appear.  \nGeneric Decryption \n  Generic decryption (GD) technology enables the antivirus program to easily detect even \nthe most complex polymorphic viruses, while maintaining fast scanning speeds \n[NACH97]. Recall that when a file containing a polymorphic virus is executed, the virus \nmust decrypt itself to activate. In order to detect such a structure, executable files are run \nthrough a GD scanner, which contains the following elements: \n\u25cf CPU emulator: A software-based virtual computer. Instructions in an executable \nfile are interpreted by the emulator rather than executed on the underlying processor. The \nemulator  \nincludes software versions of all registers and other processor hardware, so that the \nunderlying processor is unaffected by programs interpreted on the emulator. \n\u25cf Virus signature scanner: A module that scans the target code looking for known \nvirus  \nsignatures. \n\u25cf Emulation control module: Controls the execution of the target code \nDigital Immune System \nThe digital immune system is a comprehensive approach to virus protection \ndeveloped by IBM. The motivation for this development has been the rising threat of \nInternet-based virus propagation. Two major trends in Internet technology have had an \nincreasing impact on the rate of virus propagation in recent years: \n\u2022 \nIntegrated mail systems: Systems such as Lotus Notes and Microsoft Outlook \nmake it very simple to send anything to anyone and to work with objects that are received. \n\u25cf Mobile-program systems: Capabilities such as Java and ActiveX allow programs \nto move on their own from one system to another. \nIn response to the threat posed by these Internet-based capabilities, IBM has \ndeveloped a prototype digital immune system.The objective of this system is to provide \nrapid response time so that viruses can be stamped out almost as soon as they are \nintroduced. When a new virus enters an organization, the immune system automatically \ncaptures it, analyzes it, adds detection and shielding for it, removes it, and passes \ninformation about that virus to systems running IBM AntiVirus so that it can be detected \nbefore it is allowed to run elsewhere. Figure 3.8 illustrates the typical steps in digital \nimmune system operation:", "chunk_id": "332b1b57-3cdb-4043-88e2-59ddf9b34078", "chroma:document": "captures it, analyzes it, adds detection and shielding for it, removes it, and passes \ninformation about that virus to systems running IBM AntiVirus so that it can be detected \nbefore it is allowed to run elsewhere. Figure 3.8 illustrates the typical steps in digital \nimmune system operation:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 481376cb-2a2e-43a5-9f7d-47c055bd7a41
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 110, "full_page_content": "111 \n \n \nFigure 3.8. Digital Immune System \nFig 3.8 illustrates the typical steps in digital immune system operation: \n1. A monitoring program on each PC uses a variety of heuristics based on system \nbehavior, suspicious changes to programs, or family signature to infer that a virus may \nbe present.  \n2. The administrative machine encrypts the sample and sends it to a central virus \nanalysis machine.  \n3. This machine creates an environment in which the infected program can be safely \nrun for analysis. Techniques used for this purpose include emulation, or the creation of a \nprotected environment within which the suspect program can be executed and monitored.  \n4. The resulting prescription is sent back to the administrative machine.  \n5. The administrative machine forwards the prescription to the infected client.  \n6. The prescription is also forwarded to other clients in the organization.  \n7. Subscribers around the world receive regular antivirus updates that protect them \nfrom the new virus. \nThe success of the digital immune system depends on the ability of the virus analysis \nmachine to detect new and innovative virus strains. \n \n3.5.3 Behavior-Blocking Software \nBehavior-blocking software integrates with the operating system of a host computer \nand monitors program behavior in real-time for malicious actions. The behavior blocking \nsoftware then blocks potentially malicious actions before they have a chance to affect the \nsystem. Monitored behaviors can include the following: \n\u25cf Attempts to open, view, delete, and/or modify files; \n\u25cf Attempts to format disk drives and other unrecoverable disk operations; \n\u25cf Modifications to the logic of executable files or macros; \n\u25cf Modification of critical system settings, such as start-up settings; \n\u25cf Scripting of e-mail and instant messaging clients to send executable content; and \n\u25cf Initiation of network communications.", "chunk_id": "799f169a-de91-4594-af43-e016f62d45b8", "chroma:document": "111 \n \n \nFigure 3.8. Digital Immune System \nFig 3.8 illustrates the typical steps in digital immune system operation: \n1. A monitoring program on each PC uses a variety of heuristics based on system \nbehavior, suspicious changes to programs, or family signature to infer that a virus may \nbe present."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 02bbbc45-1f35-47f5-b3fe-76153c2aab44
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 110, "full_page_content": "111 \n \n \nFigure 3.8. Digital Immune System \nFig 3.8 illustrates the typical steps in digital immune system operation: \n1. A monitoring program on each PC uses a variety of heuristics based on system \nbehavior, suspicious changes to programs, or family signature to infer that a virus may \nbe present.  \n2. The administrative machine encrypts the sample and sends it to a central virus \nanalysis machine.  \n3. This machine creates an environment in which the infected program can be safely \nrun for analysis. Techniques used for this purpose include emulation, or the creation of a \nprotected environment within which the suspect program can be executed and monitored.  \n4. The resulting prescription is sent back to the administrative machine.  \n5. The administrative machine forwards the prescription to the infected client.  \n6. The prescription is also forwarded to other clients in the organization.  \n7. Subscribers around the world receive regular antivirus updates that protect them \nfrom the new virus. \nThe success of the digital immune system depends on the ability of the virus analysis \nmachine to detect new and innovative virus strains. \n \n3.5.3 Behavior-Blocking Software \nBehavior-blocking software integrates with the operating system of a host computer \nand monitors program behavior in real-time for malicious actions. The behavior blocking \nsoftware then blocks potentially malicious actions before they have a chance to affect the \nsystem. Monitored behaviors can include the following: \n\u25cf Attempts to open, view, delete, and/or modify files; \n\u25cf Attempts to format disk drives and other unrecoverable disk operations; \n\u25cf Modifications to the logic of executable files or macros; \n\u25cf Modification of critical system settings, such as start-up settings; \n\u25cf Scripting of e-mail and instant messaging clients to send executable content; and \n\u25cf Initiation of network communications.", "chunk_id": "6d894eb0-5848-4cf2-a883-e714118b6c3c", "chroma:document": "be present.  \n2. The administrative machine encrypts the sample and sends it to a central virus \nanalysis machine.  \n3. This machine creates an environment in which the infected program can be safely \nrun for analysis. Techniques used for this purpose include emulation, or the creation of a \nprotected environment within which the suspect program can be executed and monitored."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: f008635d-a884-4ca8-8939-8f6c716936a5
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 110, "full_page_content": "111 \n \n \nFigure 3.8. Digital Immune System \nFig 3.8 illustrates the typical steps in digital immune system operation: \n1. A monitoring program on each PC uses a variety of heuristics based on system \nbehavior, suspicious changes to programs, or family signature to infer that a virus may \nbe present.  \n2. The administrative machine encrypts the sample and sends it to a central virus \nanalysis machine.  \n3. This machine creates an environment in which the infected program can be safely \nrun for analysis. Techniques used for this purpose include emulation, or the creation of a \nprotected environment within which the suspect program can be executed and monitored.  \n4. The resulting prescription is sent back to the administrative machine.  \n5. The administrative machine forwards the prescription to the infected client.  \n6. The prescription is also forwarded to other clients in the organization.  \n7. Subscribers around the world receive regular antivirus updates that protect them \nfrom the new virus. \nThe success of the digital immune system depends on the ability of the virus analysis \nmachine to detect new and innovative virus strains. \n \n3.5.3 Behavior-Blocking Software \nBehavior-blocking software integrates with the operating system of a host computer \nand monitors program behavior in real-time for malicious actions. The behavior blocking \nsoftware then blocks potentially malicious actions before they have a chance to affect the \nsystem. Monitored behaviors can include the following: \n\u25cf Attempts to open, view, delete, and/or modify files; \n\u25cf Attempts to format disk drives and other unrecoverable disk operations; \n\u25cf Modifications to the logic of executable files or macros; \n\u25cf Modification of critical system settings, such as start-up settings; \n\u25cf Scripting of e-mail and instant messaging clients to send executable content; and \n\u25cf Initiation of network communications.", "chunk_id": "d0b6e71d-1569-4dc0-8eb3-495121cfcddb", "chroma:document": "4. The resulting prescription is sent back to the administrative machine.  \n5. The administrative machine forwards the prescription to the infected client.  \n6. The prescription is also forwarded to other clients in the organization.  \n7. Subscribers around the world receive regular antivirus updates that protect them \nfrom the new virus."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: a8fa245a-0e9c-40d9-b4f8-aa887eeab2ec
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 110, "full_page_content": "111 \n \n \nFigure 3.8. Digital Immune System \nFig 3.8 illustrates the typical steps in digital immune system operation: \n1. A monitoring program on each PC uses a variety of heuristics based on system \nbehavior, suspicious changes to programs, or family signature to infer that a virus may \nbe present.  \n2. The administrative machine encrypts the sample and sends it to a central virus \nanalysis machine.  \n3. This machine creates an environment in which the infected program can be safely \nrun for analysis. Techniques used for this purpose include emulation, or the creation of a \nprotected environment within which the suspect program can be executed and monitored.  \n4. The resulting prescription is sent back to the administrative machine.  \n5. The administrative machine forwards the prescription to the infected client.  \n6. The prescription is also forwarded to other clients in the organization.  \n7. Subscribers around the world receive regular antivirus updates that protect them \nfrom the new virus. \nThe success of the digital immune system depends on the ability of the virus analysis \nmachine to detect new and innovative virus strains. \n \n3.5.3 Behavior-Blocking Software \nBehavior-blocking software integrates with the operating system of a host computer \nand monitors program behavior in real-time for malicious actions. The behavior blocking \nsoftware then blocks potentially malicious actions before they have a chance to affect the \nsystem. Monitored behaviors can include the following: \n\u25cf Attempts to open, view, delete, and/or modify files; \n\u25cf Attempts to format disk drives and other unrecoverable disk operations; \n\u25cf Modifications to the logic of executable files or macros; \n\u25cf Modification of critical system settings, such as start-up settings; \n\u25cf Scripting of e-mail and instant messaging clients to send executable content; and \n\u25cf Initiation of network communications.", "chunk_id": "e0df9c63-7cdd-4418-9a16-11f4a2fcbc4d", "chroma:document": "The success of the digital immune system depends on the ability of the virus analysis \nmachine to detect new and innovative virus strains. \n \n3.5.3 Behavior-Blocking Software \nBehavior-blocking software integrates with the operating system of a host computer \nand monitors program behavior in real-time for malicious actions. The behavior blocking"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: db6e9f33-af90-4716-a480-ab7a83c47882
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 110, "full_page_content": "111 \n \n \nFigure 3.8. Digital Immune System \nFig 3.8 illustrates the typical steps in digital immune system operation: \n1. A monitoring program on each PC uses a variety of heuristics based on system \nbehavior, suspicious changes to programs, or family signature to infer that a virus may \nbe present.  \n2. The administrative machine encrypts the sample and sends it to a central virus \nanalysis machine.  \n3. This machine creates an environment in which the infected program can be safely \nrun for analysis. Techniques used for this purpose include emulation, or the creation of a \nprotected environment within which the suspect program can be executed and monitored.  \n4. The resulting prescription is sent back to the administrative machine.  \n5. The administrative machine forwards the prescription to the infected client.  \n6. The prescription is also forwarded to other clients in the organization.  \n7. Subscribers around the world receive regular antivirus updates that protect them \nfrom the new virus. \nThe success of the digital immune system depends on the ability of the virus analysis \nmachine to detect new and innovative virus strains. \n \n3.5.3 Behavior-Blocking Software \nBehavior-blocking software integrates with the operating system of a host computer \nand monitors program behavior in real-time for malicious actions. The behavior blocking \nsoftware then blocks potentially malicious actions before they have a chance to affect the \nsystem. Monitored behaviors can include the following: \n\u25cf Attempts to open, view, delete, and/or modify files; \n\u25cf Attempts to format disk drives and other unrecoverable disk operations; \n\u25cf Modifications to the logic of executable files or macros; \n\u25cf Modification of critical system settings, such as start-up settings; \n\u25cf Scripting of e-mail and instant messaging clients to send executable content; and \n\u25cf Initiation of network communications.", "chunk_id": "012d91ac-96bc-460a-993d-0c78b9a07d8b", "chroma:document": "software then blocks potentially malicious actions before they have a chance to affect the \nsystem. Monitored behaviors can include the following: \n\u25cf Attempts to open, view, delete, and/or modify files; \n\u25cf Attempts to format disk drives and other unrecoverable disk operations; \n\u25cf Modifications to the logic of executable files or macros;"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 2b45e4ee-b9d4-4905-987e-36a288e1a199
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 110, "full_page_content": "111 \n \n \nFigure 3.8. Digital Immune System \nFig 3.8 illustrates the typical steps in digital immune system operation: \n1. A monitoring program on each PC uses a variety of heuristics based on system \nbehavior, suspicious changes to programs, or family signature to infer that a virus may \nbe present.  \n2. The administrative machine encrypts the sample and sends it to a central virus \nanalysis machine.  \n3. This machine creates an environment in which the infected program can be safely \nrun for analysis. Techniques used for this purpose include emulation, or the creation of a \nprotected environment within which the suspect program can be executed and monitored.  \n4. The resulting prescription is sent back to the administrative machine.  \n5. The administrative machine forwards the prescription to the infected client.  \n6. The prescription is also forwarded to other clients in the organization.  \n7. Subscribers around the world receive regular antivirus updates that protect them \nfrom the new virus. \nThe success of the digital immune system depends on the ability of the virus analysis \nmachine to detect new and innovative virus strains. \n \n3.5.3 Behavior-Blocking Software \nBehavior-blocking software integrates with the operating system of a host computer \nand monitors program behavior in real-time for malicious actions. The behavior blocking \nsoftware then blocks potentially malicious actions before they have a chance to affect the \nsystem. Monitored behaviors can include the following: \n\u25cf Attempts to open, view, delete, and/or modify files; \n\u25cf Attempts to format disk drives and other unrecoverable disk operations; \n\u25cf Modifications to the logic of executable files or macros; \n\u25cf Modification of critical system settings, such as start-up settings; \n\u25cf Scripting of e-mail and instant messaging clients to send executable content; and \n\u25cf Initiation of network communications.", "chunk_id": "5005d9cd-0b60-4a4f-aff9-d2588fe04c21", "chroma:document": "\u25cf Modification of critical system settings, such as start-up settings; \n\u25cf Scripting of e-mail and instant messaging clients to send executable content; and \n\u25cf Initiation of network communications."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 3d57b7f2-d2ca-4d39-a150-d8826a76ab83
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 111, "full_page_content": "112 \n \nIf the behavior blocker detects that a program is initiating would-be malicious \nbehaviors as it runs, it can block these behaviors in real-time and/or terminate the \noffending software. This gives it a fundamental advantage over such established antivirus \ndetection techniques as fingerprinting or heuristics.  \nThe ability to watch software as it runs in real time clearly confers a huge benefit to \nthe behavior blocker; however, it also has drawbacks. Since the malicious code must \nactually run on the target machine before all its behaviors can be identified, it can cause \na great deal of harm to the system before it has been detected and blocked by the behavior \nblocking system. For instance, a new virus might shuffle a number of seemingly \nunimportant files around the hard drive before infecting a single file and being blocked.  \n3.6 Distributed Denial of Service Attacks \n \nDistributed denial of service (DDoS) attacks present a significant security threat to \ncorporations, and the threat appears to be growing . In one study, covering a three-week \nperiod in 2001, investigators observed more than 12,000 attacks against more than 5000 \ndistinct targets, ranging from well-known ecommerce companies such as Amazon and \nHotmail to small foreign ISPs and dial-up connections. DDoS attacks make computer \nsystems inaccessible by flooding servers, networks, or even end user systems with useless \ntraffic so that legitimate users can no longer gain access to those resources.  \n \n A denial of service (DoS) attack is an attempt to prevent legitimate users of a service \nfrom using that service. When this attack comes from a single host or network node, then \nit is simply referred to as a DoS attack. A more serious threat is posed by a DDoS attack. \nIn a DDoS attack, an attacker is able to recruit a number of hosts throughout the Internet \nto simultaneously or in a coordinated fashion launch an attack upon the target. This \nsection is concerned with DDoS attacks.  \n3.6.1 DDoS Attack Description \n \nA DDoS attack attempts to consume the target's resources so that it cannot provide \nservice. One way to classify DDoS attacks is in terms of the type of resource that is \nconsumed. Broadly speaking, the resource consumed is either an internal host resource \non the target system or data transmission capacity in the local network to which the target \nis attacked. \nA simple example of an internal resource attack is the SYN flood attack. Figure 19.5a \nshows the steps involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to \ncontact the target Web server.  \n2. The slave hosts begin sending TCP/IP SYN (synchronize/initialization) packets, with \nerroneous return IP address information, to the target. \n3. Each SYN packet is a request to open a TCP connection. For each such packet, the \nWeb server responds with a SYN/ACK (synchronize/acknowledge) packet, trying to \nestablish a TCP connection with a TCP entity at a spurious IP address. The Web server \nmaintains a data structure for each SYN request waiting for a response back and becomes \nbogged down as more traffic floods in. The result is that legitimate connections are denied \nwhile the victim machine is waiting to complete bogus \"half-open\" connections.", "chunk_id": "50a84d09-97c9-4a7b-84b8-245e8325c3d6", "chroma:document": "112 \n \nIf the behavior blocker detects that a program is initiating would-be malicious \nbehaviors as it runs, it can block these behaviors in real-time and/or terminate the \noffending software. This gives it a fundamental advantage over such established antivirus \ndetection techniques as fingerprinting or heuristics."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 6ae227d3-720f-4ef5-8369-4d364c3b48fb
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 111, "full_page_content": "112 \n \nIf the behavior blocker detects that a program is initiating would-be malicious \nbehaviors as it runs, it can block these behaviors in real-time and/or terminate the \noffending software. This gives it a fundamental advantage over such established antivirus \ndetection techniques as fingerprinting or heuristics.  \nThe ability to watch software as it runs in real time clearly confers a huge benefit to \nthe behavior blocker; however, it also has drawbacks. Since the malicious code must \nactually run on the target machine before all its behaviors can be identified, it can cause \na great deal of harm to the system before it has been detected and blocked by the behavior \nblocking system. For instance, a new virus might shuffle a number of seemingly \nunimportant files around the hard drive before infecting a single file and being blocked.  \n3.6 Distributed Denial of Service Attacks \n \nDistributed denial of service (DDoS) attacks present a significant security threat to \ncorporations, and the threat appears to be growing . In one study, covering a three-week \nperiod in 2001, investigators observed more than 12,000 attacks against more than 5000 \ndistinct targets, ranging from well-known ecommerce companies such as Amazon and \nHotmail to small foreign ISPs and dial-up connections. DDoS attacks make computer \nsystems inaccessible by flooding servers, networks, or even end user systems with useless \ntraffic so that legitimate users can no longer gain access to those resources.  \n \n A denial of service (DoS) attack is an attempt to prevent legitimate users of a service \nfrom using that service. When this attack comes from a single host or network node, then \nit is simply referred to as a DoS attack. A more serious threat is posed by a DDoS attack. \nIn a DDoS attack, an attacker is able to recruit a number of hosts throughout the Internet \nto simultaneously or in a coordinated fashion launch an attack upon the target. This \nsection is concerned with DDoS attacks.  \n3.6.1 DDoS Attack Description \n \nA DDoS attack attempts to consume the target's resources so that it cannot provide \nservice. One way to classify DDoS attacks is in terms of the type of resource that is \nconsumed. Broadly speaking, the resource consumed is either an internal host resource \non the target system or data transmission capacity in the local network to which the target \nis attacked. \nA simple example of an internal resource attack is the SYN flood attack. Figure 19.5a \nshows the steps involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to \ncontact the target Web server.  \n2. The slave hosts begin sending TCP/IP SYN (synchronize/initialization) packets, with \nerroneous return IP address information, to the target. \n3. Each SYN packet is a request to open a TCP connection. For each such packet, the \nWeb server responds with a SYN/ACK (synchronize/acknowledge) packet, trying to \nestablish a TCP connection with a TCP entity at a spurious IP address. The Web server \nmaintains a data structure for each SYN request waiting for a response back and becomes \nbogged down as more traffic floods in. The result is that legitimate connections are denied \nwhile the victim machine is waiting to complete bogus \"half-open\" connections.", "chunk_id": "791b050b-0172-4a74-bef1-032aa549ceca", "chroma:document": "The ability to watch software as it runs in real time clearly confers a huge benefit to \nthe behavior blocker; however, it also has drawbacks. Since the malicious code must \nactually run on the target machine before all its behaviors can be identified, it can cause \na great deal of harm to the system before it has been detected and blocked by the behavior"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: b372d58a-3ddd-4ec7-9003-79cf7b59b8e6
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 111, "full_page_content": "112 \n \nIf the behavior blocker detects that a program is initiating would-be malicious \nbehaviors as it runs, it can block these behaviors in real-time and/or terminate the \noffending software. This gives it a fundamental advantage over such established antivirus \ndetection techniques as fingerprinting or heuristics.  \nThe ability to watch software as it runs in real time clearly confers a huge benefit to \nthe behavior blocker; however, it also has drawbacks. Since the malicious code must \nactually run on the target machine before all its behaviors can be identified, it can cause \na great deal of harm to the system before it has been detected and blocked by the behavior \nblocking system. For instance, a new virus might shuffle a number of seemingly \nunimportant files around the hard drive before infecting a single file and being blocked.  \n3.6 Distributed Denial of Service Attacks \n \nDistributed denial of service (DDoS) attacks present a significant security threat to \ncorporations, and the threat appears to be growing . In one study, covering a three-week \nperiod in 2001, investigators observed more than 12,000 attacks against more than 5000 \ndistinct targets, ranging from well-known ecommerce companies such as Amazon and \nHotmail to small foreign ISPs and dial-up connections. DDoS attacks make computer \nsystems inaccessible by flooding servers, networks, or even end user systems with useless \ntraffic so that legitimate users can no longer gain access to those resources.  \n \n A denial of service (DoS) attack is an attempt to prevent legitimate users of a service \nfrom using that service. When this attack comes from a single host or network node, then \nit is simply referred to as a DoS attack. A more serious threat is posed by a DDoS attack. \nIn a DDoS attack, an attacker is able to recruit a number of hosts throughout the Internet \nto simultaneously or in a coordinated fashion launch an attack upon the target. This \nsection is concerned with DDoS attacks.  \n3.6.1 DDoS Attack Description \n \nA DDoS attack attempts to consume the target's resources so that it cannot provide \nservice. One way to classify DDoS attacks is in terms of the type of resource that is \nconsumed. Broadly speaking, the resource consumed is either an internal host resource \non the target system or data transmission capacity in the local network to which the target \nis attacked. \nA simple example of an internal resource attack is the SYN flood attack. Figure 19.5a \nshows the steps involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to \ncontact the target Web server.  \n2. The slave hosts begin sending TCP/IP SYN (synchronize/initialization) packets, with \nerroneous return IP address information, to the target. \n3. Each SYN packet is a request to open a TCP connection. For each such packet, the \nWeb server responds with a SYN/ACK (synchronize/acknowledge) packet, trying to \nestablish a TCP connection with a TCP entity at a spurious IP address. The Web server \nmaintains a data structure for each SYN request waiting for a response back and becomes \nbogged down as more traffic floods in. The result is that legitimate connections are denied \nwhile the victim machine is waiting to complete bogus \"half-open\" connections.", "chunk_id": "1e7788b1-82ff-4831-a31f-7ef54b2a671a", "chroma:document": "blocking system. For instance, a new virus might shuffle a number of seemingly \nunimportant files around the hard drive before infecting a single file and being blocked.  \n3.6 Distributed Denial of Service Attacks \n \nDistributed denial of service (DDoS) attacks present a significant security threat to"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 60f96d7d-0a35-4a09-9efb-8a99b369edae
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 111, "full_page_content": "112 \n \nIf the behavior blocker detects that a program is initiating would-be malicious \nbehaviors as it runs, it can block these behaviors in real-time and/or terminate the \noffending software. This gives it a fundamental advantage over such established antivirus \ndetection techniques as fingerprinting or heuristics.  \nThe ability to watch software as it runs in real time clearly confers a huge benefit to \nthe behavior blocker; however, it also has drawbacks. Since the malicious code must \nactually run on the target machine before all its behaviors can be identified, it can cause \na great deal of harm to the system before it has been detected and blocked by the behavior \nblocking system. For instance, a new virus might shuffle a number of seemingly \nunimportant files around the hard drive before infecting a single file and being blocked.  \n3.6 Distributed Denial of Service Attacks \n \nDistributed denial of service (DDoS) attacks present a significant security threat to \ncorporations, and the threat appears to be growing . In one study, covering a three-week \nperiod in 2001, investigators observed more than 12,000 attacks against more than 5000 \ndistinct targets, ranging from well-known ecommerce companies such as Amazon and \nHotmail to small foreign ISPs and dial-up connections. DDoS attacks make computer \nsystems inaccessible by flooding servers, networks, or even end user systems with useless \ntraffic so that legitimate users can no longer gain access to those resources.  \n \n A denial of service (DoS) attack is an attempt to prevent legitimate users of a service \nfrom using that service. When this attack comes from a single host or network node, then \nit is simply referred to as a DoS attack. A more serious threat is posed by a DDoS attack. \nIn a DDoS attack, an attacker is able to recruit a number of hosts throughout the Internet \nto simultaneously or in a coordinated fashion launch an attack upon the target. This \nsection is concerned with DDoS attacks.  \n3.6.1 DDoS Attack Description \n \nA DDoS attack attempts to consume the target's resources so that it cannot provide \nservice. One way to classify DDoS attacks is in terms of the type of resource that is \nconsumed. Broadly speaking, the resource consumed is either an internal host resource \non the target system or data transmission capacity in the local network to which the target \nis attacked. \nA simple example of an internal resource attack is the SYN flood attack. Figure 19.5a \nshows the steps involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to \ncontact the target Web server.  \n2. The slave hosts begin sending TCP/IP SYN (synchronize/initialization) packets, with \nerroneous return IP address information, to the target. \n3. Each SYN packet is a request to open a TCP connection. For each such packet, the \nWeb server responds with a SYN/ACK (synchronize/acknowledge) packet, trying to \nestablish a TCP connection with a TCP entity at a spurious IP address. The Web server \nmaintains a data structure for each SYN request waiting for a response back and becomes \nbogged down as more traffic floods in. The result is that legitimate connections are denied \nwhile the victim machine is waiting to complete bogus \"half-open\" connections.", "chunk_id": "7f838d2c-a9cc-49e2-9189-0f12dea0839b", "chroma:document": "corporations, and the threat appears to be growing . In one study, covering a three-week \nperiod in 2001, investigators observed more than 12,000 attacks against more than 5000 \ndistinct targets, ranging from well-known ecommerce companies such as Amazon and \nHotmail to small foreign ISPs and dial-up connections. DDoS attacks make computer"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 774beacd-385c-408d-a2b7-d63d3598df6d
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 111, "full_page_content": "112 \n \nIf the behavior blocker detects that a program is initiating would-be malicious \nbehaviors as it runs, it can block these behaviors in real-time and/or terminate the \noffending software. This gives it a fundamental advantage over such established antivirus \ndetection techniques as fingerprinting or heuristics.  \nThe ability to watch software as it runs in real time clearly confers a huge benefit to \nthe behavior blocker; however, it also has drawbacks. Since the malicious code must \nactually run on the target machine before all its behaviors can be identified, it can cause \na great deal of harm to the system before it has been detected and blocked by the behavior \nblocking system. For instance, a new virus might shuffle a number of seemingly \nunimportant files around the hard drive before infecting a single file and being blocked.  \n3.6 Distributed Denial of Service Attacks \n \nDistributed denial of service (DDoS) attacks present a significant security threat to \ncorporations, and the threat appears to be growing . In one study, covering a three-week \nperiod in 2001, investigators observed more than 12,000 attacks against more than 5000 \ndistinct targets, ranging from well-known ecommerce companies such as Amazon and \nHotmail to small foreign ISPs and dial-up connections. DDoS attacks make computer \nsystems inaccessible by flooding servers, networks, or even end user systems with useless \ntraffic so that legitimate users can no longer gain access to those resources.  \n \n A denial of service (DoS) attack is an attempt to prevent legitimate users of a service \nfrom using that service. When this attack comes from a single host or network node, then \nit is simply referred to as a DoS attack. A more serious threat is posed by a DDoS attack. \nIn a DDoS attack, an attacker is able to recruit a number of hosts throughout the Internet \nto simultaneously or in a coordinated fashion launch an attack upon the target. This \nsection is concerned with DDoS attacks.  \n3.6.1 DDoS Attack Description \n \nA DDoS attack attempts to consume the target's resources so that it cannot provide \nservice. One way to classify DDoS attacks is in terms of the type of resource that is \nconsumed. Broadly speaking, the resource consumed is either an internal host resource \non the target system or data transmission capacity in the local network to which the target \nis attacked. \nA simple example of an internal resource attack is the SYN flood attack. Figure 19.5a \nshows the steps involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to \ncontact the target Web server.  \n2. The slave hosts begin sending TCP/IP SYN (synchronize/initialization) packets, with \nerroneous return IP address information, to the target. \n3. Each SYN packet is a request to open a TCP connection. For each such packet, the \nWeb server responds with a SYN/ACK (synchronize/acknowledge) packet, trying to \nestablish a TCP connection with a TCP entity at a spurious IP address. The Web server \nmaintains a data structure for each SYN request waiting for a response back and becomes \nbogged down as more traffic floods in. The result is that legitimate connections are denied \nwhile the victim machine is waiting to complete bogus \"half-open\" connections.", "chunk_id": "53887840-5290-4c13-906a-d781d918a57f", "chroma:document": "systems inaccessible by flooding servers, networks, or even end user systems with useless \ntraffic so that legitimate users can no longer gain access to those resources.  \n \n A denial of service (DoS) attack is an attempt to prevent legitimate users of a service \nfrom using that service. When this attack comes from a single host or network node, then"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 977550dd-ac2f-4ae1-9b31-2a3d22f217ab
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 111, "full_page_content": "112 \n \nIf the behavior blocker detects that a program is initiating would-be malicious \nbehaviors as it runs, it can block these behaviors in real-time and/or terminate the \noffending software. This gives it a fundamental advantage over such established antivirus \ndetection techniques as fingerprinting or heuristics.  \nThe ability to watch software as it runs in real time clearly confers a huge benefit to \nthe behavior blocker; however, it also has drawbacks. Since the malicious code must \nactually run on the target machine before all its behaviors can be identified, it can cause \na great deal of harm to the system before it has been detected and blocked by the behavior \nblocking system. For instance, a new virus might shuffle a number of seemingly \nunimportant files around the hard drive before infecting a single file and being blocked.  \n3.6 Distributed Denial of Service Attacks \n \nDistributed denial of service (DDoS) attacks present a significant security threat to \ncorporations, and the threat appears to be growing . In one study, covering a three-week \nperiod in 2001, investigators observed more than 12,000 attacks against more than 5000 \ndistinct targets, ranging from well-known ecommerce companies such as Amazon and \nHotmail to small foreign ISPs and dial-up connections. DDoS attacks make computer \nsystems inaccessible by flooding servers, networks, or even end user systems with useless \ntraffic so that legitimate users can no longer gain access to those resources.  \n \n A denial of service (DoS) attack is an attempt to prevent legitimate users of a service \nfrom using that service. When this attack comes from a single host or network node, then \nit is simply referred to as a DoS attack. A more serious threat is posed by a DDoS attack. \nIn a DDoS attack, an attacker is able to recruit a number of hosts throughout the Internet \nto simultaneously or in a coordinated fashion launch an attack upon the target. This \nsection is concerned with DDoS attacks.  \n3.6.1 DDoS Attack Description \n \nA DDoS attack attempts to consume the target's resources so that it cannot provide \nservice. One way to classify DDoS attacks is in terms of the type of resource that is \nconsumed. Broadly speaking, the resource consumed is either an internal host resource \non the target system or data transmission capacity in the local network to which the target \nis attacked. \nA simple example of an internal resource attack is the SYN flood attack. Figure 19.5a \nshows the steps involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to \ncontact the target Web server.  \n2. The slave hosts begin sending TCP/IP SYN (synchronize/initialization) packets, with \nerroneous return IP address information, to the target. \n3. Each SYN packet is a request to open a TCP connection. For each such packet, the \nWeb server responds with a SYN/ACK (synchronize/acknowledge) packet, trying to \nestablish a TCP connection with a TCP entity at a spurious IP address. The Web server \nmaintains a data structure for each SYN request waiting for a response back and becomes \nbogged down as more traffic floods in. The result is that legitimate connections are denied \nwhile the victim machine is waiting to complete bogus \"half-open\" connections.", "chunk_id": "f6b7f071-7201-4081-a505-069de3fb565f", "chroma:document": "it is simply referred to as a DoS attack. A more serious threat is posed by a DDoS attack. \nIn a DDoS attack, an attacker is able to recruit a number of hosts throughout the Internet \nto simultaneously or in a coordinated fashion launch an attack upon the target. This \nsection is concerned with DDoS attacks.  \n3.6.1 DDoS Attack Description"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: e1cf687f-2ea5-46e6-8616-a35561ce49d5
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 111, "full_page_content": "112 \n \nIf the behavior blocker detects that a program is initiating would-be malicious \nbehaviors as it runs, it can block these behaviors in real-time and/or terminate the \noffending software. This gives it a fundamental advantage over such established antivirus \ndetection techniques as fingerprinting or heuristics.  \nThe ability to watch software as it runs in real time clearly confers a huge benefit to \nthe behavior blocker; however, it also has drawbacks. Since the malicious code must \nactually run on the target machine before all its behaviors can be identified, it can cause \na great deal of harm to the system before it has been detected and blocked by the behavior \nblocking system. For instance, a new virus might shuffle a number of seemingly \nunimportant files around the hard drive before infecting a single file and being blocked.  \n3.6 Distributed Denial of Service Attacks \n \nDistributed denial of service (DDoS) attacks present a significant security threat to \ncorporations, and the threat appears to be growing . In one study, covering a three-week \nperiod in 2001, investigators observed more than 12,000 attacks against more than 5000 \ndistinct targets, ranging from well-known ecommerce companies such as Amazon and \nHotmail to small foreign ISPs and dial-up connections. DDoS attacks make computer \nsystems inaccessible by flooding servers, networks, or even end user systems with useless \ntraffic so that legitimate users can no longer gain access to those resources.  \n \n A denial of service (DoS) attack is an attempt to prevent legitimate users of a service \nfrom using that service. When this attack comes from a single host or network node, then \nit is simply referred to as a DoS attack. A more serious threat is posed by a DDoS attack. \nIn a DDoS attack, an attacker is able to recruit a number of hosts throughout the Internet \nto simultaneously or in a coordinated fashion launch an attack upon the target. This \nsection is concerned with DDoS attacks.  \n3.6.1 DDoS Attack Description \n \nA DDoS attack attempts to consume the target's resources so that it cannot provide \nservice. One way to classify DDoS attacks is in terms of the type of resource that is \nconsumed. Broadly speaking, the resource consumed is either an internal host resource \non the target system or data transmission capacity in the local network to which the target \nis attacked. \nA simple example of an internal resource attack is the SYN flood attack. Figure 19.5a \nshows the steps involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to \ncontact the target Web server.  \n2. The slave hosts begin sending TCP/IP SYN (synchronize/initialization) packets, with \nerroneous return IP address information, to the target. \n3. Each SYN packet is a request to open a TCP connection. For each such packet, the \nWeb server responds with a SYN/ACK (synchronize/acknowledge) packet, trying to \nestablish a TCP connection with a TCP entity at a spurious IP address. The Web server \nmaintains a data structure for each SYN request waiting for a response back and becomes \nbogged down as more traffic floods in. The result is that legitimate connections are denied \nwhile the victim machine is waiting to complete bogus \"half-open\" connections.", "chunk_id": "8aae70a8-aa31-4670-ac37-cc61486abe52", "chroma:document": "A DDoS attack attempts to consume the target's resources so that it cannot provide \nservice. One way to classify DDoS attacks is in terms of the type of resource that is \nconsumed. Broadly speaking, the resource consumed is either an internal host resource \non the target system or data transmission capacity in the local network to which the target \nis attacked."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 4c281268-c26f-499c-aad5-70a58469c83a
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 111, "full_page_content": "112 \n \nIf the behavior blocker detects that a program is initiating would-be malicious \nbehaviors as it runs, it can block these behaviors in real-time and/or terminate the \noffending software. This gives it a fundamental advantage over such established antivirus \ndetection techniques as fingerprinting or heuristics.  \nThe ability to watch software as it runs in real time clearly confers a huge benefit to \nthe behavior blocker; however, it also has drawbacks. Since the malicious code must \nactually run on the target machine before all its behaviors can be identified, it can cause \na great deal of harm to the system before it has been detected and blocked by the behavior \nblocking system. For instance, a new virus might shuffle a number of seemingly \nunimportant files around the hard drive before infecting a single file and being blocked.  \n3.6 Distributed Denial of Service Attacks \n \nDistributed denial of service (DDoS) attacks present a significant security threat to \ncorporations, and the threat appears to be growing . In one study, covering a three-week \nperiod in 2001, investigators observed more than 12,000 attacks against more than 5000 \ndistinct targets, ranging from well-known ecommerce companies such as Amazon and \nHotmail to small foreign ISPs and dial-up connections. DDoS attacks make computer \nsystems inaccessible by flooding servers, networks, or even end user systems with useless \ntraffic so that legitimate users can no longer gain access to those resources.  \n \n A denial of service (DoS) attack is an attempt to prevent legitimate users of a service \nfrom using that service. When this attack comes from a single host or network node, then \nit is simply referred to as a DoS attack. A more serious threat is posed by a DDoS attack. \nIn a DDoS attack, an attacker is able to recruit a number of hosts throughout the Internet \nto simultaneously or in a coordinated fashion launch an attack upon the target. This \nsection is concerned with DDoS attacks.  \n3.6.1 DDoS Attack Description \n \nA DDoS attack attempts to consume the target's resources so that it cannot provide \nservice. One way to classify DDoS attacks is in terms of the type of resource that is \nconsumed. Broadly speaking, the resource consumed is either an internal host resource \non the target system or data transmission capacity in the local network to which the target \nis attacked. \nA simple example of an internal resource attack is the SYN flood attack. Figure 19.5a \nshows the steps involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to \ncontact the target Web server.  \n2. The slave hosts begin sending TCP/IP SYN (synchronize/initialization) packets, with \nerroneous return IP address information, to the target. \n3. Each SYN packet is a request to open a TCP connection. For each such packet, the \nWeb server responds with a SYN/ACK (synchronize/acknowledge) packet, trying to \nestablish a TCP connection with a TCP entity at a spurious IP address. The Web server \nmaintains a data structure for each SYN request waiting for a response back and becomes \nbogged down as more traffic floods in. The result is that legitimate connections are denied \nwhile the victim machine is waiting to complete bogus \"half-open\" connections.", "chunk_id": "9f97b5cd-9ab2-48ce-ba98-e8d0051ae692", "chroma:document": "is attacked. \nA simple example of an internal resource attack is the SYN flood attack. Figure 19.5a \nshows the steps involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to \ncontact the target Web server.  \n2. The slave hosts begin sending TCP/IP SYN (synchronize/initialization) packets, with"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: edefde11-2f61-4e6a-973a-78f1252c4e9d
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 111, "full_page_content": "112 \n \nIf the behavior blocker detects that a program is initiating would-be malicious \nbehaviors as it runs, it can block these behaviors in real-time and/or terminate the \noffending software. This gives it a fundamental advantage over such established antivirus \ndetection techniques as fingerprinting or heuristics.  \nThe ability to watch software as it runs in real time clearly confers a huge benefit to \nthe behavior blocker; however, it also has drawbacks. Since the malicious code must \nactually run on the target machine before all its behaviors can be identified, it can cause \na great deal of harm to the system before it has been detected and blocked by the behavior \nblocking system. For instance, a new virus might shuffle a number of seemingly \nunimportant files around the hard drive before infecting a single file and being blocked.  \n3.6 Distributed Denial of Service Attacks \n \nDistributed denial of service (DDoS) attacks present a significant security threat to \ncorporations, and the threat appears to be growing . In one study, covering a three-week \nperiod in 2001, investigators observed more than 12,000 attacks against more than 5000 \ndistinct targets, ranging from well-known ecommerce companies such as Amazon and \nHotmail to small foreign ISPs and dial-up connections. DDoS attacks make computer \nsystems inaccessible by flooding servers, networks, or even end user systems with useless \ntraffic so that legitimate users can no longer gain access to those resources.  \n \n A denial of service (DoS) attack is an attempt to prevent legitimate users of a service \nfrom using that service. When this attack comes from a single host or network node, then \nit is simply referred to as a DoS attack. A more serious threat is posed by a DDoS attack. \nIn a DDoS attack, an attacker is able to recruit a number of hosts throughout the Internet \nto simultaneously or in a coordinated fashion launch an attack upon the target. This \nsection is concerned with DDoS attacks.  \n3.6.1 DDoS Attack Description \n \nA DDoS attack attempts to consume the target's resources so that it cannot provide \nservice. One way to classify DDoS attacks is in terms of the type of resource that is \nconsumed. Broadly speaking, the resource consumed is either an internal host resource \non the target system or data transmission capacity in the local network to which the target \nis attacked. \nA simple example of an internal resource attack is the SYN flood attack. Figure 19.5a \nshows the steps involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to \ncontact the target Web server.  \n2. The slave hosts begin sending TCP/IP SYN (synchronize/initialization) packets, with \nerroneous return IP address information, to the target. \n3. Each SYN packet is a request to open a TCP connection. For each such packet, the \nWeb server responds with a SYN/ACK (synchronize/acknowledge) packet, trying to \nestablish a TCP connection with a TCP entity at a spurious IP address. The Web server \nmaintains a data structure for each SYN request waiting for a response back and becomes \nbogged down as more traffic floods in. The result is that legitimate connections are denied \nwhile the victim machine is waiting to complete bogus \"half-open\" connections.", "chunk_id": "ce5a8e02-55e1-45f6-a25a-645ebf4fcb1e", "chroma:document": "erroneous return IP address information, to the target. \n3. Each SYN packet is a request to open a TCP connection. For each such packet, the \nWeb server responds with a SYN/ACK (synchronize/acknowledge) packet, trying to \nestablish a TCP connection with a TCP entity at a spurious IP address. The Web server"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 3d5ac4c9-7b73-4ac3-948e-2a02bff43db2
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 111, "full_page_content": "112 \n \nIf the behavior blocker detects that a program is initiating would-be malicious \nbehaviors as it runs, it can block these behaviors in real-time and/or terminate the \noffending software. This gives it a fundamental advantage over such established antivirus \ndetection techniques as fingerprinting or heuristics.  \nThe ability to watch software as it runs in real time clearly confers a huge benefit to \nthe behavior blocker; however, it also has drawbacks. Since the malicious code must \nactually run on the target machine before all its behaviors can be identified, it can cause \na great deal of harm to the system before it has been detected and blocked by the behavior \nblocking system. For instance, a new virus might shuffle a number of seemingly \nunimportant files around the hard drive before infecting a single file and being blocked.  \n3.6 Distributed Denial of Service Attacks \n \nDistributed denial of service (DDoS) attacks present a significant security threat to \ncorporations, and the threat appears to be growing . In one study, covering a three-week \nperiod in 2001, investigators observed more than 12,000 attacks against more than 5000 \ndistinct targets, ranging from well-known ecommerce companies such as Amazon and \nHotmail to small foreign ISPs and dial-up connections. DDoS attacks make computer \nsystems inaccessible by flooding servers, networks, or even end user systems with useless \ntraffic so that legitimate users can no longer gain access to those resources.  \n \n A denial of service (DoS) attack is an attempt to prevent legitimate users of a service \nfrom using that service. When this attack comes from a single host or network node, then \nit is simply referred to as a DoS attack. A more serious threat is posed by a DDoS attack. \nIn a DDoS attack, an attacker is able to recruit a number of hosts throughout the Internet \nto simultaneously or in a coordinated fashion launch an attack upon the target. This \nsection is concerned with DDoS attacks.  \n3.6.1 DDoS Attack Description \n \nA DDoS attack attempts to consume the target's resources so that it cannot provide \nservice. One way to classify DDoS attacks is in terms of the type of resource that is \nconsumed. Broadly speaking, the resource consumed is either an internal host resource \non the target system or data transmission capacity in the local network to which the target \nis attacked. \nA simple example of an internal resource attack is the SYN flood attack. Figure 19.5a \nshows the steps involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to \ncontact the target Web server.  \n2. The slave hosts begin sending TCP/IP SYN (synchronize/initialization) packets, with \nerroneous return IP address information, to the target. \n3. Each SYN packet is a request to open a TCP connection. For each such packet, the \nWeb server responds with a SYN/ACK (synchronize/acknowledge) packet, trying to \nestablish a TCP connection with a TCP entity at a spurious IP address. The Web server \nmaintains a data structure for each SYN request waiting for a response back and becomes \nbogged down as more traffic floods in. The result is that legitimate connections are denied \nwhile the victim machine is waiting to complete bogus \"half-open\" connections.", "chunk_id": "096187d7-390c-4792-8f60-09220089a639", "chroma:document": "maintains a data structure for each SYN request waiting for a response back and becomes \nbogged down as more traffic floods in. The result is that legitimate connections are denied \nwhile the victim machine is waiting to complete bogus \"half-open\" connections."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: b7b49022-896e-4206-801a-809afc1c685c
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 112, "full_page_content": "113 \n \n \n \nFigure 3.9. Examples of Simple DDoS Attacks \nThe TCP state data structure is a popular internal resource target but by no means the \nonly one. Examples are the following: \n1. In many systems, a limited number of data structures are available to hold process \ninformation (process identifiers, process table entries, process slots, etc.). An intruder \nmay be able to consume these data structures by writing a simple program or script that \ndoes nothing but repeatedly create copies of itself. \n2. An intruder may also attempt to consume disk space in other ways, including \n\u2022 \ngenerating excessive numbers of mail messages \n\u2022 \nplacing files in anonymous ftp areas or network-shared areas \n\u2022 \nintentionally generating errors that must be logged \nFig 3.9  illustrates an example of an attack that consumes data transmission resources. \nThe  \nfollowing steps are involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to send \nICMP  \nECHO packets with the target's spoofed IP address to a group of hosts that act as \nreflectors, as described subsequently.  \n2. Nodes at the bounce site receive multiple spoofed requests and respond by sending \necho reply packets to the target site.", "chunk_id": "7c2ec7c6-6d82-4274-b6a1-3af9dc949b38", "chroma:document": "113 \n \n \n \nFigure 3.9. Examples of Simple DDoS Attacks \nThe TCP state data structure is a popular internal resource target but by no means the \nonly one. Examples are the following: \n1. In many systems, a limited number of data structures are available to hold process \ninformation (process identifiers, process table entries, process slots, etc.). An intruder"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: f047bb9a-c52e-4b4b-a284-d01b7c1ffcc3
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 112, "full_page_content": "113 \n \n \n \nFigure 3.9. Examples of Simple DDoS Attacks \nThe TCP state data structure is a popular internal resource target but by no means the \nonly one. Examples are the following: \n1. In many systems, a limited number of data structures are available to hold process \ninformation (process identifiers, process table entries, process slots, etc.). An intruder \nmay be able to consume these data structures by writing a simple program or script that \ndoes nothing but repeatedly create copies of itself. \n2. An intruder may also attempt to consume disk space in other ways, including \n\u2022 \ngenerating excessive numbers of mail messages \n\u2022 \nplacing files in anonymous ftp areas or network-shared areas \n\u2022 \nintentionally generating errors that must be logged \nFig 3.9  illustrates an example of an attack that consumes data transmission resources. \nThe  \nfollowing steps are involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to send \nICMP  \nECHO packets with the target's spoofed IP address to a group of hosts that act as \nreflectors, as described subsequently.  \n2. Nodes at the bounce site receive multiple spoofed requests and respond by sending \necho reply packets to the target site.", "chunk_id": "925cdefb-b608-4115-b592-8aaf97588c13", "chroma:document": "may be able to consume these data structures by writing a simple program or script that \ndoes nothing but repeatedly create copies of itself. \n2. An intruder may also attempt to consume disk space in other ways, including \n\u2022 \ngenerating excessive numbers of mail messages \n\u2022 \nplacing files in anonymous ftp areas or network-shared areas \n\u2022"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: efc916c8-6060-4488-b35c-4548508e158e
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 112, "full_page_content": "113 \n \n \n \nFigure 3.9. Examples of Simple DDoS Attacks \nThe TCP state data structure is a popular internal resource target but by no means the \nonly one. Examples are the following: \n1. In many systems, a limited number of data structures are available to hold process \ninformation (process identifiers, process table entries, process slots, etc.). An intruder \nmay be able to consume these data structures by writing a simple program or script that \ndoes nothing but repeatedly create copies of itself. \n2. An intruder may also attempt to consume disk space in other ways, including \n\u2022 \ngenerating excessive numbers of mail messages \n\u2022 \nplacing files in anonymous ftp areas or network-shared areas \n\u2022 \nintentionally generating errors that must be logged \nFig 3.9  illustrates an example of an attack that consumes data transmission resources. \nThe  \nfollowing steps are involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to send \nICMP  \nECHO packets with the target's spoofed IP address to a group of hosts that act as \nreflectors, as described subsequently.  \n2. Nodes at the bounce site receive multiple spoofed requests and respond by sending \necho reply packets to the target site.", "chunk_id": "14fe99cf-6381-4def-9163-ce857c54e106", "chroma:document": "\u2022 \nintentionally generating errors that must be logged \nFig 3.9  illustrates an example of an attack that consumes data transmission resources. \nThe  \nfollowing steps are involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to send \nICMP  \nECHO packets with the target's spoofed IP address to a group of hosts that act as"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: eea04f3a-e545-4e8b-a242-ab0d8ebeb43c
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 112, "full_page_content": "113 \n \n \n \nFigure 3.9. Examples of Simple DDoS Attacks \nThe TCP state data structure is a popular internal resource target but by no means the \nonly one. Examples are the following: \n1. In many systems, a limited number of data structures are available to hold process \ninformation (process identifiers, process table entries, process slots, etc.). An intruder \nmay be able to consume these data structures by writing a simple program or script that \ndoes nothing but repeatedly create copies of itself. \n2. An intruder may also attempt to consume disk space in other ways, including \n\u2022 \ngenerating excessive numbers of mail messages \n\u2022 \nplacing files in anonymous ftp areas or network-shared areas \n\u2022 \nintentionally generating errors that must be logged \nFig 3.9  illustrates an example of an attack that consumes data transmission resources. \nThe  \nfollowing steps are involved: \n1. The attacker takes control of multiple hosts over the Internet, instructing them to send \nICMP  \nECHO packets with the target's spoofed IP address to a group of hosts that act as \nreflectors, as described subsequently.  \n2. Nodes at the bounce site receive multiple spoofed requests and respond by sending \necho reply packets to the target site.", "chunk_id": "f2ec09f0-c574-4c3f-9d52-d4e11af4ac01", "chroma:document": "reflectors, as described subsequently.  \n2. Nodes at the bounce site receive multiple spoofed requests and respond by sending \necho reply packets to the target site."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 6ed6c406-9b57-4dcd-8dbd-7bab0269a2c9
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 113, "full_page_content": "114 \n \n3. The target's router is flooded with packets from the bounce site, leaving no data \ntransmission  capacity for legitimate traffic. \nAnother way to classify DDoS attacks is as either direct or reflector DDoS attacks. In a \ndirect DDoS attack (Figure 3.10 a), the attacker is able to implant zombie software on a \nnumber of sites distributed throughout the Internet. Often, the DDoS attack involves two \nlevels of zombie machines: master zombies and slave zombies. The hosts of both \nmachines have been infected with malicious code. The attacker coordinates and triggers \nthe master zombies, which in turn coordinate and trigger the slave zombies. The use of \ntwo levels of zombies makes it more difficult to trace the attack back to its source and \nprovides for a more resilient network of attackers", "chunk_id": "f73b2db2-b5e8-4d0d-bb8b-8debb1a2777c", "chroma:document": "114 \n \n3. The target's router is flooded with packets from the bounce site, leaving no data \ntransmission  capacity for legitimate traffic. \nAnother way to classify DDoS attacks is as either direct or reflector DDoS attacks. In a \ndirect DDoS attack (Figure 3.10 a), the attacker is able to implant zombie software on a"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 0ee7fb66-8408-497c-acee-422df4b6b4d2
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 113, "full_page_content": "114 \n \n3. The target's router is flooded with packets from the bounce site, leaving no data \ntransmission  capacity for legitimate traffic. \nAnother way to classify DDoS attacks is as either direct or reflector DDoS attacks. In a \ndirect DDoS attack (Figure 3.10 a), the attacker is able to implant zombie software on a \nnumber of sites distributed throughout the Internet. Often, the DDoS attack involves two \nlevels of zombie machines: master zombies and slave zombies. The hosts of both \nmachines have been infected with malicious code. The attacker coordinates and triggers \nthe master zombies, which in turn coordinate and trigger the slave zombies. The use of \ntwo levels of zombies makes it more difficult to trace the attack back to its source and \nprovides for a more resilient network of attackers", "chunk_id": "97e220be-f012-4ddb-934f-e02089b9ac34", "chroma:document": "number of sites distributed throughout the Internet. Often, the DDoS attack involves two \nlevels of zombie machines: master zombies and slave zombies. The hosts of both \nmachines have been infected with malicious code. The attacker coordinates and triggers \nthe master zombies, which in turn coordinate and trigger the slave zombies. The use of"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: be5d8659-54fa-4d05-bc46-0f855f386962
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 113, "full_page_content": "114 \n \n3. The target's router is flooded with packets from the bounce site, leaving no data \ntransmission  capacity for legitimate traffic. \nAnother way to classify DDoS attacks is as either direct or reflector DDoS attacks. In a \ndirect DDoS attack (Figure 3.10 a), the attacker is able to implant zombie software on a \nnumber of sites distributed throughout the Internet. Often, the DDoS attack involves two \nlevels of zombie machines: master zombies and slave zombies. The hosts of both \nmachines have been infected with malicious code. The attacker coordinates and triggers \nthe master zombies, which in turn coordinate and trigger the slave zombies. The use of \ntwo levels of zombies makes it more difficult to trace the attack back to its source and \nprovides for a more resilient network of attackers", "chunk_id": "fc9b11ef-44d7-478c-813e-68d48d47cc5f", "chroma:document": "two levels of zombies makes it more difficult to trace the attack back to its source and \nprovides for a more resilient network of attackers"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 0be88e42-7d20-4f3f-bcac-6cbab4dad360
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 114, "full_page_content": "115 \n \n \nFigure 3.10 Types of Flooding-Based DDoS Attacks \n \nA reflector DDoS attack adds another layer of machines (Figure 310 b). In this type of \nattack, the slave zombies construct packets requiring a response that contain the target's \nIP address as the source IP address in the packet's IP header. These packets are sent to \nuninfected machines known as reflectors. The uninfected machines respond with packets \ndirected at the target machine. A reflector DDoS attack can easily involve more machines \nand more traffic than a direct DDoS attack and hence be more damaging.  \n3.6.2 Constructing the Attack Network", "chunk_id": "a44d99b6-0482-4ddd-b63c-b5145aacf5d6", "chroma:document": "115 \n \n \nFigure 3.10 Types of Flooding-Based DDoS Attacks \n \nA reflector DDoS attack adds another layer of machines (Figure 310 b). In this type of \nattack, the slave zombies construct packets requiring a response that contain the target's \nIP address as the source IP address in the packet's IP header. These packets are sent to"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 59c576cf-1e2a-4454-b9eb-13994e4a73fc
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 114, "full_page_content": "115 \n \n \nFigure 3.10 Types of Flooding-Based DDoS Attacks \n \nA reflector DDoS attack adds another layer of machines (Figure 310 b). In this type of \nattack, the slave zombies construct packets requiring a response that contain the target's \nIP address as the source IP address in the packet's IP header. These packets are sent to \nuninfected machines known as reflectors. The uninfected machines respond with packets \ndirected at the target machine. A reflector DDoS attack can easily involve more machines \nand more traffic than a direct DDoS attack and hence be more damaging.  \n3.6.2 Constructing the Attack Network", "chunk_id": "a4ef8340-113c-4e75-905f-2332951b9c63", "chroma:document": "uninfected machines known as reflectors. The uninfected machines respond with packets \ndirected at the target machine. A reflector DDoS attack can easily involve more machines \nand more traffic than a direct DDoS attack and hence be more damaging.  \n3.6.2 Constructing the Attack Network"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ec991546-8cae-4886-b6cb-2e5a7de84ba8
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 115, "full_page_content": "116 \n \n The first step in a DDoS attack is for the attacker to infect a number of machines with \nzombie software that will ultimately be used to carry out the attack. The essential \ningredients in this phase of the attack are the following: \n1. Software that can carry out the DDoS attack. The software must be able to run on a \nlarge  \nnumber of machines, must be able to conceal its existence, must be able to communicate \nwith the attacker or have some sort of time-triggered mechanism, and must be able to \nlaunch the intended attack toward the target. \n2. A vulnerability in a large number of systems. The attacker must become aware of a \nvulnerability that many system administrators and individual users have failed to patch \nand that enables the attacker to install the zombie software. \n3. A strategy for locating vulnerable machines, a process known as scanning \n \nIn the scanning process, the attacker first seeks out a number of vulnerable machines \nand infects them. Then, typically, the zombie software that is installed in the infected \nmachines repeats the same scanning process, until a large distributed network of infected \nmachines is created. The followings are types of scanning strategies: \n\u25cf Random: Each compromised host probes random addresses in the IP address space, \nusing a different seed. This technique produces a high volume of Internet traffic, which \nmay cause generalized disruption even before the actual attack is launched. \n\u25cf Hit-list: The attacker first compiles a long list of potential vulnerable machines. This \ncan be a slow process done over a long period to avoid detection that an attack is \nunderway. Once the list is compiled, the attacker begins infecting machines on the list. \nEach infected machine is provided with a portion of list to scan. This strategy results in a \nvery short scanning period, which may make it difficult to detect that infection is taking \nplace. \n\u25cf Topological: This method uses information contained on an infected victim machine \nto find more hosts to scan. \n\u25cf Local subnet: If a host can be infected behind a firewall, that host then looks for targets \nin its own local network. The host uses the subnet address structure to find other hosts \nthat would otherwise be protected by the firewall. \n3.6.3 DDoS Countermeasures \nIn general, there are three lines of defense against DDoS attacks \n\u2022 Attack prevention and preemption (before the attack): These mechanisms enable the  \nvictim to endure attack attempts without denying service to legitimate clients. Techniques  \ninclude enforcing policies for resource consumption and providing backup resources \navailable on demand. In addition, prevention mechanisms modify systems and protocols \non the Internet to reduce the possibility of DDoS attacks. \n\u25cf Attack detection and filtering (during the attack): These mechanisms attempt to \ndetect the attack as it begins and respond immediately. This minimizes the impact of the \nattack on the target. Detection involves looking for suspicious patterns of behavior. \nResponse involves filtering out packets likely to be part of the attack. \n\u2022 Attack source traceback and identification (during and after the attack): This is an", "chunk_id": "6ef348d6-5898-4b1a-a649-fe648b383ebf", "chroma:document": "116 \n \n The first step in a DDoS attack is for the attacker to infect a number of machines with \nzombie software that will ultimately be used to carry out the attack. The essential \ningredients in this phase of the attack are the following: \n1. Software that can carry out the DDoS attack. The software must be able to run on a \nlarge"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: aaea61fb-dbef-4a74-b9ac-28dffa71c8b3
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 115, "full_page_content": "116 \n \n The first step in a DDoS attack is for the attacker to infect a number of machines with \nzombie software that will ultimately be used to carry out the attack. The essential \ningredients in this phase of the attack are the following: \n1. Software that can carry out the DDoS attack. The software must be able to run on a \nlarge  \nnumber of machines, must be able to conceal its existence, must be able to communicate \nwith the attacker or have some sort of time-triggered mechanism, and must be able to \nlaunch the intended attack toward the target. \n2. A vulnerability in a large number of systems. The attacker must become aware of a \nvulnerability that many system administrators and individual users have failed to patch \nand that enables the attacker to install the zombie software. \n3. A strategy for locating vulnerable machines, a process known as scanning \n \nIn the scanning process, the attacker first seeks out a number of vulnerable machines \nand infects them. Then, typically, the zombie software that is installed in the infected \nmachines repeats the same scanning process, until a large distributed network of infected \nmachines is created. The followings are types of scanning strategies: \n\u25cf Random: Each compromised host probes random addresses in the IP address space, \nusing a different seed. This technique produces a high volume of Internet traffic, which \nmay cause generalized disruption even before the actual attack is launched. \n\u25cf Hit-list: The attacker first compiles a long list of potential vulnerable machines. This \ncan be a slow process done over a long period to avoid detection that an attack is \nunderway. Once the list is compiled, the attacker begins infecting machines on the list. \nEach infected machine is provided with a portion of list to scan. This strategy results in a \nvery short scanning period, which may make it difficult to detect that infection is taking \nplace. \n\u25cf Topological: This method uses information contained on an infected victim machine \nto find more hosts to scan. \n\u25cf Local subnet: If a host can be infected behind a firewall, that host then looks for targets \nin its own local network. The host uses the subnet address structure to find other hosts \nthat would otherwise be protected by the firewall. \n3.6.3 DDoS Countermeasures \nIn general, there are three lines of defense against DDoS attacks \n\u2022 Attack prevention and preemption (before the attack): These mechanisms enable the  \nvictim to endure attack attempts without denying service to legitimate clients. Techniques  \ninclude enforcing policies for resource consumption and providing backup resources \navailable on demand. In addition, prevention mechanisms modify systems and protocols \non the Internet to reduce the possibility of DDoS attacks. \n\u25cf Attack detection and filtering (during the attack): These mechanisms attempt to \ndetect the attack as it begins and respond immediately. This minimizes the impact of the \nattack on the target. Detection involves looking for suspicious patterns of behavior. \nResponse involves filtering out packets likely to be part of the attack. \n\u2022 Attack source traceback and identification (during and after the attack): This is an", "chunk_id": "403a4f77-35de-4b8d-ad5d-6b0b1ac5c7cb", "chroma:document": "large  \nnumber of machines, must be able to conceal its existence, must be able to communicate \nwith the attacker or have some sort of time-triggered mechanism, and must be able to \nlaunch the intended attack toward the target. \n2. A vulnerability in a large number of systems. The attacker must become aware of a"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 60954c3c-9f09-4273-9812-fb84cc610554
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 115, "full_page_content": "116 \n \n The first step in a DDoS attack is for the attacker to infect a number of machines with \nzombie software that will ultimately be used to carry out the attack. The essential \ningredients in this phase of the attack are the following: \n1. Software that can carry out the DDoS attack. The software must be able to run on a \nlarge  \nnumber of machines, must be able to conceal its existence, must be able to communicate \nwith the attacker or have some sort of time-triggered mechanism, and must be able to \nlaunch the intended attack toward the target. \n2. A vulnerability in a large number of systems. The attacker must become aware of a \nvulnerability that many system administrators and individual users have failed to patch \nand that enables the attacker to install the zombie software. \n3. A strategy for locating vulnerable machines, a process known as scanning \n \nIn the scanning process, the attacker first seeks out a number of vulnerable machines \nand infects them. Then, typically, the zombie software that is installed in the infected \nmachines repeats the same scanning process, until a large distributed network of infected \nmachines is created. The followings are types of scanning strategies: \n\u25cf Random: Each compromised host probes random addresses in the IP address space, \nusing a different seed. This technique produces a high volume of Internet traffic, which \nmay cause generalized disruption even before the actual attack is launched. \n\u25cf Hit-list: The attacker first compiles a long list of potential vulnerable machines. This \ncan be a slow process done over a long period to avoid detection that an attack is \nunderway. Once the list is compiled, the attacker begins infecting machines on the list. \nEach infected machine is provided with a portion of list to scan. This strategy results in a \nvery short scanning period, which may make it difficult to detect that infection is taking \nplace. \n\u25cf Topological: This method uses information contained on an infected victim machine \nto find more hosts to scan. \n\u25cf Local subnet: If a host can be infected behind a firewall, that host then looks for targets \nin its own local network. The host uses the subnet address structure to find other hosts \nthat would otherwise be protected by the firewall. \n3.6.3 DDoS Countermeasures \nIn general, there are three lines of defense against DDoS attacks \n\u2022 Attack prevention and preemption (before the attack): These mechanisms enable the  \nvictim to endure attack attempts without denying service to legitimate clients. Techniques  \ninclude enforcing policies for resource consumption and providing backup resources \navailable on demand. In addition, prevention mechanisms modify systems and protocols \non the Internet to reduce the possibility of DDoS attacks. \n\u25cf Attack detection and filtering (during the attack): These mechanisms attempt to \ndetect the attack as it begins and respond immediately. This minimizes the impact of the \nattack on the target. Detection involves looking for suspicious patterns of behavior. \nResponse involves filtering out packets likely to be part of the attack. \n\u2022 Attack source traceback and identification (during and after the attack): This is an", "chunk_id": "30ee7210-c4e7-414a-9b2f-c9de14fcbdd2", "chroma:document": "vulnerability that many system administrators and individual users have failed to patch \nand that enables the attacker to install the zombie software. \n3. A strategy for locating vulnerable machines, a process known as scanning \n \nIn the scanning process, the attacker first seeks out a number of vulnerable machines"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ebb79376-7b3e-4972-87d1-f0dcc6885cb9
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 115, "full_page_content": "116 \n \n The first step in a DDoS attack is for the attacker to infect a number of machines with \nzombie software that will ultimately be used to carry out the attack. The essential \ningredients in this phase of the attack are the following: \n1. Software that can carry out the DDoS attack. The software must be able to run on a \nlarge  \nnumber of machines, must be able to conceal its existence, must be able to communicate \nwith the attacker or have some sort of time-triggered mechanism, and must be able to \nlaunch the intended attack toward the target. \n2. A vulnerability in a large number of systems. The attacker must become aware of a \nvulnerability that many system administrators and individual users have failed to patch \nand that enables the attacker to install the zombie software. \n3. A strategy for locating vulnerable machines, a process known as scanning \n \nIn the scanning process, the attacker first seeks out a number of vulnerable machines \nand infects them. Then, typically, the zombie software that is installed in the infected \nmachines repeats the same scanning process, until a large distributed network of infected \nmachines is created. The followings are types of scanning strategies: \n\u25cf Random: Each compromised host probes random addresses in the IP address space, \nusing a different seed. This technique produces a high volume of Internet traffic, which \nmay cause generalized disruption even before the actual attack is launched. \n\u25cf Hit-list: The attacker first compiles a long list of potential vulnerable machines. This \ncan be a slow process done over a long period to avoid detection that an attack is \nunderway. Once the list is compiled, the attacker begins infecting machines on the list. \nEach infected machine is provided with a portion of list to scan. This strategy results in a \nvery short scanning period, which may make it difficult to detect that infection is taking \nplace. \n\u25cf Topological: This method uses information contained on an infected victim machine \nto find more hosts to scan. \n\u25cf Local subnet: If a host can be infected behind a firewall, that host then looks for targets \nin its own local network. The host uses the subnet address structure to find other hosts \nthat would otherwise be protected by the firewall. \n3.6.3 DDoS Countermeasures \nIn general, there are three lines of defense against DDoS attacks \n\u2022 Attack prevention and preemption (before the attack): These mechanisms enable the  \nvictim to endure attack attempts without denying service to legitimate clients. Techniques  \ninclude enforcing policies for resource consumption and providing backup resources \navailable on demand. In addition, prevention mechanisms modify systems and protocols \non the Internet to reduce the possibility of DDoS attacks. \n\u25cf Attack detection and filtering (during the attack): These mechanisms attempt to \ndetect the attack as it begins and respond immediately. This minimizes the impact of the \nattack on the target. Detection involves looking for suspicious patterns of behavior. \nResponse involves filtering out packets likely to be part of the attack. \n\u2022 Attack source traceback and identification (during and after the attack): This is an", "chunk_id": "cf3c94e2-bb5b-4298-a2b6-5abba6de36bd", "chroma:document": "and infects them. Then, typically, the zombie software that is installed in the infected \nmachines repeats the same scanning process, until a large distributed network of infected \nmachines is created. The followings are types of scanning strategies: \n\u25cf Random: Each compromised host probes random addresses in the IP address space,"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 1430ebda-c798-4e63-9174-9814e1b5489d
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 115, "full_page_content": "116 \n \n The first step in a DDoS attack is for the attacker to infect a number of machines with \nzombie software that will ultimately be used to carry out the attack. The essential \ningredients in this phase of the attack are the following: \n1. Software that can carry out the DDoS attack. The software must be able to run on a \nlarge  \nnumber of machines, must be able to conceal its existence, must be able to communicate \nwith the attacker or have some sort of time-triggered mechanism, and must be able to \nlaunch the intended attack toward the target. \n2. A vulnerability in a large number of systems. The attacker must become aware of a \nvulnerability that many system administrators and individual users have failed to patch \nand that enables the attacker to install the zombie software. \n3. A strategy for locating vulnerable machines, a process known as scanning \n \nIn the scanning process, the attacker first seeks out a number of vulnerable machines \nand infects them. Then, typically, the zombie software that is installed in the infected \nmachines repeats the same scanning process, until a large distributed network of infected \nmachines is created. The followings are types of scanning strategies: \n\u25cf Random: Each compromised host probes random addresses in the IP address space, \nusing a different seed. This technique produces a high volume of Internet traffic, which \nmay cause generalized disruption even before the actual attack is launched. \n\u25cf Hit-list: The attacker first compiles a long list of potential vulnerable machines. This \ncan be a slow process done over a long period to avoid detection that an attack is \nunderway. Once the list is compiled, the attacker begins infecting machines on the list. \nEach infected machine is provided with a portion of list to scan. This strategy results in a \nvery short scanning period, which may make it difficult to detect that infection is taking \nplace. \n\u25cf Topological: This method uses information contained on an infected victim machine \nto find more hosts to scan. \n\u25cf Local subnet: If a host can be infected behind a firewall, that host then looks for targets \nin its own local network. The host uses the subnet address structure to find other hosts \nthat would otherwise be protected by the firewall. \n3.6.3 DDoS Countermeasures \nIn general, there are three lines of defense against DDoS attacks \n\u2022 Attack prevention and preemption (before the attack): These mechanisms enable the  \nvictim to endure attack attempts without denying service to legitimate clients. Techniques  \ninclude enforcing policies for resource consumption and providing backup resources \navailable on demand. In addition, prevention mechanisms modify systems and protocols \non the Internet to reduce the possibility of DDoS attacks. \n\u25cf Attack detection and filtering (during the attack): These mechanisms attempt to \ndetect the attack as it begins and respond immediately. This minimizes the impact of the \nattack on the target. Detection involves looking for suspicious patterns of behavior. \nResponse involves filtering out packets likely to be part of the attack. \n\u2022 Attack source traceback and identification (during and after the attack): This is an", "chunk_id": "d74fbe1d-126a-41b0-adfb-26382033f9ef", "chroma:document": "using a different seed. This technique produces a high volume of Internet traffic, which \nmay cause generalized disruption even before the actual attack is launched. \n\u25cf Hit-list: The attacker first compiles a long list of potential vulnerable machines. This \ncan be a slow process done over a long period to avoid detection that an attack is"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 5a68ea17-f246-4fd4-ba11-9090902ae09c
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 115, "full_page_content": "116 \n \n The first step in a DDoS attack is for the attacker to infect a number of machines with \nzombie software that will ultimately be used to carry out the attack. The essential \ningredients in this phase of the attack are the following: \n1. Software that can carry out the DDoS attack. The software must be able to run on a \nlarge  \nnumber of machines, must be able to conceal its existence, must be able to communicate \nwith the attacker or have some sort of time-triggered mechanism, and must be able to \nlaunch the intended attack toward the target. \n2. A vulnerability in a large number of systems. The attacker must become aware of a \nvulnerability that many system administrators and individual users have failed to patch \nand that enables the attacker to install the zombie software. \n3. A strategy for locating vulnerable machines, a process known as scanning \n \nIn the scanning process, the attacker first seeks out a number of vulnerable machines \nand infects them. Then, typically, the zombie software that is installed in the infected \nmachines repeats the same scanning process, until a large distributed network of infected \nmachines is created. The followings are types of scanning strategies: \n\u25cf Random: Each compromised host probes random addresses in the IP address space, \nusing a different seed. This technique produces a high volume of Internet traffic, which \nmay cause generalized disruption even before the actual attack is launched. \n\u25cf Hit-list: The attacker first compiles a long list of potential vulnerable machines. This \ncan be a slow process done over a long period to avoid detection that an attack is \nunderway. Once the list is compiled, the attacker begins infecting machines on the list. \nEach infected machine is provided with a portion of list to scan. This strategy results in a \nvery short scanning period, which may make it difficult to detect that infection is taking \nplace. \n\u25cf Topological: This method uses information contained on an infected victim machine \nto find more hosts to scan. \n\u25cf Local subnet: If a host can be infected behind a firewall, that host then looks for targets \nin its own local network. The host uses the subnet address structure to find other hosts \nthat would otherwise be protected by the firewall. \n3.6.3 DDoS Countermeasures \nIn general, there are three lines of defense against DDoS attacks \n\u2022 Attack prevention and preemption (before the attack): These mechanisms enable the  \nvictim to endure attack attempts without denying service to legitimate clients. Techniques  \ninclude enforcing policies for resource consumption and providing backup resources \navailable on demand. In addition, prevention mechanisms modify systems and protocols \non the Internet to reduce the possibility of DDoS attacks. \n\u25cf Attack detection and filtering (during the attack): These mechanisms attempt to \ndetect the attack as it begins and respond immediately. This minimizes the impact of the \nattack on the target. Detection involves looking for suspicious patterns of behavior. \nResponse involves filtering out packets likely to be part of the attack. \n\u2022 Attack source traceback and identification (during and after the attack): This is an", "chunk_id": "c6b23750-8750-4853-96bb-8efe1d944cc5", "chroma:document": "underway. Once the list is compiled, the attacker begins infecting machines on the list. \nEach infected machine is provided with a portion of list to scan. This strategy results in a \nvery short scanning period, which may make it difficult to detect that infection is taking \nplace. \n\u25cf Topological: This method uses information contained on an infected victim machine"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 94e03c7e-a05b-41a7-8d37-509d2b79fc8b
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 115, "full_page_content": "116 \n \n The first step in a DDoS attack is for the attacker to infect a number of machines with \nzombie software that will ultimately be used to carry out the attack. The essential \ningredients in this phase of the attack are the following: \n1. Software that can carry out the DDoS attack. The software must be able to run on a \nlarge  \nnumber of machines, must be able to conceal its existence, must be able to communicate \nwith the attacker or have some sort of time-triggered mechanism, and must be able to \nlaunch the intended attack toward the target. \n2. A vulnerability in a large number of systems. The attacker must become aware of a \nvulnerability that many system administrators and individual users have failed to patch \nand that enables the attacker to install the zombie software. \n3. A strategy for locating vulnerable machines, a process known as scanning \n \nIn the scanning process, the attacker first seeks out a number of vulnerable machines \nand infects them. Then, typically, the zombie software that is installed in the infected \nmachines repeats the same scanning process, until a large distributed network of infected \nmachines is created. The followings are types of scanning strategies: \n\u25cf Random: Each compromised host probes random addresses in the IP address space, \nusing a different seed. This technique produces a high volume of Internet traffic, which \nmay cause generalized disruption even before the actual attack is launched. \n\u25cf Hit-list: The attacker first compiles a long list of potential vulnerable machines. This \ncan be a slow process done over a long period to avoid detection that an attack is \nunderway. Once the list is compiled, the attacker begins infecting machines on the list. \nEach infected machine is provided with a portion of list to scan. This strategy results in a \nvery short scanning period, which may make it difficult to detect that infection is taking \nplace. \n\u25cf Topological: This method uses information contained on an infected victim machine \nto find more hosts to scan. \n\u25cf Local subnet: If a host can be infected behind a firewall, that host then looks for targets \nin its own local network. The host uses the subnet address structure to find other hosts \nthat would otherwise be protected by the firewall. \n3.6.3 DDoS Countermeasures \nIn general, there are three lines of defense against DDoS attacks \n\u2022 Attack prevention and preemption (before the attack): These mechanisms enable the  \nvictim to endure attack attempts without denying service to legitimate clients. Techniques  \ninclude enforcing policies for resource consumption and providing backup resources \navailable on demand. In addition, prevention mechanisms modify systems and protocols \non the Internet to reduce the possibility of DDoS attacks. \n\u25cf Attack detection and filtering (during the attack): These mechanisms attempt to \ndetect the attack as it begins and respond immediately. This minimizes the impact of the \nattack on the target. Detection involves looking for suspicious patterns of behavior. \nResponse involves filtering out packets likely to be part of the attack. \n\u2022 Attack source traceback and identification (during and after the attack): This is an", "chunk_id": "10fff792-9dba-4ac2-9248-8565cc3eb710", "chroma:document": "to find more hosts to scan. \n\u25cf Local subnet: If a host can be infected behind a firewall, that host then looks for targets \nin its own local network. The host uses the subnet address structure to find other hosts \nthat would otherwise be protected by the firewall. \n3.6.3 DDoS Countermeasures \nIn general, there are three lines of defense against DDoS attacks"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: a925fbb6-70e9-4700-ab74-6ca51cbe4426
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 115, "full_page_content": "116 \n \n The first step in a DDoS attack is for the attacker to infect a number of machines with \nzombie software that will ultimately be used to carry out the attack. The essential \ningredients in this phase of the attack are the following: \n1. Software that can carry out the DDoS attack. The software must be able to run on a \nlarge  \nnumber of machines, must be able to conceal its existence, must be able to communicate \nwith the attacker or have some sort of time-triggered mechanism, and must be able to \nlaunch the intended attack toward the target. \n2. A vulnerability in a large number of systems. The attacker must become aware of a \nvulnerability that many system administrators and individual users have failed to patch \nand that enables the attacker to install the zombie software. \n3. A strategy for locating vulnerable machines, a process known as scanning \n \nIn the scanning process, the attacker first seeks out a number of vulnerable machines \nand infects them. Then, typically, the zombie software that is installed in the infected \nmachines repeats the same scanning process, until a large distributed network of infected \nmachines is created. The followings are types of scanning strategies: \n\u25cf Random: Each compromised host probes random addresses in the IP address space, \nusing a different seed. This technique produces a high volume of Internet traffic, which \nmay cause generalized disruption even before the actual attack is launched. \n\u25cf Hit-list: The attacker first compiles a long list of potential vulnerable machines. This \ncan be a slow process done over a long period to avoid detection that an attack is \nunderway. Once the list is compiled, the attacker begins infecting machines on the list. \nEach infected machine is provided with a portion of list to scan. This strategy results in a \nvery short scanning period, which may make it difficult to detect that infection is taking \nplace. \n\u25cf Topological: This method uses information contained on an infected victim machine \nto find more hosts to scan. \n\u25cf Local subnet: If a host can be infected behind a firewall, that host then looks for targets \nin its own local network. The host uses the subnet address structure to find other hosts \nthat would otherwise be protected by the firewall. \n3.6.3 DDoS Countermeasures \nIn general, there are three lines of defense against DDoS attacks \n\u2022 Attack prevention and preemption (before the attack): These mechanisms enable the  \nvictim to endure attack attempts without denying service to legitimate clients. Techniques  \ninclude enforcing policies for resource consumption and providing backup resources \navailable on demand. In addition, prevention mechanisms modify systems and protocols \non the Internet to reduce the possibility of DDoS attacks. \n\u25cf Attack detection and filtering (during the attack): These mechanisms attempt to \ndetect the attack as it begins and respond immediately. This minimizes the impact of the \nattack on the target. Detection involves looking for suspicious patterns of behavior. \nResponse involves filtering out packets likely to be part of the attack. \n\u2022 Attack source traceback and identification (during and after the attack): This is an", "chunk_id": "da3da482-0ec6-4a7c-83a7-acf116c12568", "chroma:document": "\u2022 Attack prevention and preemption (before the attack): These mechanisms enable the  \nvictim to endure attack attempts without denying service to legitimate clients. Techniques  \ninclude enforcing policies for resource consumption and providing backup resources \navailable on demand. In addition, prevention mechanisms modify systems and protocols"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 697282f9-71fa-46de-a7c7-69415b4d6ceb
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 115, "full_page_content": "116 \n \n The first step in a DDoS attack is for the attacker to infect a number of machines with \nzombie software that will ultimately be used to carry out the attack. The essential \ningredients in this phase of the attack are the following: \n1. Software that can carry out the DDoS attack. The software must be able to run on a \nlarge  \nnumber of machines, must be able to conceal its existence, must be able to communicate \nwith the attacker or have some sort of time-triggered mechanism, and must be able to \nlaunch the intended attack toward the target. \n2. A vulnerability in a large number of systems. The attacker must become aware of a \nvulnerability that many system administrators and individual users have failed to patch \nand that enables the attacker to install the zombie software. \n3. A strategy for locating vulnerable machines, a process known as scanning \n \nIn the scanning process, the attacker first seeks out a number of vulnerable machines \nand infects them. Then, typically, the zombie software that is installed in the infected \nmachines repeats the same scanning process, until a large distributed network of infected \nmachines is created. The followings are types of scanning strategies: \n\u25cf Random: Each compromised host probes random addresses in the IP address space, \nusing a different seed. This technique produces a high volume of Internet traffic, which \nmay cause generalized disruption even before the actual attack is launched. \n\u25cf Hit-list: The attacker first compiles a long list of potential vulnerable machines. This \ncan be a slow process done over a long period to avoid detection that an attack is \nunderway. Once the list is compiled, the attacker begins infecting machines on the list. \nEach infected machine is provided with a portion of list to scan. This strategy results in a \nvery short scanning period, which may make it difficult to detect that infection is taking \nplace. \n\u25cf Topological: This method uses information contained on an infected victim machine \nto find more hosts to scan. \n\u25cf Local subnet: If a host can be infected behind a firewall, that host then looks for targets \nin its own local network. The host uses the subnet address structure to find other hosts \nthat would otherwise be protected by the firewall. \n3.6.3 DDoS Countermeasures \nIn general, there are three lines of defense against DDoS attacks \n\u2022 Attack prevention and preemption (before the attack): These mechanisms enable the  \nvictim to endure attack attempts without denying service to legitimate clients. Techniques  \ninclude enforcing policies for resource consumption and providing backup resources \navailable on demand. In addition, prevention mechanisms modify systems and protocols \non the Internet to reduce the possibility of DDoS attacks. \n\u25cf Attack detection and filtering (during the attack): These mechanisms attempt to \ndetect the attack as it begins and respond immediately. This minimizes the impact of the \nattack on the target. Detection involves looking for suspicious patterns of behavior. \nResponse involves filtering out packets likely to be part of the attack. \n\u2022 Attack source traceback and identification (during and after the attack): This is an", "chunk_id": "9d0a731f-5da5-4ffa-b543-a13e117609aa", "chroma:document": "on the Internet to reduce the possibility of DDoS attacks. \n\u25cf Attack detection and filtering (during the attack): These mechanisms attempt to \ndetect the attack as it begins and respond immediately. This minimizes the impact of the \nattack on the target. Detection involves looking for suspicious patterns of behavior."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: dcdca8f0-5a0e-4bcc-ac75-6df217985e80
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 115, "full_page_content": "116 \n \n The first step in a DDoS attack is for the attacker to infect a number of machines with \nzombie software that will ultimately be used to carry out the attack. The essential \ningredients in this phase of the attack are the following: \n1. Software that can carry out the DDoS attack. The software must be able to run on a \nlarge  \nnumber of machines, must be able to conceal its existence, must be able to communicate \nwith the attacker or have some sort of time-triggered mechanism, and must be able to \nlaunch the intended attack toward the target. \n2. A vulnerability in a large number of systems. The attacker must become aware of a \nvulnerability that many system administrators and individual users have failed to patch \nand that enables the attacker to install the zombie software. \n3. A strategy for locating vulnerable machines, a process known as scanning \n \nIn the scanning process, the attacker first seeks out a number of vulnerable machines \nand infects them. Then, typically, the zombie software that is installed in the infected \nmachines repeats the same scanning process, until a large distributed network of infected \nmachines is created. The followings are types of scanning strategies: \n\u25cf Random: Each compromised host probes random addresses in the IP address space, \nusing a different seed. This technique produces a high volume of Internet traffic, which \nmay cause generalized disruption even before the actual attack is launched. \n\u25cf Hit-list: The attacker first compiles a long list of potential vulnerable machines. This \ncan be a slow process done over a long period to avoid detection that an attack is \nunderway. Once the list is compiled, the attacker begins infecting machines on the list. \nEach infected machine is provided with a portion of list to scan. This strategy results in a \nvery short scanning period, which may make it difficult to detect that infection is taking \nplace. \n\u25cf Topological: This method uses information contained on an infected victim machine \nto find more hosts to scan. \n\u25cf Local subnet: If a host can be infected behind a firewall, that host then looks for targets \nin its own local network. The host uses the subnet address structure to find other hosts \nthat would otherwise be protected by the firewall. \n3.6.3 DDoS Countermeasures \nIn general, there are three lines of defense against DDoS attacks \n\u2022 Attack prevention and preemption (before the attack): These mechanisms enable the  \nvictim to endure attack attempts without denying service to legitimate clients. Techniques  \ninclude enforcing policies for resource consumption and providing backup resources \navailable on demand. In addition, prevention mechanisms modify systems and protocols \non the Internet to reduce the possibility of DDoS attacks. \n\u25cf Attack detection and filtering (during the attack): These mechanisms attempt to \ndetect the attack as it begins and respond immediately. This minimizes the impact of the \nattack on the target. Detection involves looking for suspicious patterns of behavior. \nResponse involves filtering out packets likely to be part of the attack. \n\u2022 Attack source traceback and identification (during and after the attack): This is an", "chunk_id": "2682b454-ca01-4930-89d1-3c39d32c5504", "chroma:document": "Response involves filtering out packets likely to be part of the attack. \n\u2022 Attack source traceback and identification (during and after the attack): This is an"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ebe7abb7-9f00-4f23-890c-7574a7842e1a
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 116, "full_page_content": "117 \n \nattempt to identify the source of the attack as a first step in preventing future attacks. \nHowever, this method typically does not yield results fast enough, if at all, to mitigate an \nongoing attack. \n3.7 Firewall Design Principles \nInformation systems in corporations, government agencies, and other organizations have \nundergone a steady evolution: \n\u25cf Centralized data processing system, with a central mainframe supporting a number of \ndirectly connected terminals \n\u25cf Local area networks (LANs) interconnecting PCs and terminals to each other and the \nmainframe \n\u25cf Premises network, consisting of a number of LANs, interconnecting PCs, servers, and \nperhaps a mainframe or two \n\u25cf Enterprise-wide network, consisting of multiple, geographically distributed premises \nnetworks interconnected by a private wide area network (WAN) \n\u25cf Internet connectivity, in which the various premises networks all hook into the Internet \nand may or may not also be connected by a private WAN. \n3.7.1 Firewall Characteristics \nThe following are design goals for a firewall: \n1. All traffic from inside to outside, and vice versa, must pass through the firewall. This \nis achieved by physically blocking all access to the local network except via the firewall. \nVarious configurations are possible. \n2. Only authorized traffic, as defined by the local security policy, will be allowed to pass. \nVarious types of firewalls are used, which implement various types of security policies, \nas explained later. \n3. The firewall itself is immune to penetration. This implies that use of a trusted system \nwith a secure operating system.  Originally, firewalls focused primarily on service \ncontrol, but they have since evolved to provide all four: \n\u25cf Service control: Determines the types of Internet services that can be accessed, \ninbound or outbound. The firewall may filter traffic on the basis of IP address and TCP \nport number; may provide proxy software that receives and interprets each service request \nbefore passing it on; or may host the server software itself, such as a Web or mail service. \n\u25cf Direction control: Determines the direction in which particular service requests may \nbe initiated and allowed to flow through the firewall. \n\u25cf User control: Controls access to a service according to which user is attempting to \naccess it. This feature is typically applied to users inside the firewall perimeter (local \nusers). It may also be applied to incoming traffic from external users; the latter requires \nsome form of secure authentication technology, such as is provided in IPSec. \n\u25cf Behavior control: Controls how particular services are used. For example, the firewall \nmay filter e-mail to eliminate spam, or it may enable external access to only a portion of \nthe information on a local Web server. \nThe following capabilities are within the scope of a firewall: \n1. A firewall defines a single choke point that keeps unauthorized users out of the \nprotected", "chunk_id": "a64afe40-ab2e-4a15-850a-8065e98cd810", "chroma:document": "117 \n \nattempt to identify the source of the attack as a first step in preventing future attacks. \nHowever, this method typically does not yield results fast enough, if at all, to mitigate an \nongoing attack. \n3.7 Firewall Design Principles \nInformation systems in corporations, government agencies, and other organizations have \nundergone a steady evolution:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 343ee518-d673-484a-96eb-af9707f310ad
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 116, "full_page_content": "117 \n \nattempt to identify the source of the attack as a first step in preventing future attacks. \nHowever, this method typically does not yield results fast enough, if at all, to mitigate an \nongoing attack. \n3.7 Firewall Design Principles \nInformation systems in corporations, government agencies, and other organizations have \nundergone a steady evolution: \n\u25cf Centralized data processing system, with a central mainframe supporting a number of \ndirectly connected terminals \n\u25cf Local area networks (LANs) interconnecting PCs and terminals to each other and the \nmainframe \n\u25cf Premises network, consisting of a number of LANs, interconnecting PCs, servers, and \nperhaps a mainframe or two \n\u25cf Enterprise-wide network, consisting of multiple, geographically distributed premises \nnetworks interconnected by a private wide area network (WAN) \n\u25cf Internet connectivity, in which the various premises networks all hook into the Internet \nand may or may not also be connected by a private WAN. \n3.7.1 Firewall Characteristics \nThe following are design goals for a firewall: \n1. All traffic from inside to outside, and vice versa, must pass through the firewall. This \nis achieved by physically blocking all access to the local network except via the firewall. \nVarious configurations are possible. \n2. Only authorized traffic, as defined by the local security policy, will be allowed to pass. \nVarious types of firewalls are used, which implement various types of security policies, \nas explained later. \n3. The firewall itself is immune to penetration. This implies that use of a trusted system \nwith a secure operating system.  Originally, firewalls focused primarily on service \ncontrol, but they have since evolved to provide all four: \n\u25cf Service control: Determines the types of Internet services that can be accessed, \ninbound or outbound. The firewall may filter traffic on the basis of IP address and TCP \nport number; may provide proxy software that receives and interprets each service request \nbefore passing it on; or may host the server software itself, such as a Web or mail service. \n\u25cf Direction control: Determines the direction in which particular service requests may \nbe initiated and allowed to flow through the firewall. \n\u25cf User control: Controls access to a service according to which user is attempting to \naccess it. This feature is typically applied to users inside the firewall perimeter (local \nusers). It may also be applied to incoming traffic from external users; the latter requires \nsome form of secure authentication technology, such as is provided in IPSec. \n\u25cf Behavior control: Controls how particular services are used. For example, the firewall \nmay filter e-mail to eliminate spam, or it may enable external access to only a portion of \nthe information on a local Web server. \nThe following capabilities are within the scope of a firewall: \n1. A firewall defines a single choke point that keeps unauthorized users out of the \nprotected", "chunk_id": "d7b10c31-8b8b-44b4-876e-8f82bb01c1b5", "chroma:document": "\u25cf Centralized data processing system, with a central mainframe supporting a number of \ndirectly connected terminals \n\u25cf Local area networks (LANs) interconnecting PCs and terminals to each other and the \nmainframe \n\u25cf Premises network, consisting of a number of LANs, interconnecting PCs, servers, and \nperhaps a mainframe or two"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: e94902f3-112b-444a-b8c6-eccdd547014c
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 116, "full_page_content": "117 \n \nattempt to identify the source of the attack as a first step in preventing future attacks. \nHowever, this method typically does not yield results fast enough, if at all, to mitigate an \nongoing attack. \n3.7 Firewall Design Principles \nInformation systems in corporations, government agencies, and other organizations have \nundergone a steady evolution: \n\u25cf Centralized data processing system, with a central mainframe supporting a number of \ndirectly connected terminals \n\u25cf Local area networks (LANs) interconnecting PCs and terminals to each other and the \nmainframe \n\u25cf Premises network, consisting of a number of LANs, interconnecting PCs, servers, and \nperhaps a mainframe or two \n\u25cf Enterprise-wide network, consisting of multiple, geographically distributed premises \nnetworks interconnected by a private wide area network (WAN) \n\u25cf Internet connectivity, in which the various premises networks all hook into the Internet \nand may or may not also be connected by a private WAN. \n3.7.1 Firewall Characteristics \nThe following are design goals for a firewall: \n1. All traffic from inside to outside, and vice versa, must pass through the firewall. This \nis achieved by physically blocking all access to the local network except via the firewall. \nVarious configurations are possible. \n2. Only authorized traffic, as defined by the local security policy, will be allowed to pass. \nVarious types of firewalls are used, which implement various types of security policies, \nas explained later. \n3. The firewall itself is immune to penetration. This implies that use of a trusted system \nwith a secure operating system.  Originally, firewalls focused primarily on service \ncontrol, but they have since evolved to provide all four: \n\u25cf Service control: Determines the types of Internet services that can be accessed, \ninbound or outbound. The firewall may filter traffic on the basis of IP address and TCP \nport number; may provide proxy software that receives and interprets each service request \nbefore passing it on; or may host the server software itself, such as a Web or mail service. \n\u25cf Direction control: Determines the direction in which particular service requests may \nbe initiated and allowed to flow through the firewall. \n\u25cf User control: Controls access to a service according to which user is attempting to \naccess it. This feature is typically applied to users inside the firewall perimeter (local \nusers). It may also be applied to incoming traffic from external users; the latter requires \nsome form of secure authentication technology, such as is provided in IPSec. \n\u25cf Behavior control: Controls how particular services are used. For example, the firewall \nmay filter e-mail to eliminate spam, or it may enable external access to only a portion of \nthe information on a local Web server. \nThe following capabilities are within the scope of a firewall: \n1. A firewall defines a single choke point that keeps unauthorized users out of the \nprotected", "chunk_id": "477f7312-bda4-4c89-8d50-d6ab294302ef", "chroma:document": "\u25cf Enterprise-wide network, consisting of multiple, geographically distributed premises \nnetworks interconnected by a private wide area network (WAN) \n\u25cf Internet connectivity, in which the various premises networks all hook into the Internet \nand may or may not also be connected by a private WAN. \n3.7.1 Firewall Characteristics \nThe following are design goals for a firewall:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 77340c3b-b48b-4cf0-ab60-0486f05fbdbf
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 116, "full_page_content": "117 \n \nattempt to identify the source of the attack as a first step in preventing future attacks. \nHowever, this method typically does not yield results fast enough, if at all, to mitigate an \nongoing attack. \n3.7 Firewall Design Principles \nInformation systems in corporations, government agencies, and other organizations have \nundergone a steady evolution: \n\u25cf Centralized data processing system, with a central mainframe supporting a number of \ndirectly connected terminals \n\u25cf Local area networks (LANs) interconnecting PCs and terminals to each other and the \nmainframe \n\u25cf Premises network, consisting of a number of LANs, interconnecting PCs, servers, and \nperhaps a mainframe or two \n\u25cf Enterprise-wide network, consisting of multiple, geographically distributed premises \nnetworks interconnected by a private wide area network (WAN) \n\u25cf Internet connectivity, in which the various premises networks all hook into the Internet \nand may or may not also be connected by a private WAN. \n3.7.1 Firewall Characteristics \nThe following are design goals for a firewall: \n1. All traffic from inside to outside, and vice versa, must pass through the firewall. This \nis achieved by physically blocking all access to the local network except via the firewall. \nVarious configurations are possible. \n2. Only authorized traffic, as defined by the local security policy, will be allowed to pass. \nVarious types of firewalls are used, which implement various types of security policies, \nas explained later. \n3. The firewall itself is immune to penetration. This implies that use of a trusted system \nwith a secure operating system.  Originally, firewalls focused primarily on service \ncontrol, but they have since evolved to provide all four: \n\u25cf Service control: Determines the types of Internet services that can be accessed, \ninbound or outbound. The firewall may filter traffic on the basis of IP address and TCP \nport number; may provide proxy software that receives and interprets each service request \nbefore passing it on; or may host the server software itself, such as a Web or mail service. \n\u25cf Direction control: Determines the direction in which particular service requests may \nbe initiated and allowed to flow through the firewall. \n\u25cf User control: Controls access to a service according to which user is attempting to \naccess it. This feature is typically applied to users inside the firewall perimeter (local \nusers). It may also be applied to incoming traffic from external users; the latter requires \nsome form of secure authentication technology, such as is provided in IPSec. \n\u25cf Behavior control: Controls how particular services are used. For example, the firewall \nmay filter e-mail to eliminate spam, or it may enable external access to only a portion of \nthe information on a local Web server. \nThe following capabilities are within the scope of a firewall: \n1. A firewall defines a single choke point that keeps unauthorized users out of the \nprotected", "chunk_id": "56372fb3-cbd4-4a0f-bac4-6230bdf4a322", "chroma:document": "1. All traffic from inside to outside, and vice versa, must pass through the firewall. This \nis achieved by physically blocking all access to the local network except via the firewall. \nVarious configurations are possible. \n2. Only authorized traffic, as defined by the local security policy, will be allowed to pass."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 4a54af3c-4652-45cc-9778-a54af9fb12f8
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 116, "full_page_content": "117 \n \nattempt to identify the source of the attack as a first step in preventing future attacks. \nHowever, this method typically does not yield results fast enough, if at all, to mitigate an \nongoing attack. \n3.7 Firewall Design Principles \nInformation systems in corporations, government agencies, and other organizations have \nundergone a steady evolution: \n\u25cf Centralized data processing system, with a central mainframe supporting a number of \ndirectly connected terminals \n\u25cf Local area networks (LANs) interconnecting PCs and terminals to each other and the \nmainframe \n\u25cf Premises network, consisting of a number of LANs, interconnecting PCs, servers, and \nperhaps a mainframe or two \n\u25cf Enterprise-wide network, consisting of multiple, geographically distributed premises \nnetworks interconnected by a private wide area network (WAN) \n\u25cf Internet connectivity, in which the various premises networks all hook into the Internet \nand may or may not also be connected by a private WAN. \n3.7.1 Firewall Characteristics \nThe following are design goals for a firewall: \n1. All traffic from inside to outside, and vice versa, must pass through the firewall. This \nis achieved by physically blocking all access to the local network except via the firewall. \nVarious configurations are possible. \n2. Only authorized traffic, as defined by the local security policy, will be allowed to pass. \nVarious types of firewalls are used, which implement various types of security policies, \nas explained later. \n3. The firewall itself is immune to penetration. This implies that use of a trusted system \nwith a secure operating system.  Originally, firewalls focused primarily on service \ncontrol, but they have since evolved to provide all four: \n\u25cf Service control: Determines the types of Internet services that can be accessed, \ninbound or outbound. The firewall may filter traffic on the basis of IP address and TCP \nport number; may provide proxy software that receives and interprets each service request \nbefore passing it on; or may host the server software itself, such as a Web or mail service. \n\u25cf Direction control: Determines the direction in which particular service requests may \nbe initiated and allowed to flow through the firewall. \n\u25cf User control: Controls access to a service according to which user is attempting to \naccess it. This feature is typically applied to users inside the firewall perimeter (local \nusers). It may also be applied to incoming traffic from external users; the latter requires \nsome form of secure authentication technology, such as is provided in IPSec. \n\u25cf Behavior control: Controls how particular services are used. For example, the firewall \nmay filter e-mail to eliminate spam, or it may enable external access to only a portion of \nthe information on a local Web server. \nThe following capabilities are within the scope of a firewall: \n1. A firewall defines a single choke point that keeps unauthorized users out of the \nprotected", "chunk_id": "dcc14342-4bfd-4dde-80d7-335144ba526e", "chroma:document": "Various types of firewalls are used, which implement various types of security policies, \nas explained later. \n3. The firewall itself is immune to penetration. This implies that use of a trusted system \nwith a secure operating system.  Originally, firewalls focused primarily on service \ncontrol, but they have since evolved to provide all four:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 3e55ad3d-8fd8-4f23-88f3-ec35039ff4a0
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 116, "full_page_content": "117 \n \nattempt to identify the source of the attack as a first step in preventing future attacks. \nHowever, this method typically does not yield results fast enough, if at all, to mitigate an \nongoing attack. \n3.7 Firewall Design Principles \nInformation systems in corporations, government agencies, and other organizations have \nundergone a steady evolution: \n\u25cf Centralized data processing system, with a central mainframe supporting a number of \ndirectly connected terminals \n\u25cf Local area networks (LANs) interconnecting PCs and terminals to each other and the \nmainframe \n\u25cf Premises network, consisting of a number of LANs, interconnecting PCs, servers, and \nperhaps a mainframe or two \n\u25cf Enterprise-wide network, consisting of multiple, geographically distributed premises \nnetworks interconnected by a private wide area network (WAN) \n\u25cf Internet connectivity, in which the various premises networks all hook into the Internet \nand may or may not also be connected by a private WAN. \n3.7.1 Firewall Characteristics \nThe following are design goals for a firewall: \n1. All traffic from inside to outside, and vice versa, must pass through the firewall. This \nis achieved by physically blocking all access to the local network except via the firewall. \nVarious configurations are possible. \n2. Only authorized traffic, as defined by the local security policy, will be allowed to pass. \nVarious types of firewalls are used, which implement various types of security policies, \nas explained later. \n3. The firewall itself is immune to penetration. This implies that use of a trusted system \nwith a secure operating system.  Originally, firewalls focused primarily on service \ncontrol, but they have since evolved to provide all four: \n\u25cf Service control: Determines the types of Internet services that can be accessed, \ninbound or outbound. The firewall may filter traffic on the basis of IP address and TCP \nport number; may provide proxy software that receives and interprets each service request \nbefore passing it on; or may host the server software itself, such as a Web or mail service. \n\u25cf Direction control: Determines the direction in which particular service requests may \nbe initiated and allowed to flow through the firewall. \n\u25cf User control: Controls access to a service according to which user is attempting to \naccess it. This feature is typically applied to users inside the firewall perimeter (local \nusers). It may also be applied to incoming traffic from external users; the latter requires \nsome form of secure authentication technology, such as is provided in IPSec. \n\u25cf Behavior control: Controls how particular services are used. For example, the firewall \nmay filter e-mail to eliminate spam, or it may enable external access to only a portion of \nthe information on a local Web server. \nThe following capabilities are within the scope of a firewall: \n1. A firewall defines a single choke point that keeps unauthorized users out of the \nprotected", "chunk_id": "1bd095f7-9b79-450c-8f23-f9436acf7e01", "chroma:document": "\u25cf Service control: Determines the types of Internet services that can be accessed, \ninbound or outbound. The firewall may filter traffic on the basis of IP address and TCP \nport number; may provide proxy software that receives and interprets each service request \nbefore passing it on; or may host the server software itself, such as a Web or mail service."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 8503925e-9858-449a-be1e-6992783d0644
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 116, "full_page_content": "117 \n \nattempt to identify the source of the attack as a first step in preventing future attacks. \nHowever, this method typically does not yield results fast enough, if at all, to mitigate an \nongoing attack. \n3.7 Firewall Design Principles \nInformation systems in corporations, government agencies, and other organizations have \nundergone a steady evolution: \n\u25cf Centralized data processing system, with a central mainframe supporting a number of \ndirectly connected terminals \n\u25cf Local area networks (LANs) interconnecting PCs and terminals to each other and the \nmainframe \n\u25cf Premises network, consisting of a number of LANs, interconnecting PCs, servers, and \nperhaps a mainframe or two \n\u25cf Enterprise-wide network, consisting of multiple, geographically distributed premises \nnetworks interconnected by a private wide area network (WAN) \n\u25cf Internet connectivity, in which the various premises networks all hook into the Internet \nand may or may not also be connected by a private WAN. \n3.7.1 Firewall Characteristics \nThe following are design goals for a firewall: \n1. All traffic from inside to outside, and vice versa, must pass through the firewall. This \nis achieved by physically blocking all access to the local network except via the firewall. \nVarious configurations are possible. \n2. Only authorized traffic, as defined by the local security policy, will be allowed to pass. \nVarious types of firewalls are used, which implement various types of security policies, \nas explained later. \n3. The firewall itself is immune to penetration. This implies that use of a trusted system \nwith a secure operating system.  Originally, firewalls focused primarily on service \ncontrol, but they have since evolved to provide all four: \n\u25cf Service control: Determines the types of Internet services that can be accessed, \ninbound or outbound. The firewall may filter traffic on the basis of IP address and TCP \nport number; may provide proxy software that receives and interprets each service request \nbefore passing it on; or may host the server software itself, such as a Web or mail service. \n\u25cf Direction control: Determines the direction in which particular service requests may \nbe initiated and allowed to flow through the firewall. \n\u25cf User control: Controls access to a service according to which user is attempting to \naccess it. This feature is typically applied to users inside the firewall perimeter (local \nusers). It may also be applied to incoming traffic from external users; the latter requires \nsome form of secure authentication technology, such as is provided in IPSec. \n\u25cf Behavior control: Controls how particular services are used. For example, the firewall \nmay filter e-mail to eliminate spam, or it may enable external access to only a portion of \nthe information on a local Web server. \nThe following capabilities are within the scope of a firewall: \n1. A firewall defines a single choke point that keeps unauthorized users out of the \nprotected", "chunk_id": "d1dbda94-818a-4ced-9cfc-09f54859cf4d", "chroma:document": "\u25cf Direction control: Determines the direction in which particular service requests may \nbe initiated and allowed to flow through the firewall. \n\u25cf User control: Controls access to a service according to which user is attempting to \naccess it. This feature is typically applied to users inside the firewall perimeter (local"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 5789e16a-0056-439b-b149-dbb3b13ee95a
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 116, "full_page_content": "117 \n \nattempt to identify the source of the attack as a first step in preventing future attacks. \nHowever, this method typically does not yield results fast enough, if at all, to mitigate an \nongoing attack. \n3.7 Firewall Design Principles \nInformation systems in corporations, government agencies, and other organizations have \nundergone a steady evolution: \n\u25cf Centralized data processing system, with a central mainframe supporting a number of \ndirectly connected terminals \n\u25cf Local area networks (LANs) interconnecting PCs and terminals to each other and the \nmainframe \n\u25cf Premises network, consisting of a number of LANs, interconnecting PCs, servers, and \nperhaps a mainframe or two \n\u25cf Enterprise-wide network, consisting of multiple, geographically distributed premises \nnetworks interconnected by a private wide area network (WAN) \n\u25cf Internet connectivity, in which the various premises networks all hook into the Internet \nand may or may not also be connected by a private WAN. \n3.7.1 Firewall Characteristics \nThe following are design goals for a firewall: \n1. All traffic from inside to outside, and vice versa, must pass through the firewall. This \nis achieved by physically blocking all access to the local network except via the firewall. \nVarious configurations are possible. \n2. Only authorized traffic, as defined by the local security policy, will be allowed to pass. \nVarious types of firewalls are used, which implement various types of security policies, \nas explained later. \n3. The firewall itself is immune to penetration. This implies that use of a trusted system \nwith a secure operating system.  Originally, firewalls focused primarily on service \ncontrol, but they have since evolved to provide all four: \n\u25cf Service control: Determines the types of Internet services that can be accessed, \ninbound or outbound. The firewall may filter traffic on the basis of IP address and TCP \nport number; may provide proxy software that receives and interprets each service request \nbefore passing it on; or may host the server software itself, such as a Web or mail service. \n\u25cf Direction control: Determines the direction in which particular service requests may \nbe initiated and allowed to flow through the firewall. \n\u25cf User control: Controls access to a service according to which user is attempting to \naccess it. This feature is typically applied to users inside the firewall perimeter (local \nusers). It may also be applied to incoming traffic from external users; the latter requires \nsome form of secure authentication technology, such as is provided in IPSec. \n\u25cf Behavior control: Controls how particular services are used. For example, the firewall \nmay filter e-mail to eliminate spam, or it may enable external access to only a portion of \nthe information on a local Web server. \nThe following capabilities are within the scope of a firewall: \n1. A firewall defines a single choke point that keeps unauthorized users out of the \nprotected", "chunk_id": "42a7d365-c260-4d83-a6ee-1cc2176d66d8", "chroma:document": "users). It may also be applied to incoming traffic from external users; the latter requires \nsome form of secure authentication technology, such as is provided in IPSec. \n\u25cf Behavior control: Controls how particular services are used. For example, the firewall \nmay filter e-mail to eliminate spam, or it may enable external access to only a portion of"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 5153caee-4c7b-4fd7-ac79-7e865859fef1
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 116, "full_page_content": "117 \n \nattempt to identify the source of the attack as a first step in preventing future attacks. \nHowever, this method typically does not yield results fast enough, if at all, to mitigate an \nongoing attack. \n3.7 Firewall Design Principles \nInformation systems in corporations, government agencies, and other organizations have \nundergone a steady evolution: \n\u25cf Centralized data processing system, with a central mainframe supporting a number of \ndirectly connected terminals \n\u25cf Local area networks (LANs) interconnecting PCs and terminals to each other and the \nmainframe \n\u25cf Premises network, consisting of a number of LANs, interconnecting PCs, servers, and \nperhaps a mainframe or two \n\u25cf Enterprise-wide network, consisting of multiple, geographically distributed premises \nnetworks interconnected by a private wide area network (WAN) \n\u25cf Internet connectivity, in which the various premises networks all hook into the Internet \nand may or may not also be connected by a private WAN. \n3.7.1 Firewall Characteristics \nThe following are design goals for a firewall: \n1. All traffic from inside to outside, and vice versa, must pass through the firewall. This \nis achieved by physically blocking all access to the local network except via the firewall. \nVarious configurations are possible. \n2. Only authorized traffic, as defined by the local security policy, will be allowed to pass. \nVarious types of firewalls are used, which implement various types of security policies, \nas explained later. \n3. The firewall itself is immune to penetration. This implies that use of a trusted system \nwith a secure operating system.  Originally, firewalls focused primarily on service \ncontrol, but they have since evolved to provide all four: \n\u25cf Service control: Determines the types of Internet services that can be accessed, \ninbound or outbound. The firewall may filter traffic on the basis of IP address and TCP \nport number; may provide proxy software that receives and interprets each service request \nbefore passing it on; or may host the server software itself, such as a Web or mail service. \n\u25cf Direction control: Determines the direction in which particular service requests may \nbe initiated and allowed to flow through the firewall. \n\u25cf User control: Controls access to a service according to which user is attempting to \naccess it. This feature is typically applied to users inside the firewall perimeter (local \nusers). It may also be applied to incoming traffic from external users; the latter requires \nsome form of secure authentication technology, such as is provided in IPSec. \n\u25cf Behavior control: Controls how particular services are used. For example, the firewall \nmay filter e-mail to eliminate spam, or it may enable external access to only a portion of \nthe information on a local Web server. \nThe following capabilities are within the scope of a firewall: \n1. A firewall defines a single choke point that keeps unauthorized users out of the \nprotected", "chunk_id": "e82eeb51-96ad-4ffb-be84-fb1622e72b00", "chroma:document": "the information on a local Web server. \nThe following capabilities are within the scope of a firewall: \n1. A firewall defines a single choke point that keeps unauthorized users out of the \nprotected"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 0f0b079d-e89a-4f9a-8ed7-aaef15b8c7a3
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 117, "full_page_content": "118 \n \nnetwork, prohibits potentially vulnerable services from entering or leaving the network, \nand provides protection from various kinds of IP spoofing and routing attacks.  \n2. A firewall provides a location for monitoring security-related events. Audits and \nalarms can be implemented on the firewall system. \n3. A firewall is a convenient platform for several Internet functions that are not security \nrelated.  \n4. A firewall can serve as the platform for IPSec. Using the tunnel mode capability \ndescribed in the firewall can be used to implement virtual private networks. \nFirewalls have their limitations, including the following: \n1. The firewall cannot protect against attacks that bypass the firewall. Internal systems \nmay have dial-out capability to connect to an ISP. An internal LAN may support a modem \npool that provides dial-in capability for traveling employees and telecommuters. \n2. The firewall does not protect against internal threats, such as a disgruntled employee \nor an employee who unwittingly cooperates with an external attacker. \n3. The firewall cannot protect against the transfer of virus-infected programs or files.  \n3.7.2 Types of Firewalls \nFig 3.11 illustrates the three common types of firewalls: packet filters, application-level \ngateways, and circuit-level gateways.", "chunk_id": "58fc920c-496d-418c-8dee-02d647a4f4d8", "chroma:document": "118 \n \nnetwork, prohibits potentially vulnerable services from entering or leaving the network, \nand provides protection from various kinds of IP spoofing and routing attacks.  \n2. A firewall provides a location for monitoring security-related events. Audits and \nalarms can be implemented on the firewall system."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 40bb5970-dae7-451b-af4d-3d9c4304a288
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 117, "full_page_content": "118 \n \nnetwork, prohibits potentially vulnerable services from entering or leaving the network, \nand provides protection from various kinds of IP spoofing and routing attacks.  \n2. A firewall provides a location for monitoring security-related events. Audits and \nalarms can be implemented on the firewall system. \n3. A firewall is a convenient platform for several Internet functions that are not security \nrelated.  \n4. A firewall can serve as the platform for IPSec. Using the tunnel mode capability \ndescribed in the firewall can be used to implement virtual private networks. \nFirewalls have their limitations, including the following: \n1. The firewall cannot protect against attacks that bypass the firewall. Internal systems \nmay have dial-out capability to connect to an ISP. An internal LAN may support a modem \npool that provides dial-in capability for traveling employees and telecommuters. \n2. The firewall does not protect against internal threats, such as a disgruntled employee \nor an employee who unwittingly cooperates with an external attacker. \n3. The firewall cannot protect against the transfer of virus-infected programs or files.  \n3.7.2 Types of Firewalls \nFig 3.11 illustrates the three common types of firewalls: packet filters, application-level \ngateways, and circuit-level gateways.", "chunk_id": "940b482e-682d-4f1a-9a8b-809857605971", "chroma:document": "3. A firewall is a convenient platform for several Internet functions that are not security \nrelated.  \n4. A firewall can serve as the platform for IPSec. Using the tunnel mode capability \ndescribed in the firewall can be used to implement virtual private networks. \nFirewalls have their limitations, including the following:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 44d3e72a-c7cb-4806-92c5-f60b024ab66c
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 117, "full_page_content": "118 \n \nnetwork, prohibits potentially vulnerable services from entering or leaving the network, \nand provides protection from various kinds of IP spoofing and routing attacks.  \n2. A firewall provides a location for monitoring security-related events. Audits and \nalarms can be implemented on the firewall system. \n3. A firewall is a convenient platform for several Internet functions that are not security \nrelated.  \n4. A firewall can serve as the platform for IPSec. Using the tunnel mode capability \ndescribed in the firewall can be used to implement virtual private networks. \nFirewalls have their limitations, including the following: \n1. The firewall cannot protect against attacks that bypass the firewall. Internal systems \nmay have dial-out capability to connect to an ISP. An internal LAN may support a modem \npool that provides dial-in capability for traveling employees and telecommuters. \n2. The firewall does not protect against internal threats, such as a disgruntled employee \nor an employee who unwittingly cooperates with an external attacker. \n3. The firewall cannot protect against the transfer of virus-infected programs or files.  \n3.7.2 Types of Firewalls \nFig 3.11 illustrates the three common types of firewalls: packet filters, application-level \ngateways, and circuit-level gateways.", "chunk_id": "f3394da6-00fb-4e38-98da-70399309e4e1", "chroma:document": "1. The firewall cannot protect against attacks that bypass the firewall. Internal systems \nmay have dial-out capability to connect to an ISP. An internal LAN may support a modem \npool that provides dial-in capability for traveling employees and telecommuters. \n2. The firewall does not protect against internal threats, such as a disgruntled employee"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: cf71ddaf-8deb-4719-8e60-bdfe7ae9c120
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 117, "full_page_content": "118 \n \nnetwork, prohibits potentially vulnerable services from entering or leaving the network, \nand provides protection from various kinds of IP spoofing and routing attacks.  \n2. A firewall provides a location for monitoring security-related events. Audits and \nalarms can be implemented on the firewall system. \n3. A firewall is a convenient platform for several Internet functions that are not security \nrelated.  \n4. A firewall can serve as the platform for IPSec. Using the tunnel mode capability \ndescribed in the firewall can be used to implement virtual private networks. \nFirewalls have their limitations, including the following: \n1. The firewall cannot protect against attacks that bypass the firewall. Internal systems \nmay have dial-out capability to connect to an ISP. An internal LAN may support a modem \npool that provides dial-in capability for traveling employees and telecommuters. \n2. The firewall does not protect against internal threats, such as a disgruntled employee \nor an employee who unwittingly cooperates with an external attacker. \n3. The firewall cannot protect against the transfer of virus-infected programs or files.  \n3.7.2 Types of Firewalls \nFig 3.11 illustrates the three common types of firewalls: packet filters, application-level \ngateways, and circuit-level gateways.", "chunk_id": "5793496a-a503-49c4-8f38-49f11a504032", "chroma:document": "or an employee who unwittingly cooperates with an external attacker. \n3. The firewall cannot protect against the transfer of virus-infected programs or files.  \n3.7.2 Types of Firewalls \nFig 3.11 illustrates the three common types of firewalls: packet filters, application-level \ngateways, and circuit-level gateways."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 19840398-24f5-4f19-8077-c6a8870a7103
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 118, "full_page_content": "119 \n \n \nFigure 3.11. Firewall Types \n3.7.2.1 Packet-Filtering Router \nA packet filtering firewall applies a set of rules to each incoming and outgoing IP \npacket and then forwards or discards the packet (Figure 22.1b). The firewall is typically \nconfigured to filter packets going in both directions (from and to the internal network). \nFiltering rules are based on information contained in a network packet: \n \u2022  Source IP address: The IP address of the system that originated the IP packet (e.g., 19\n2.178.1.1) \n\u2022  Destination IP address: The IP address of the system the IP packet is trying to reach (e.\ng., 192.168.1.2) \n\u2022   Source and destination transport-level address: The transport-\nlevel (e.g., TCP or UDP) port number, which defines applications such as SNMP or TEL\nNET \n\u2022   IP protocol field: Defines the transport protocol", "chunk_id": "30d192fa-deda-44e5-95da-bb66167d1f65", "chroma:document": "119 \n \n \nFigure 3.11. Firewall Types \n3.7.2.1 Packet-Filtering Router \nA packet filtering firewall applies a set of rules to each incoming and outgoing IP \npacket and then forwards or discards the packet (Figure 22.1b). The firewall is typically \nconfigured to filter packets going in both directions (from and to the internal network)."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: a20145e7-8c88-4608-a866-fcc6490f03e9
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 118, "full_page_content": "119 \n \n \nFigure 3.11. Firewall Types \n3.7.2.1 Packet-Filtering Router \nA packet filtering firewall applies a set of rules to each incoming and outgoing IP \npacket and then forwards or discards the packet (Figure 22.1b). The firewall is typically \nconfigured to filter packets going in both directions (from and to the internal network). \nFiltering rules are based on information contained in a network packet: \n \u2022  Source IP address: The IP address of the system that originated the IP packet (e.g., 19\n2.178.1.1) \n\u2022  Destination IP address: The IP address of the system the IP packet is trying to reach (e.\ng., 192.168.1.2) \n\u2022   Source and destination transport-level address: The transport-\nlevel (e.g., TCP or UDP) port number, which defines applications such as SNMP or TEL\nNET \n\u2022   IP protocol field: Defines the transport protocol", "chunk_id": "6e1e532a-2e8a-4f9d-b945-99c383b4f819", "chroma:document": "Filtering rules are based on information contained in a network packet: \n \u2022  Source IP address: The IP address of the system that originated the IP packet (e.g., 19\n2.178.1.1) \n\u2022  Destination IP address: The IP address of the system the IP packet is trying to reach (e.\ng., 192.168.1.2) \n\u2022   Source and destination transport-level address: The transport-"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 699f4b64-34d0-490b-af20-28efedab31e7
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 118, "full_page_content": "119 \n \n \nFigure 3.11. Firewall Types \n3.7.2.1 Packet-Filtering Router \nA packet filtering firewall applies a set of rules to each incoming and outgoing IP \npacket and then forwards or discards the packet (Figure 22.1b). The firewall is typically \nconfigured to filter packets going in both directions (from and to the internal network). \nFiltering rules are based on information contained in a network packet: \n \u2022  Source IP address: The IP address of the system that originated the IP packet (e.g., 19\n2.178.1.1) \n\u2022  Destination IP address: The IP address of the system the IP packet is trying to reach (e.\ng., 192.168.1.2) \n\u2022   Source and destination transport-level address: The transport-\nlevel (e.g., TCP or UDP) port number, which defines applications such as SNMP or TEL\nNET \n\u2022   IP protocol field: Defines the transport protocol", "chunk_id": "7c02b64e-f694-4474-ba20-08d202363c2c", "chroma:document": "level (e.g., TCP or UDP) port number, which defines applications such as SNMP or TEL\nNET \n\u2022   IP protocol field: Defines the transport protocol"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 3b8de7ed-3bc0-4e23-8f42-0fc705d7b08c
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 119, "full_page_content": "120 \n \n\u2022  Interface: For a firewall with three or more ports, which interface of the fire- \nwall the packet came from or which interface of the firewall the packet is des- tined for \n \u2022 Default = discard: That which is not expressly permitted is prohibited. \n\u2022 Default = forward: That which is not expressly prohibited is permitted. \n The default discard policy is more conservative. Initially, everything is blocked, and \nservices must be added on a case-by-case basis. This policy is more visible to users, who \nare more likely to see the firewall as a hindrance. However, this is the policy likely to be \npreferred by businesses and government organizations.  \nIn each set, the rules are applied top to bottom. The \u201c*\u201d in a field is a wildcard \ndesignator that matches everything. We assume that the default = discard policy is in \nforce", "chunk_id": "860f9742-b7c7-477e-9017-958b1791bfbc", "chroma:document": "120 \n \n\u2022  Interface: For a firewall with three or more ports, which interface of the fire- \nwall the packet came from or which interface of the firewall the packet is des- tined for \n \u2022 Default = discard: That which is not expressly permitted is prohibited. \n\u2022 Default = forward: That which is not expressly prohibited is permitted."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: b34d33d7-d0ef-430d-81d6-600c7a52cf2d
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 119, "full_page_content": "120 \n \n\u2022  Interface: For a firewall with three or more ports, which interface of the fire- \nwall the packet came from or which interface of the firewall the packet is des- tined for \n \u2022 Default = discard: That which is not expressly permitted is prohibited. \n\u2022 Default = forward: That which is not expressly prohibited is permitted. \n The default discard policy is more conservative. Initially, everything is blocked, and \nservices must be added on a case-by-case basis. This policy is more visible to users, who \nare more likely to see the firewall as a hindrance. However, this is the policy likely to be \npreferred by businesses and government organizations.  \nIn each set, the rules are applied top to bottom. The \u201c*\u201d in a field is a wildcard \ndesignator that matches everything. We assume that the default = discard policy is in \nforce", "chunk_id": "9e05d4d1-e459-44c8-a772-14ae96b7e23b", "chroma:document": "The default discard policy is more conservative. Initially, everything is blocked, and \nservices must be added on a case-by-case basis. This policy is more visible to users, who \nare more likely to see the firewall as a hindrance. However, this is the policy likely to be \npreferred by businesses and government organizations."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 1f172380-1cbd-400d-967d-cf158950dca4
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 119, "full_page_content": "120 \n \n\u2022  Interface: For a firewall with three or more ports, which interface of the fire- \nwall the packet came from or which interface of the firewall the packet is des- tined for \n \u2022 Default = discard: That which is not expressly permitted is prohibited. \n\u2022 Default = forward: That which is not expressly prohibited is permitted. \n The default discard policy is more conservative. Initially, everything is blocked, and \nservices must be added on a case-by-case basis. This policy is more visible to users, who \nare more likely to see the firewall as a hindrance. However, this is the policy likely to be \npreferred by businesses and government organizations.  \nIn each set, the rules are applied top to bottom. The \u201c*\u201d in a field is a wildcard \ndesignator that matches everything. We assume that the default = discard policy is in \nforce", "chunk_id": "595e1710-4bcd-4fa7-9351-f2188019ecf1", "chroma:document": "In each set, the rules are applied top to bottom. The \u201c*\u201d in a field is a wildcard \ndesignator that matches everything. We assume that the default = discard policy is in \nforce"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 4e8342ed-8384-42f6-9009-d0679c887d40
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 120, "full_page_content": "121 \n \nFig 3.12 Types of Firewalls \nTable 3.2 . Packet-Filtering Examples", "chunk_id": "f0aa1197-aff0-421d-89c2-308a501021ad", "chroma:document": "121 \n \nFig 3.12 Types of Firewalls \nTable 3.2 . Packet-Filtering Examples"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 6798368f-600f-4e83-8629-cb77c5368223
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 121, "full_page_content": "122 \n \nA.       Inbound mail is allowed (port 25 is for SMTP incoming), but only to a gateway host. \nHowever, packets from a particular external host, SPIGOT, are blocked because that host \nhas a history of sending massive files in e-mail  messages. \nB.     This is an explicit statement of the default policy. All rulesets include this rule implici\ntly as the last rule. \nC.     This ruleset is intended to specify that any inside host can send mail to the out- side. A \nTCP packet with a destination port of 25 is routed to the SMTP server on the destination ma\nchine.  \nD.This ruleset achieves the intended result that was not achieved in C. The rules take adv\nantage of a feature of TCP connections. Once a connection is set up, the ACK flag of a TCP \nsegment is set to acknowledge segments sent from the other side. Thus, this ruleset states tha\nt it allows IP packets where the source IP address is one of a list of designated internal hosts \nand the destination TCP port number is 25 \nE.   This ruleset isone approach to handling FTP connections. With FTP, two TCP \nconnections are used: a control connection to set up the file transfer and a data \nconnection for the actual file transfer.  Thus, this ruleset allows \n\u2014  Packets that originate internally \n\u2014 Reply packets to a connection initiated by an internal machine \n\u2014 Packets destined for a high-numbered port on an internal machine \nThis scheme requires that the systems be configured so that only the appropriate port \nnumbers are in use. \n Rule set E points out the difficulty in dealing with applications at the packet-\nfiltering level. Another way to deal with FTP and similar applications is either state- \nful packet filters or an application-level gateway, both described subsequently in this \nsection. \nOne advantage of a packet filtering firewall is its simplicity. Also, packet filters typically \nare transparent to users and are very fast. [WACK02] lists the following weaknesses of \npacket filter firewalls:  \n\u2022   Because packet filter firewalls do not examine upper-layer data, they cannot prevent \nattacks \nthat \nemploy \napplication-specific \nvulnerabilities \nor \nfunctions.  \nFor example, a packet \nfilter \nfirewall \ncannot \nblock \nspecific application commands; if a packet filter firewall allows a given application, all \nfunctions available within that application will be   permitted. \n\u2022   Because of the limited information available to the firewall, the logging func- \ntionality present in packet filter firewalls is limited. Packet filter logs normally contain the \nsame \ninformation \nused \nto \nmake \naccess \ncontrol \ndecisions \n(source \naddress, destination address, and traffic type). \n\u2022  Most packet filter firewalls do not support advanced user authentication schemes. \nOnce again, \nthis \nlimitation \nis \nmostly due to \nthe lack of upper-layer \nfunctionality by the firewall.", "chunk_id": "8cda8bb9-a8a4-4b26-bb91-511ae74834c2", "chroma:document": "122 \n \nA.       Inbound mail is allowed (port 25 is for SMTP incoming), but only to a gateway host. \nHowever, packets from a particular external host, SPIGOT, are blocked because that host \nhas a history of sending massive files in e-mail  messages. \nB.     This is an explicit statement of the default policy. All rulesets include this rule implici\ntly as the last rule."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 7d21fb1e-96dd-4b9f-9884-4a3a37e54590
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 121, "full_page_content": "122 \n \nA.       Inbound mail is allowed (port 25 is for SMTP incoming), but only to a gateway host. \nHowever, packets from a particular external host, SPIGOT, are blocked because that host \nhas a history of sending massive files in e-mail  messages. \nB.     This is an explicit statement of the default policy. All rulesets include this rule implici\ntly as the last rule. \nC.     This ruleset is intended to specify that any inside host can send mail to the out- side. A \nTCP packet with a destination port of 25 is routed to the SMTP server on the destination ma\nchine.  \nD.This ruleset achieves the intended result that was not achieved in C. The rules take adv\nantage of a feature of TCP connections. Once a connection is set up, the ACK flag of a TCP \nsegment is set to acknowledge segments sent from the other side. Thus, this ruleset states tha\nt it allows IP packets where the source IP address is one of a list of designated internal hosts \nand the destination TCP port number is 25 \nE.   This ruleset isone approach to handling FTP connections. With FTP, two TCP \nconnections are used: a control connection to set up the file transfer and a data \nconnection for the actual file transfer.  Thus, this ruleset allows \n\u2014  Packets that originate internally \n\u2014 Reply packets to a connection initiated by an internal machine \n\u2014 Packets destined for a high-numbered port on an internal machine \nThis scheme requires that the systems be configured so that only the appropriate port \nnumbers are in use. \n Rule set E points out the difficulty in dealing with applications at the packet-\nfiltering level. Another way to deal with FTP and similar applications is either state- \nful packet filters or an application-level gateway, both described subsequently in this \nsection. \nOne advantage of a packet filtering firewall is its simplicity. Also, packet filters typically \nare transparent to users and are very fast. [WACK02] lists the following weaknesses of \npacket filter firewalls:  \n\u2022   Because packet filter firewalls do not examine upper-layer data, they cannot prevent \nattacks \nthat \nemploy \napplication-specific \nvulnerabilities \nor \nfunctions.  \nFor example, a packet \nfilter \nfirewall \ncannot \nblock \nspecific application commands; if a packet filter firewall allows a given application, all \nfunctions available within that application will be   permitted. \n\u2022   Because of the limited information available to the firewall, the logging func- \ntionality present in packet filter firewalls is limited. Packet filter logs normally contain the \nsame \ninformation \nused \nto \nmake \naccess \ncontrol \ndecisions \n(source \naddress, destination address, and traffic type). \n\u2022  Most packet filter firewalls do not support advanced user authentication schemes. \nOnce again, \nthis \nlimitation \nis \nmostly due to \nthe lack of upper-layer \nfunctionality by the firewall.", "chunk_id": "d5e74a31-f246-490e-945c-d853bb114d05", "chroma:document": "C.     This ruleset is intended to specify that any inside host can send mail to the out- side. A \nTCP packet with a destination port of 25 is routed to the SMTP server on the destination ma\nchine.  \nD.This ruleset achieves the intended result that was not achieved in C. The rules take adv\nantage of a feature of TCP connections. Once a connection is set up, the ACK flag of a TCP"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 1fc65d17-7949-4949-b3eb-b55bd0aa0237
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 121, "full_page_content": "122 \n \nA.       Inbound mail is allowed (port 25 is for SMTP incoming), but only to a gateway host. \nHowever, packets from a particular external host, SPIGOT, are blocked because that host \nhas a history of sending massive files in e-mail  messages. \nB.     This is an explicit statement of the default policy. All rulesets include this rule implici\ntly as the last rule. \nC.     This ruleset is intended to specify that any inside host can send mail to the out- side. A \nTCP packet with a destination port of 25 is routed to the SMTP server on the destination ma\nchine.  \nD.This ruleset achieves the intended result that was not achieved in C. The rules take adv\nantage of a feature of TCP connections. Once a connection is set up, the ACK flag of a TCP \nsegment is set to acknowledge segments sent from the other side. Thus, this ruleset states tha\nt it allows IP packets where the source IP address is one of a list of designated internal hosts \nand the destination TCP port number is 25 \nE.   This ruleset isone approach to handling FTP connections. With FTP, two TCP \nconnections are used: a control connection to set up the file transfer and a data \nconnection for the actual file transfer.  Thus, this ruleset allows \n\u2014  Packets that originate internally \n\u2014 Reply packets to a connection initiated by an internal machine \n\u2014 Packets destined for a high-numbered port on an internal machine \nThis scheme requires that the systems be configured so that only the appropriate port \nnumbers are in use. \n Rule set E points out the difficulty in dealing with applications at the packet-\nfiltering level. Another way to deal with FTP and similar applications is either state- \nful packet filters or an application-level gateway, both described subsequently in this \nsection. \nOne advantage of a packet filtering firewall is its simplicity. Also, packet filters typically \nare transparent to users and are very fast. [WACK02] lists the following weaknesses of \npacket filter firewalls:  \n\u2022   Because packet filter firewalls do not examine upper-layer data, they cannot prevent \nattacks \nthat \nemploy \napplication-specific \nvulnerabilities \nor \nfunctions.  \nFor example, a packet \nfilter \nfirewall \ncannot \nblock \nspecific application commands; if a packet filter firewall allows a given application, all \nfunctions available within that application will be   permitted. \n\u2022   Because of the limited information available to the firewall, the logging func- \ntionality present in packet filter firewalls is limited. Packet filter logs normally contain the \nsame \ninformation \nused \nto \nmake \naccess \ncontrol \ndecisions \n(source \naddress, destination address, and traffic type). \n\u2022  Most packet filter firewalls do not support advanced user authentication schemes. \nOnce again, \nthis \nlimitation \nis \nmostly due to \nthe lack of upper-layer \nfunctionality by the firewall.", "chunk_id": "d0f38a5a-9d76-45f3-874d-1b599fce6d70", "chroma:document": "segment is set to acknowledge segments sent from the other side. Thus, this ruleset states tha\nt it allows IP packets where the source IP address is one of a list of designated internal hosts \nand the destination TCP port number is 25 \nE.   This ruleset isone approach to handling FTP connections. With FTP, two TCP"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: b7f4e799-4897-48b4-a4f5-64936d9f67e4
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 121, "full_page_content": "122 \n \nA.       Inbound mail is allowed (port 25 is for SMTP incoming), but only to a gateway host. \nHowever, packets from a particular external host, SPIGOT, are blocked because that host \nhas a history of sending massive files in e-mail  messages. \nB.     This is an explicit statement of the default policy. All rulesets include this rule implici\ntly as the last rule. \nC.     This ruleset is intended to specify that any inside host can send mail to the out- side. A \nTCP packet with a destination port of 25 is routed to the SMTP server on the destination ma\nchine.  \nD.This ruleset achieves the intended result that was not achieved in C. The rules take adv\nantage of a feature of TCP connections. Once a connection is set up, the ACK flag of a TCP \nsegment is set to acknowledge segments sent from the other side. Thus, this ruleset states tha\nt it allows IP packets where the source IP address is one of a list of designated internal hosts \nand the destination TCP port number is 25 \nE.   This ruleset isone approach to handling FTP connections. With FTP, two TCP \nconnections are used: a control connection to set up the file transfer and a data \nconnection for the actual file transfer.  Thus, this ruleset allows \n\u2014  Packets that originate internally \n\u2014 Reply packets to a connection initiated by an internal machine \n\u2014 Packets destined for a high-numbered port on an internal machine \nThis scheme requires that the systems be configured so that only the appropriate port \nnumbers are in use. \n Rule set E points out the difficulty in dealing with applications at the packet-\nfiltering level. Another way to deal with FTP and similar applications is either state- \nful packet filters or an application-level gateway, both described subsequently in this \nsection. \nOne advantage of a packet filtering firewall is its simplicity. Also, packet filters typically \nare transparent to users and are very fast. [WACK02] lists the following weaknesses of \npacket filter firewalls:  \n\u2022   Because packet filter firewalls do not examine upper-layer data, they cannot prevent \nattacks \nthat \nemploy \napplication-specific \nvulnerabilities \nor \nfunctions.  \nFor example, a packet \nfilter \nfirewall \ncannot \nblock \nspecific application commands; if a packet filter firewall allows a given application, all \nfunctions available within that application will be   permitted. \n\u2022   Because of the limited information available to the firewall, the logging func- \ntionality present in packet filter firewalls is limited. Packet filter logs normally contain the \nsame \ninformation \nused \nto \nmake \naccess \ncontrol \ndecisions \n(source \naddress, destination address, and traffic type). \n\u2022  Most packet filter firewalls do not support advanced user authentication schemes. \nOnce again, \nthis \nlimitation \nis \nmostly due to \nthe lack of upper-layer \nfunctionality by the firewall.", "chunk_id": "5a6a7f01-f25f-43aa-a738-e02bf0ca546f", "chroma:document": "connections are used: a control connection to set up the file transfer and a data \nconnection for the actual file transfer.  Thus, this ruleset allows \n\u2014  Packets that originate internally \n\u2014 Reply packets to a connection initiated by an internal machine \n\u2014 Packets destined for a high-numbered port on an internal machine"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 3f52d044-9866-4ea5-8ab1-2f0b99d09980
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 121, "full_page_content": "122 \n \nA.       Inbound mail is allowed (port 25 is for SMTP incoming), but only to a gateway host. \nHowever, packets from a particular external host, SPIGOT, are blocked because that host \nhas a history of sending massive files in e-mail  messages. \nB.     This is an explicit statement of the default policy. All rulesets include this rule implici\ntly as the last rule. \nC.     This ruleset is intended to specify that any inside host can send mail to the out- side. A \nTCP packet with a destination port of 25 is routed to the SMTP server on the destination ma\nchine.  \nD.This ruleset achieves the intended result that was not achieved in C. The rules take adv\nantage of a feature of TCP connections. Once a connection is set up, the ACK flag of a TCP \nsegment is set to acknowledge segments sent from the other side. Thus, this ruleset states tha\nt it allows IP packets where the source IP address is one of a list of designated internal hosts \nand the destination TCP port number is 25 \nE.   This ruleset isone approach to handling FTP connections. With FTP, two TCP \nconnections are used: a control connection to set up the file transfer and a data \nconnection for the actual file transfer.  Thus, this ruleset allows \n\u2014  Packets that originate internally \n\u2014 Reply packets to a connection initiated by an internal machine \n\u2014 Packets destined for a high-numbered port on an internal machine \nThis scheme requires that the systems be configured so that only the appropriate port \nnumbers are in use. \n Rule set E points out the difficulty in dealing with applications at the packet-\nfiltering level. Another way to deal with FTP and similar applications is either state- \nful packet filters or an application-level gateway, both described subsequently in this \nsection. \nOne advantage of a packet filtering firewall is its simplicity. Also, packet filters typically \nare transparent to users and are very fast. [WACK02] lists the following weaknesses of \npacket filter firewalls:  \n\u2022   Because packet filter firewalls do not examine upper-layer data, they cannot prevent \nattacks \nthat \nemploy \napplication-specific \nvulnerabilities \nor \nfunctions.  \nFor example, a packet \nfilter \nfirewall \ncannot \nblock \nspecific application commands; if a packet filter firewall allows a given application, all \nfunctions available within that application will be   permitted. \n\u2022   Because of the limited information available to the firewall, the logging func- \ntionality present in packet filter firewalls is limited. Packet filter logs normally contain the \nsame \ninformation \nused \nto \nmake \naccess \ncontrol \ndecisions \n(source \naddress, destination address, and traffic type). \n\u2022  Most packet filter firewalls do not support advanced user authentication schemes. \nOnce again, \nthis \nlimitation \nis \nmostly due to \nthe lack of upper-layer \nfunctionality by the firewall.", "chunk_id": "f8c21679-7b90-423b-ba88-b3e2af9f6b5d", "chroma:document": "This scheme requires that the systems be configured so that only the appropriate port \nnumbers are in use. \n Rule set E points out the difficulty in dealing with applications at the packet-\nfiltering level. Another way to deal with FTP and similar applications is either state- \nful packet filters or an application-level gateway, both described subsequently in this \nsection."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: f0c8187c-e53a-4d25-a583-5d3e183607ad
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 121, "full_page_content": "122 \n \nA.       Inbound mail is allowed (port 25 is for SMTP incoming), but only to a gateway host. \nHowever, packets from a particular external host, SPIGOT, are blocked because that host \nhas a history of sending massive files in e-mail  messages. \nB.     This is an explicit statement of the default policy. All rulesets include this rule implici\ntly as the last rule. \nC.     This ruleset is intended to specify that any inside host can send mail to the out- side. A \nTCP packet with a destination port of 25 is routed to the SMTP server on the destination ma\nchine.  \nD.This ruleset achieves the intended result that was not achieved in C. The rules take adv\nantage of a feature of TCP connections. Once a connection is set up, the ACK flag of a TCP \nsegment is set to acknowledge segments sent from the other side. Thus, this ruleset states tha\nt it allows IP packets where the source IP address is one of a list of designated internal hosts \nand the destination TCP port number is 25 \nE.   This ruleset isone approach to handling FTP connections. With FTP, two TCP \nconnections are used: a control connection to set up the file transfer and a data \nconnection for the actual file transfer.  Thus, this ruleset allows \n\u2014  Packets that originate internally \n\u2014 Reply packets to a connection initiated by an internal machine \n\u2014 Packets destined for a high-numbered port on an internal machine \nThis scheme requires that the systems be configured so that only the appropriate port \nnumbers are in use. \n Rule set E points out the difficulty in dealing with applications at the packet-\nfiltering level. Another way to deal with FTP and similar applications is either state- \nful packet filters or an application-level gateway, both described subsequently in this \nsection. \nOne advantage of a packet filtering firewall is its simplicity. Also, packet filters typically \nare transparent to users and are very fast. [WACK02] lists the following weaknesses of \npacket filter firewalls:  \n\u2022   Because packet filter firewalls do not examine upper-layer data, they cannot prevent \nattacks \nthat \nemploy \napplication-specific \nvulnerabilities \nor \nfunctions.  \nFor example, a packet \nfilter \nfirewall \ncannot \nblock \nspecific application commands; if a packet filter firewall allows a given application, all \nfunctions available within that application will be   permitted. \n\u2022   Because of the limited information available to the firewall, the logging func- \ntionality present in packet filter firewalls is limited. Packet filter logs normally contain the \nsame \ninformation \nused \nto \nmake \naccess \ncontrol \ndecisions \n(source \naddress, destination address, and traffic type). \n\u2022  Most packet filter firewalls do not support advanced user authentication schemes. \nOnce again, \nthis \nlimitation \nis \nmostly due to \nthe lack of upper-layer \nfunctionality by the firewall.", "chunk_id": "d30b3288-4a80-4dcd-81c7-bb6aab1eba03", "chroma:document": "section. \nOne advantage of a packet filtering firewall is its simplicity. Also, packet filters typically \nare transparent to users and are very fast. [WACK02] lists the following weaknesses of \npacket filter firewalls:  \n\u2022   Because packet filter firewalls do not examine upper-layer data, they cannot prevent \nattacks \nthat \nemploy \napplication-specific \nvulnerabilities \nor"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 69793274-2068-4ee0-af4b-aee1190c0907
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 121, "full_page_content": "122 \n \nA.       Inbound mail is allowed (port 25 is for SMTP incoming), but only to a gateway host. \nHowever, packets from a particular external host, SPIGOT, are blocked because that host \nhas a history of sending massive files in e-mail  messages. \nB.     This is an explicit statement of the default policy. All rulesets include this rule implici\ntly as the last rule. \nC.     This ruleset is intended to specify that any inside host can send mail to the out- side. A \nTCP packet with a destination port of 25 is routed to the SMTP server on the destination ma\nchine.  \nD.This ruleset achieves the intended result that was not achieved in C. The rules take adv\nantage of a feature of TCP connections. Once a connection is set up, the ACK flag of a TCP \nsegment is set to acknowledge segments sent from the other side. Thus, this ruleset states tha\nt it allows IP packets where the source IP address is one of a list of designated internal hosts \nand the destination TCP port number is 25 \nE.   This ruleset isone approach to handling FTP connections. With FTP, two TCP \nconnections are used: a control connection to set up the file transfer and a data \nconnection for the actual file transfer.  Thus, this ruleset allows \n\u2014  Packets that originate internally \n\u2014 Reply packets to a connection initiated by an internal machine \n\u2014 Packets destined for a high-numbered port on an internal machine \nThis scheme requires that the systems be configured so that only the appropriate port \nnumbers are in use. \n Rule set E points out the difficulty in dealing with applications at the packet-\nfiltering level. Another way to deal with FTP and similar applications is either state- \nful packet filters or an application-level gateway, both described subsequently in this \nsection. \nOne advantage of a packet filtering firewall is its simplicity. Also, packet filters typically \nare transparent to users and are very fast. [WACK02] lists the following weaknesses of \npacket filter firewalls:  \n\u2022   Because packet filter firewalls do not examine upper-layer data, they cannot prevent \nattacks \nthat \nemploy \napplication-specific \nvulnerabilities \nor \nfunctions.  \nFor example, a packet \nfilter \nfirewall \ncannot \nblock \nspecific application commands; if a packet filter firewall allows a given application, all \nfunctions available within that application will be   permitted. \n\u2022   Because of the limited information available to the firewall, the logging func- \ntionality present in packet filter firewalls is limited. Packet filter logs normally contain the \nsame \ninformation \nused \nto \nmake \naccess \ncontrol \ndecisions \n(source \naddress, destination address, and traffic type). \n\u2022  Most packet filter firewalls do not support advanced user authentication schemes. \nOnce again, \nthis \nlimitation \nis \nmostly due to \nthe lack of upper-layer \nfunctionality by the firewall.", "chunk_id": "4de1de3f-5899-4672-9519-9f56ccbd9449", "chroma:document": "or \nfunctions.  \nFor example, a packet \nfilter \nfirewall \ncannot \nblock \nspecific application commands; if a packet filter firewall allows a given application, all \nfunctions available within that application will be   permitted. \n\u2022   Because of the limited information available to the firewall, the logging func-"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 187c55e0-4a49-48fa-9067-2b0eb7f4d421
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 121, "full_page_content": "122 \n \nA.       Inbound mail is allowed (port 25 is for SMTP incoming), but only to a gateway host. \nHowever, packets from a particular external host, SPIGOT, are blocked because that host \nhas a history of sending massive files in e-mail  messages. \nB.     This is an explicit statement of the default policy. All rulesets include this rule implici\ntly as the last rule. \nC.     This ruleset is intended to specify that any inside host can send mail to the out- side. A \nTCP packet with a destination port of 25 is routed to the SMTP server on the destination ma\nchine.  \nD.This ruleset achieves the intended result that was not achieved in C. The rules take adv\nantage of a feature of TCP connections. Once a connection is set up, the ACK flag of a TCP \nsegment is set to acknowledge segments sent from the other side. Thus, this ruleset states tha\nt it allows IP packets where the source IP address is one of a list of designated internal hosts \nand the destination TCP port number is 25 \nE.   This ruleset isone approach to handling FTP connections. With FTP, two TCP \nconnections are used: a control connection to set up the file transfer and a data \nconnection for the actual file transfer.  Thus, this ruleset allows \n\u2014  Packets that originate internally \n\u2014 Reply packets to a connection initiated by an internal machine \n\u2014 Packets destined for a high-numbered port on an internal machine \nThis scheme requires that the systems be configured so that only the appropriate port \nnumbers are in use. \n Rule set E points out the difficulty in dealing with applications at the packet-\nfiltering level. Another way to deal with FTP and similar applications is either state- \nful packet filters or an application-level gateway, both described subsequently in this \nsection. \nOne advantage of a packet filtering firewall is its simplicity. Also, packet filters typically \nare transparent to users and are very fast. [WACK02] lists the following weaknesses of \npacket filter firewalls:  \n\u2022   Because packet filter firewalls do not examine upper-layer data, they cannot prevent \nattacks \nthat \nemploy \napplication-specific \nvulnerabilities \nor \nfunctions.  \nFor example, a packet \nfilter \nfirewall \ncannot \nblock \nspecific application commands; if a packet filter firewall allows a given application, all \nfunctions available within that application will be   permitted. \n\u2022   Because of the limited information available to the firewall, the logging func- \ntionality present in packet filter firewalls is limited. Packet filter logs normally contain the \nsame \ninformation \nused \nto \nmake \naccess \ncontrol \ndecisions \n(source \naddress, destination address, and traffic type). \n\u2022  Most packet filter firewalls do not support advanced user authentication schemes. \nOnce again, \nthis \nlimitation \nis \nmostly due to \nthe lack of upper-layer \nfunctionality by the firewall.", "chunk_id": "f9a7752f-a972-4815-a36a-d9363f9f6a45", "chroma:document": "tionality present in packet filter firewalls is limited. Packet filter logs normally contain the \nsame \ninformation \nused \nto \nmake \naccess \ncontrol \ndecisions \n(source \naddress, destination address, and traffic type). \n\u2022  Most packet filter firewalls do not support advanced user authentication schemes. \nOnce again, \nthis \nlimitation \nis \nmostly due to \nthe lack of upper-layer"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: b4ad550d-c778-4914-b682-ac1734eb36df
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 121, "full_page_content": "122 \n \nA.       Inbound mail is allowed (port 25 is for SMTP incoming), but only to a gateway host. \nHowever, packets from a particular external host, SPIGOT, are blocked because that host \nhas a history of sending massive files in e-mail  messages. \nB.     This is an explicit statement of the default policy. All rulesets include this rule implici\ntly as the last rule. \nC.     This ruleset is intended to specify that any inside host can send mail to the out- side. A \nTCP packet with a destination port of 25 is routed to the SMTP server on the destination ma\nchine.  \nD.This ruleset achieves the intended result that was not achieved in C. The rules take adv\nantage of a feature of TCP connections. Once a connection is set up, the ACK flag of a TCP \nsegment is set to acknowledge segments sent from the other side. Thus, this ruleset states tha\nt it allows IP packets where the source IP address is one of a list of designated internal hosts \nand the destination TCP port number is 25 \nE.   This ruleset isone approach to handling FTP connections. With FTP, two TCP \nconnections are used: a control connection to set up the file transfer and a data \nconnection for the actual file transfer.  Thus, this ruleset allows \n\u2014  Packets that originate internally \n\u2014 Reply packets to a connection initiated by an internal machine \n\u2014 Packets destined for a high-numbered port on an internal machine \nThis scheme requires that the systems be configured so that only the appropriate port \nnumbers are in use. \n Rule set E points out the difficulty in dealing with applications at the packet-\nfiltering level. Another way to deal with FTP and similar applications is either state- \nful packet filters or an application-level gateway, both described subsequently in this \nsection. \nOne advantage of a packet filtering firewall is its simplicity. Also, packet filters typically \nare transparent to users and are very fast. [WACK02] lists the following weaknesses of \npacket filter firewalls:  \n\u2022   Because packet filter firewalls do not examine upper-layer data, they cannot prevent \nattacks \nthat \nemploy \napplication-specific \nvulnerabilities \nor \nfunctions.  \nFor example, a packet \nfilter \nfirewall \ncannot \nblock \nspecific application commands; if a packet filter firewall allows a given application, all \nfunctions available within that application will be   permitted. \n\u2022   Because of the limited information available to the firewall, the logging func- \ntionality present in packet filter firewalls is limited. Packet filter logs normally contain the \nsame \ninformation \nused \nto \nmake \naccess \ncontrol \ndecisions \n(source \naddress, destination address, and traffic type). \n\u2022  Most packet filter firewalls do not support advanced user authentication schemes. \nOnce again, \nthis \nlimitation \nis \nmostly due to \nthe lack of upper-layer \nfunctionality by the firewall.", "chunk_id": "ab799d6e-2bbf-4929-829d-7e5979058fe3", "chroma:document": "functionality by the firewall."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 8768fac8-2498-4ff6-be6e-28b98ad81f5c
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 122, "full_page_content": "123 \n \n\u2022  Packet filter firewalls are generally vulnerable to attacks and exploits that take \nadvantage of problems \nwithin the TCP/IP \nspecification and protocol stack, \nsuch as network layer address \nspoofing. \nMany \npacket \nfilter firewalls cannot detect a network packet in which the OSI Layer 3 addressing infor\nma- \ntion has been altered. Spoofing attacks are generally employed by intruders to \nbypass the security controls implemented in a firewall platform. \nSome of the attacks that can be made on packet filtering firewalls and the appropriate \ncountermeasures are the following: \n \u2022  IP address spoofing: The intruder transmits packets from the outside with a \nsource IP address field containing an address of an internal host. The attacker \nhopes that the use of a spoofed address will allow penetration of systems that \nemploy simple source address security, in which packets from specific trusted \ninternal \nhosts \nare \naccepted. The countermeasure \nis \nto \ndiscard \npackets \nwith \nan \ninside source address if the packet arrives on an external interface. In fact, this \ncountermeasure is often implemented at the router external to the firewall. \n\u2022  Source routing attacks: The source station specifies the route that a packet \nshould take as it crosses the Internet, in the hopes that this will bypass security measures \nthat \ndo \nnot \nanalyze \nthe \nsource \nrouting \ninformation. \nThe \ncounter- \nmeasure is to discard all packets that use this option. \n\u2022  Tiny fragment attacks: The intruder uses the IP fragmentation option to create \nextremely small fragments and force the TCP header information into a separate packet f\nragment. This attack is designed to circumvent filtering rules that depend on TCP header \ninformation. Typically, a \npacket \nfilter \nwill \nmake \na \nfil- \ntering decision on the first fragment of a packet. All subsequent fragments of that packet \nare filtered out solely on the basis that they are part of the packet \nwhose first fragment was rejected.  \n3.7.2.2 Stateful Inspection Firewalls \nA traditional packet filter makes filtering decisions on an individual packet basis and does \nnot take into consideration any higher layer context. To understand what is meant by \ncontext and why a traditional packet filter is limited with regard to context, a little \nbackground is needed. Most standardized applications that run on top of TCP follow a \nclient/server model. For example, for the Simple Mail Transfer Protocol (SMTP), e-mail \nis transmitted from a client system to a server system.  \nA simple packet-filtering firewall must permit inbound network traffic on all these high-\nnumbered ports for TCP-based traffic to occur. This creates a vulnerability that can be \nexploited by unauthorized users.  \nA stateful inspection packet filter tightens up the rules for TCP traffic by creating a \ndirectory of outbound TCP connections, as shown in Table 3.3. There is an entry for each \ncurrently established connection. The packet filter will now allow incoming traffic to \nhigh-numbered ports only for those packets that fit the profile of one of the entries in this \ndirectory", "chunk_id": "d3854396-7878-48e2-a0d0-13481427f589", "chroma:document": "123 \n \n\u2022  Packet filter firewalls are generally vulnerable to attacks and exploits that take \nadvantage of problems \nwithin the TCP/IP \nspecification and protocol stack, \nsuch as network layer address \nspoofing. \nMany \npacket \nfilter firewalls cannot detect a network packet in which the OSI Layer 3 addressing infor\nma-"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 4ec518e4-0da5-430a-8cd1-0e27323fd3c8
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 122, "full_page_content": "123 \n \n\u2022  Packet filter firewalls are generally vulnerable to attacks and exploits that take \nadvantage of problems \nwithin the TCP/IP \nspecification and protocol stack, \nsuch as network layer address \nspoofing. \nMany \npacket \nfilter firewalls cannot detect a network packet in which the OSI Layer 3 addressing infor\nma- \ntion has been altered. Spoofing attacks are generally employed by intruders to \nbypass the security controls implemented in a firewall platform. \nSome of the attacks that can be made on packet filtering firewalls and the appropriate \ncountermeasures are the following: \n \u2022  IP address spoofing: The intruder transmits packets from the outside with a \nsource IP address field containing an address of an internal host. The attacker \nhopes that the use of a spoofed address will allow penetration of systems that \nemploy simple source address security, in which packets from specific trusted \ninternal \nhosts \nare \naccepted. The countermeasure \nis \nto \ndiscard \npackets \nwith \nan \ninside source address if the packet arrives on an external interface. In fact, this \ncountermeasure is often implemented at the router external to the firewall. \n\u2022  Source routing attacks: The source station specifies the route that a packet \nshould take as it crosses the Internet, in the hopes that this will bypass security measures \nthat \ndo \nnot \nanalyze \nthe \nsource \nrouting \ninformation. \nThe \ncounter- \nmeasure is to discard all packets that use this option. \n\u2022  Tiny fragment attacks: The intruder uses the IP fragmentation option to create \nextremely small fragments and force the TCP header information into a separate packet f\nragment. This attack is designed to circumvent filtering rules that depend on TCP header \ninformation. Typically, a \npacket \nfilter \nwill \nmake \na \nfil- \ntering decision on the first fragment of a packet. All subsequent fragments of that packet \nare filtered out solely on the basis that they are part of the packet \nwhose first fragment was rejected.  \n3.7.2.2 Stateful Inspection Firewalls \nA traditional packet filter makes filtering decisions on an individual packet basis and does \nnot take into consideration any higher layer context. To understand what is meant by \ncontext and why a traditional packet filter is limited with regard to context, a little \nbackground is needed. Most standardized applications that run on top of TCP follow a \nclient/server model. For example, for the Simple Mail Transfer Protocol (SMTP), e-mail \nis transmitted from a client system to a server system.  \nA simple packet-filtering firewall must permit inbound network traffic on all these high-\nnumbered ports for TCP-based traffic to occur. This creates a vulnerability that can be \nexploited by unauthorized users.  \nA stateful inspection packet filter tightens up the rules for TCP traffic by creating a \ndirectory of outbound TCP connections, as shown in Table 3.3. There is an entry for each \ncurrently established connection. The packet filter will now allow incoming traffic to \nhigh-numbered ports only for those packets that fit the profile of one of the entries in this \ndirectory", "chunk_id": "d671e72e-d516-402c-bd61-eb4e5653be00", "chroma:document": "ma- \ntion has been altered. Spoofing attacks are generally employed by intruders to \nbypass the security controls implemented in a firewall platform. \nSome of the attacks that can be made on packet filtering firewalls and the appropriate \ncountermeasures are the following: \n \u2022  IP address spoofing: The intruder transmits packets from the outside with a"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: e5f8916e-e175-48eb-bfa7-1a1c4a4dec6c
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 122, "full_page_content": "123 \n \n\u2022  Packet filter firewalls are generally vulnerable to attacks and exploits that take \nadvantage of problems \nwithin the TCP/IP \nspecification and protocol stack, \nsuch as network layer address \nspoofing. \nMany \npacket \nfilter firewalls cannot detect a network packet in which the OSI Layer 3 addressing infor\nma- \ntion has been altered. Spoofing attacks are generally employed by intruders to \nbypass the security controls implemented in a firewall platform. \nSome of the attacks that can be made on packet filtering firewalls and the appropriate \ncountermeasures are the following: \n \u2022  IP address spoofing: The intruder transmits packets from the outside with a \nsource IP address field containing an address of an internal host. The attacker \nhopes that the use of a spoofed address will allow penetration of systems that \nemploy simple source address security, in which packets from specific trusted \ninternal \nhosts \nare \naccepted. The countermeasure \nis \nto \ndiscard \npackets \nwith \nan \ninside source address if the packet arrives on an external interface. In fact, this \ncountermeasure is often implemented at the router external to the firewall. \n\u2022  Source routing attacks: The source station specifies the route that a packet \nshould take as it crosses the Internet, in the hopes that this will bypass security measures \nthat \ndo \nnot \nanalyze \nthe \nsource \nrouting \ninformation. \nThe \ncounter- \nmeasure is to discard all packets that use this option. \n\u2022  Tiny fragment attacks: The intruder uses the IP fragmentation option to create \nextremely small fragments and force the TCP header information into a separate packet f\nragment. This attack is designed to circumvent filtering rules that depend on TCP header \ninformation. Typically, a \npacket \nfilter \nwill \nmake \na \nfil- \ntering decision on the first fragment of a packet. All subsequent fragments of that packet \nare filtered out solely on the basis that they are part of the packet \nwhose first fragment was rejected.  \n3.7.2.2 Stateful Inspection Firewalls \nA traditional packet filter makes filtering decisions on an individual packet basis and does \nnot take into consideration any higher layer context. To understand what is meant by \ncontext and why a traditional packet filter is limited with regard to context, a little \nbackground is needed. Most standardized applications that run on top of TCP follow a \nclient/server model. For example, for the Simple Mail Transfer Protocol (SMTP), e-mail \nis transmitted from a client system to a server system.  \nA simple packet-filtering firewall must permit inbound network traffic on all these high-\nnumbered ports for TCP-based traffic to occur. This creates a vulnerability that can be \nexploited by unauthorized users.  \nA stateful inspection packet filter tightens up the rules for TCP traffic by creating a \ndirectory of outbound TCP connections, as shown in Table 3.3. There is an entry for each \ncurrently established connection. The packet filter will now allow incoming traffic to \nhigh-numbered ports only for those packets that fit the profile of one of the entries in this \ndirectory", "chunk_id": "02187de6-5384-40e0-b8ea-96819adf6c3e", "chroma:document": "source IP address field containing an address of an internal host. The attacker \nhopes that the use of a spoofed address will allow penetration of systems that \nemploy simple source address security, in which packets from specific trusted \ninternal \nhosts \nare \naccepted. The countermeasure \nis \nto \ndiscard \npackets \nwith \nan"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 56cf32f2-076e-4100-8c19-9f7a079d5d02
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 122, "full_page_content": "123 \n \n\u2022  Packet filter firewalls are generally vulnerable to attacks and exploits that take \nadvantage of problems \nwithin the TCP/IP \nspecification and protocol stack, \nsuch as network layer address \nspoofing. \nMany \npacket \nfilter firewalls cannot detect a network packet in which the OSI Layer 3 addressing infor\nma- \ntion has been altered. Spoofing attacks are generally employed by intruders to \nbypass the security controls implemented in a firewall platform. \nSome of the attacks that can be made on packet filtering firewalls and the appropriate \ncountermeasures are the following: \n \u2022  IP address spoofing: The intruder transmits packets from the outside with a \nsource IP address field containing an address of an internal host. The attacker \nhopes that the use of a spoofed address will allow penetration of systems that \nemploy simple source address security, in which packets from specific trusted \ninternal \nhosts \nare \naccepted. The countermeasure \nis \nto \ndiscard \npackets \nwith \nan \ninside source address if the packet arrives on an external interface. In fact, this \ncountermeasure is often implemented at the router external to the firewall. \n\u2022  Source routing attacks: The source station specifies the route that a packet \nshould take as it crosses the Internet, in the hopes that this will bypass security measures \nthat \ndo \nnot \nanalyze \nthe \nsource \nrouting \ninformation. \nThe \ncounter- \nmeasure is to discard all packets that use this option. \n\u2022  Tiny fragment attacks: The intruder uses the IP fragmentation option to create \nextremely small fragments and force the TCP header information into a separate packet f\nragment. This attack is designed to circumvent filtering rules that depend on TCP header \ninformation. Typically, a \npacket \nfilter \nwill \nmake \na \nfil- \ntering decision on the first fragment of a packet. All subsequent fragments of that packet \nare filtered out solely on the basis that they are part of the packet \nwhose first fragment was rejected.  \n3.7.2.2 Stateful Inspection Firewalls \nA traditional packet filter makes filtering decisions on an individual packet basis and does \nnot take into consideration any higher layer context. To understand what is meant by \ncontext and why a traditional packet filter is limited with regard to context, a little \nbackground is needed. Most standardized applications that run on top of TCP follow a \nclient/server model. For example, for the Simple Mail Transfer Protocol (SMTP), e-mail \nis transmitted from a client system to a server system.  \nA simple packet-filtering firewall must permit inbound network traffic on all these high-\nnumbered ports for TCP-based traffic to occur. This creates a vulnerability that can be \nexploited by unauthorized users.  \nA stateful inspection packet filter tightens up the rules for TCP traffic by creating a \ndirectory of outbound TCP connections, as shown in Table 3.3. There is an entry for each \ncurrently established connection. The packet filter will now allow incoming traffic to \nhigh-numbered ports only for those packets that fit the profile of one of the entries in this \ndirectory", "chunk_id": "69ba57b5-e295-44d3-8bba-c41707ca1cf2", "chroma:document": "packets \nwith \nan \ninside source address if the packet arrives on an external interface. In fact, this \ncountermeasure is often implemented at the router external to the firewall. \n\u2022  Source routing attacks: The source station specifies the route that a packet \nshould take as it crosses the Internet, in the hopes that this will bypass security measures \nthat \ndo \nnot \nanalyze"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 8840f5b7-8a8d-4d43-9fb9-9f0a4488a59b
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 122, "full_page_content": "123 \n \n\u2022  Packet filter firewalls are generally vulnerable to attacks and exploits that take \nadvantage of problems \nwithin the TCP/IP \nspecification and protocol stack, \nsuch as network layer address \nspoofing. \nMany \npacket \nfilter firewalls cannot detect a network packet in which the OSI Layer 3 addressing infor\nma- \ntion has been altered. Spoofing attacks are generally employed by intruders to \nbypass the security controls implemented in a firewall platform. \nSome of the attacks that can be made on packet filtering firewalls and the appropriate \ncountermeasures are the following: \n \u2022  IP address spoofing: The intruder transmits packets from the outside with a \nsource IP address field containing an address of an internal host. The attacker \nhopes that the use of a spoofed address will allow penetration of systems that \nemploy simple source address security, in which packets from specific trusted \ninternal \nhosts \nare \naccepted. The countermeasure \nis \nto \ndiscard \npackets \nwith \nan \ninside source address if the packet arrives on an external interface. In fact, this \ncountermeasure is often implemented at the router external to the firewall. \n\u2022  Source routing attacks: The source station specifies the route that a packet \nshould take as it crosses the Internet, in the hopes that this will bypass security measures \nthat \ndo \nnot \nanalyze \nthe \nsource \nrouting \ninformation. \nThe \ncounter- \nmeasure is to discard all packets that use this option. \n\u2022  Tiny fragment attacks: The intruder uses the IP fragmentation option to create \nextremely small fragments and force the TCP header information into a separate packet f\nragment. This attack is designed to circumvent filtering rules that depend on TCP header \ninformation. Typically, a \npacket \nfilter \nwill \nmake \na \nfil- \ntering decision on the first fragment of a packet. All subsequent fragments of that packet \nare filtered out solely on the basis that they are part of the packet \nwhose first fragment was rejected.  \n3.7.2.2 Stateful Inspection Firewalls \nA traditional packet filter makes filtering decisions on an individual packet basis and does \nnot take into consideration any higher layer context. To understand what is meant by \ncontext and why a traditional packet filter is limited with regard to context, a little \nbackground is needed. Most standardized applications that run on top of TCP follow a \nclient/server model. For example, for the Simple Mail Transfer Protocol (SMTP), e-mail \nis transmitted from a client system to a server system.  \nA simple packet-filtering firewall must permit inbound network traffic on all these high-\nnumbered ports for TCP-based traffic to occur. This creates a vulnerability that can be \nexploited by unauthorized users.  \nA stateful inspection packet filter tightens up the rules for TCP traffic by creating a \ndirectory of outbound TCP connections, as shown in Table 3.3. There is an entry for each \ncurrently established connection. The packet filter will now allow incoming traffic to \nhigh-numbered ports only for those packets that fit the profile of one of the entries in this \ndirectory", "chunk_id": "e1739fa2-fc89-4375-9753-5784cb43917c", "chroma:document": "do \nnot \nanalyze \nthe \nsource \nrouting \ninformation. \nThe \ncounter- \nmeasure is to discard all packets that use this option. \n\u2022  Tiny fragment attacks: The intruder uses the IP fragmentation option to create \nextremely small fragments and force the TCP header information into a separate packet f"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 063f01be-96a5-4d84-bf58-992c3e89fc8a
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 122, "full_page_content": "123 \n \n\u2022  Packet filter firewalls are generally vulnerable to attacks and exploits that take \nadvantage of problems \nwithin the TCP/IP \nspecification and protocol stack, \nsuch as network layer address \nspoofing. \nMany \npacket \nfilter firewalls cannot detect a network packet in which the OSI Layer 3 addressing infor\nma- \ntion has been altered. Spoofing attacks are generally employed by intruders to \nbypass the security controls implemented in a firewall platform. \nSome of the attacks that can be made on packet filtering firewalls and the appropriate \ncountermeasures are the following: \n \u2022  IP address spoofing: The intruder transmits packets from the outside with a \nsource IP address field containing an address of an internal host. The attacker \nhopes that the use of a spoofed address will allow penetration of systems that \nemploy simple source address security, in which packets from specific trusted \ninternal \nhosts \nare \naccepted. The countermeasure \nis \nto \ndiscard \npackets \nwith \nan \ninside source address if the packet arrives on an external interface. In fact, this \ncountermeasure is often implemented at the router external to the firewall. \n\u2022  Source routing attacks: The source station specifies the route that a packet \nshould take as it crosses the Internet, in the hopes that this will bypass security measures \nthat \ndo \nnot \nanalyze \nthe \nsource \nrouting \ninformation. \nThe \ncounter- \nmeasure is to discard all packets that use this option. \n\u2022  Tiny fragment attacks: The intruder uses the IP fragmentation option to create \nextremely small fragments and force the TCP header information into a separate packet f\nragment. This attack is designed to circumvent filtering rules that depend on TCP header \ninformation. Typically, a \npacket \nfilter \nwill \nmake \na \nfil- \ntering decision on the first fragment of a packet. All subsequent fragments of that packet \nare filtered out solely on the basis that they are part of the packet \nwhose first fragment was rejected.  \n3.7.2.2 Stateful Inspection Firewalls \nA traditional packet filter makes filtering decisions on an individual packet basis and does \nnot take into consideration any higher layer context. To understand what is meant by \ncontext and why a traditional packet filter is limited with regard to context, a little \nbackground is needed. Most standardized applications that run on top of TCP follow a \nclient/server model. For example, for the Simple Mail Transfer Protocol (SMTP), e-mail \nis transmitted from a client system to a server system.  \nA simple packet-filtering firewall must permit inbound network traffic on all these high-\nnumbered ports for TCP-based traffic to occur. This creates a vulnerability that can be \nexploited by unauthorized users.  \nA stateful inspection packet filter tightens up the rules for TCP traffic by creating a \ndirectory of outbound TCP connections, as shown in Table 3.3. There is an entry for each \ncurrently established connection. The packet filter will now allow incoming traffic to \nhigh-numbered ports only for those packets that fit the profile of one of the entries in this \ndirectory", "chunk_id": "ae4436fb-7228-4ea7-b74b-8b7f8ac5d2fb", "chroma:document": "ragment. This attack is designed to circumvent filtering rules that depend on TCP header \ninformation. Typically, a \npacket \nfilter \nwill \nmake \na \nfil- \ntering decision on the first fragment of a packet. All subsequent fragments of that packet \nare filtered out solely on the basis that they are part of the packet \nwhose first fragment was rejected."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 85607012-0e2d-4919-85cf-985e85300fce
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 122, "full_page_content": "123 \n \n\u2022  Packet filter firewalls are generally vulnerable to attacks and exploits that take \nadvantage of problems \nwithin the TCP/IP \nspecification and protocol stack, \nsuch as network layer address \nspoofing. \nMany \npacket \nfilter firewalls cannot detect a network packet in which the OSI Layer 3 addressing infor\nma- \ntion has been altered. Spoofing attacks are generally employed by intruders to \nbypass the security controls implemented in a firewall platform. \nSome of the attacks that can be made on packet filtering firewalls and the appropriate \ncountermeasures are the following: \n \u2022  IP address spoofing: The intruder transmits packets from the outside with a \nsource IP address field containing an address of an internal host. The attacker \nhopes that the use of a spoofed address will allow penetration of systems that \nemploy simple source address security, in which packets from specific trusted \ninternal \nhosts \nare \naccepted. The countermeasure \nis \nto \ndiscard \npackets \nwith \nan \ninside source address if the packet arrives on an external interface. In fact, this \ncountermeasure is often implemented at the router external to the firewall. \n\u2022  Source routing attacks: The source station specifies the route that a packet \nshould take as it crosses the Internet, in the hopes that this will bypass security measures \nthat \ndo \nnot \nanalyze \nthe \nsource \nrouting \ninformation. \nThe \ncounter- \nmeasure is to discard all packets that use this option. \n\u2022  Tiny fragment attacks: The intruder uses the IP fragmentation option to create \nextremely small fragments and force the TCP header information into a separate packet f\nragment. This attack is designed to circumvent filtering rules that depend on TCP header \ninformation. Typically, a \npacket \nfilter \nwill \nmake \na \nfil- \ntering decision on the first fragment of a packet. All subsequent fragments of that packet \nare filtered out solely on the basis that they are part of the packet \nwhose first fragment was rejected.  \n3.7.2.2 Stateful Inspection Firewalls \nA traditional packet filter makes filtering decisions on an individual packet basis and does \nnot take into consideration any higher layer context. To understand what is meant by \ncontext and why a traditional packet filter is limited with regard to context, a little \nbackground is needed. Most standardized applications that run on top of TCP follow a \nclient/server model. For example, for the Simple Mail Transfer Protocol (SMTP), e-mail \nis transmitted from a client system to a server system.  \nA simple packet-filtering firewall must permit inbound network traffic on all these high-\nnumbered ports for TCP-based traffic to occur. This creates a vulnerability that can be \nexploited by unauthorized users.  \nA stateful inspection packet filter tightens up the rules for TCP traffic by creating a \ndirectory of outbound TCP connections, as shown in Table 3.3. There is an entry for each \ncurrently established connection. The packet filter will now allow incoming traffic to \nhigh-numbered ports only for those packets that fit the profile of one of the entries in this \ndirectory", "chunk_id": "c66ad83e-e8c2-4a8f-acd5-315fb493e939", "chroma:document": "3.7.2.2 Stateful Inspection Firewalls \nA traditional packet filter makes filtering decisions on an individual packet basis and does \nnot take into consideration any higher layer context. To understand what is meant by \ncontext and why a traditional packet filter is limited with regard to context, a little"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 9a51343b-aef0-4a36-94b2-a2280c7b9b02
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 122, "full_page_content": "123 \n \n\u2022  Packet filter firewalls are generally vulnerable to attacks and exploits that take \nadvantage of problems \nwithin the TCP/IP \nspecification and protocol stack, \nsuch as network layer address \nspoofing. \nMany \npacket \nfilter firewalls cannot detect a network packet in which the OSI Layer 3 addressing infor\nma- \ntion has been altered. Spoofing attacks are generally employed by intruders to \nbypass the security controls implemented in a firewall platform. \nSome of the attacks that can be made on packet filtering firewalls and the appropriate \ncountermeasures are the following: \n \u2022  IP address spoofing: The intruder transmits packets from the outside with a \nsource IP address field containing an address of an internal host. The attacker \nhopes that the use of a spoofed address will allow penetration of systems that \nemploy simple source address security, in which packets from specific trusted \ninternal \nhosts \nare \naccepted. The countermeasure \nis \nto \ndiscard \npackets \nwith \nan \ninside source address if the packet arrives on an external interface. In fact, this \ncountermeasure is often implemented at the router external to the firewall. \n\u2022  Source routing attacks: The source station specifies the route that a packet \nshould take as it crosses the Internet, in the hopes that this will bypass security measures \nthat \ndo \nnot \nanalyze \nthe \nsource \nrouting \ninformation. \nThe \ncounter- \nmeasure is to discard all packets that use this option. \n\u2022  Tiny fragment attacks: The intruder uses the IP fragmentation option to create \nextremely small fragments and force the TCP header information into a separate packet f\nragment. This attack is designed to circumvent filtering rules that depend on TCP header \ninformation. Typically, a \npacket \nfilter \nwill \nmake \na \nfil- \ntering decision on the first fragment of a packet. All subsequent fragments of that packet \nare filtered out solely on the basis that they are part of the packet \nwhose first fragment was rejected.  \n3.7.2.2 Stateful Inspection Firewalls \nA traditional packet filter makes filtering decisions on an individual packet basis and does \nnot take into consideration any higher layer context. To understand what is meant by \ncontext and why a traditional packet filter is limited with regard to context, a little \nbackground is needed. Most standardized applications that run on top of TCP follow a \nclient/server model. For example, for the Simple Mail Transfer Protocol (SMTP), e-mail \nis transmitted from a client system to a server system.  \nA simple packet-filtering firewall must permit inbound network traffic on all these high-\nnumbered ports for TCP-based traffic to occur. This creates a vulnerability that can be \nexploited by unauthorized users.  \nA stateful inspection packet filter tightens up the rules for TCP traffic by creating a \ndirectory of outbound TCP connections, as shown in Table 3.3. There is an entry for each \ncurrently established connection. The packet filter will now allow incoming traffic to \nhigh-numbered ports only for those packets that fit the profile of one of the entries in this \ndirectory", "chunk_id": "0770b378-16c3-4e50-865b-097cf592ff03", "chroma:document": "background is needed. Most standardized applications that run on top of TCP follow a \nclient/server model. For example, for the Simple Mail Transfer Protocol (SMTP), e-mail \nis transmitted from a client system to a server system.  \nA simple packet-filtering firewall must permit inbound network traffic on all these high-"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: e281bb8b-4606-4e93-9851-f20b7931bb49
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 122, "full_page_content": "123 \n \n\u2022  Packet filter firewalls are generally vulnerable to attacks and exploits that take \nadvantage of problems \nwithin the TCP/IP \nspecification and protocol stack, \nsuch as network layer address \nspoofing. \nMany \npacket \nfilter firewalls cannot detect a network packet in which the OSI Layer 3 addressing infor\nma- \ntion has been altered. Spoofing attacks are generally employed by intruders to \nbypass the security controls implemented in a firewall platform. \nSome of the attacks that can be made on packet filtering firewalls and the appropriate \ncountermeasures are the following: \n \u2022  IP address spoofing: The intruder transmits packets from the outside with a \nsource IP address field containing an address of an internal host. The attacker \nhopes that the use of a spoofed address will allow penetration of systems that \nemploy simple source address security, in which packets from specific trusted \ninternal \nhosts \nare \naccepted. The countermeasure \nis \nto \ndiscard \npackets \nwith \nan \ninside source address if the packet arrives on an external interface. In fact, this \ncountermeasure is often implemented at the router external to the firewall. \n\u2022  Source routing attacks: The source station specifies the route that a packet \nshould take as it crosses the Internet, in the hopes that this will bypass security measures \nthat \ndo \nnot \nanalyze \nthe \nsource \nrouting \ninformation. \nThe \ncounter- \nmeasure is to discard all packets that use this option. \n\u2022  Tiny fragment attacks: The intruder uses the IP fragmentation option to create \nextremely small fragments and force the TCP header information into a separate packet f\nragment. This attack is designed to circumvent filtering rules that depend on TCP header \ninformation. Typically, a \npacket \nfilter \nwill \nmake \na \nfil- \ntering decision on the first fragment of a packet. All subsequent fragments of that packet \nare filtered out solely on the basis that they are part of the packet \nwhose first fragment was rejected.  \n3.7.2.2 Stateful Inspection Firewalls \nA traditional packet filter makes filtering decisions on an individual packet basis and does \nnot take into consideration any higher layer context. To understand what is meant by \ncontext and why a traditional packet filter is limited with regard to context, a little \nbackground is needed. Most standardized applications that run on top of TCP follow a \nclient/server model. For example, for the Simple Mail Transfer Protocol (SMTP), e-mail \nis transmitted from a client system to a server system.  \nA simple packet-filtering firewall must permit inbound network traffic on all these high-\nnumbered ports for TCP-based traffic to occur. This creates a vulnerability that can be \nexploited by unauthorized users.  \nA stateful inspection packet filter tightens up the rules for TCP traffic by creating a \ndirectory of outbound TCP connections, as shown in Table 3.3. There is an entry for each \ncurrently established connection. The packet filter will now allow incoming traffic to \nhigh-numbered ports only for those packets that fit the profile of one of the entries in this \ndirectory", "chunk_id": "11e77d91-4f90-46de-a280-abde2c5c314b", "chroma:document": "numbered ports for TCP-based traffic to occur. This creates a vulnerability that can be \nexploited by unauthorized users.  \nA stateful inspection packet filter tightens up the rules for TCP traffic by creating a \ndirectory of outbound TCP connections, as shown in Table 3.3. There is an entry for each"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 70cb5c23-1623-426d-b6d3-2f858451dacb
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 122, "full_page_content": "123 \n \n\u2022  Packet filter firewalls are generally vulnerable to attacks and exploits that take \nadvantage of problems \nwithin the TCP/IP \nspecification and protocol stack, \nsuch as network layer address \nspoofing. \nMany \npacket \nfilter firewalls cannot detect a network packet in which the OSI Layer 3 addressing infor\nma- \ntion has been altered. Spoofing attacks are generally employed by intruders to \nbypass the security controls implemented in a firewall platform. \nSome of the attacks that can be made on packet filtering firewalls and the appropriate \ncountermeasures are the following: \n \u2022  IP address spoofing: The intruder transmits packets from the outside with a \nsource IP address field containing an address of an internal host. The attacker \nhopes that the use of a spoofed address will allow penetration of systems that \nemploy simple source address security, in which packets from specific trusted \ninternal \nhosts \nare \naccepted. The countermeasure \nis \nto \ndiscard \npackets \nwith \nan \ninside source address if the packet arrives on an external interface. In fact, this \ncountermeasure is often implemented at the router external to the firewall. \n\u2022  Source routing attacks: The source station specifies the route that a packet \nshould take as it crosses the Internet, in the hopes that this will bypass security measures \nthat \ndo \nnot \nanalyze \nthe \nsource \nrouting \ninformation. \nThe \ncounter- \nmeasure is to discard all packets that use this option. \n\u2022  Tiny fragment attacks: The intruder uses the IP fragmentation option to create \nextremely small fragments and force the TCP header information into a separate packet f\nragment. This attack is designed to circumvent filtering rules that depend on TCP header \ninformation. Typically, a \npacket \nfilter \nwill \nmake \na \nfil- \ntering decision on the first fragment of a packet. All subsequent fragments of that packet \nare filtered out solely on the basis that they are part of the packet \nwhose first fragment was rejected.  \n3.7.2.2 Stateful Inspection Firewalls \nA traditional packet filter makes filtering decisions on an individual packet basis and does \nnot take into consideration any higher layer context. To understand what is meant by \ncontext and why a traditional packet filter is limited with regard to context, a little \nbackground is needed. Most standardized applications that run on top of TCP follow a \nclient/server model. For example, for the Simple Mail Transfer Protocol (SMTP), e-mail \nis transmitted from a client system to a server system.  \nA simple packet-filtering firewall must permit inbound network traffic on all these high-\nnumbered ports for TCP-based traffic to occur. This creates a vulnerability that can be \nexploited by unauthorized users.  \nA stateful inspection packet filter tightens up the rules for TCP traffic by creating a \ndirectory of outbound TCP connections, as shown in Table 3.3. There is an entry for each \ncurrently established connection. The packet filter will now allow incoming traffic to \nhigh-numbered ports only for those packets that fit the profile of one of the entries in this \ndirectory", "chunk_id": "8c2a4ac0-a25d-4970-9bc5-2a01c97f7464", "chroma:document": "currently established connection. The packet filter will now allow incoming traffic to \nhigh-numbered ports only for those packets that fit the profile of one of the entries in this \ndirectory"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 84276761-536a-4384-b0ca-b6343f19ccb2
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 123, "full_page_content": "124 \n \n \n \nTable 3.3. Example Stateful Firewall Connection State Table \nApplication-Level Gateway \nAn application-level gateway, also called a proxy server, acts as a relay of application-\nlevel traffic. \n The user contacts the gateway using a TCP/IP application, such as Telnet or FTP, and \nthe gateway asks the user for the name of the remote host to be accessed. When the user \nresponds and provides a valid user ID and authentication information, the gateway \ncontacts the application on the remote host and relays TCP segments containing the \napplication data between the two endpoints. If the gateway does not implement the proxy \ncode for a specific application, the service is not supported and cannot be forwarded \nacross the firewall. Further, the gateway can be configured to support only specific \nfeatures of an application that the network administrator considers acceptable while \ndenying all other features.  \n Application-level gateways tend to be more secure than packet filters. Rather than trying \nto deal with the numerous possible combinations that are to be allowed and forbidden at \nthe TCP and IP level, the application-level gateway need only scrutinize a few allowable \napplications. In addition, it is easy to log and audit all incoming traffic at the application \nlevel.  \nA prime disadvantage of this type of gateway is the additional processing overhead on \neach connection. In effect, there are two spliced connections between the end users, with \nthe gateway at the splice point, and the gateway must examine and forward all traffic in \nboth directions. \n3.7.2.3 Circuit-Level Gateway \nA third type of firewall is the circuit-level gateway (Figure 20.1c). This can be a \nstand-alone system or it can be a specialized function performed by an application-level \ngateway for certain applications. A circuit-level gateway does not permit an end-to-end", "chunk_id": "ce50bbee-7938-41b1-afd4-211d287fc86f", "chroma:document": "124 \n \n \n \nTable 3.3. Example Stateful Firewall Connection State Table \nApplication-Level Gateway \nAn application-level gateway, also called a proxy server, acts as a relay of application-\nlevel traffic. \n The user contacts the gateway using a TCP/IP application, such as Telnet or FTP, and \nthe gateway asks the user for the name of the remote host to be accessed. When the user"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 3e4b696f-e161-46b2-9ea8-2798134165b1
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 123, "full_page_content": "124 \n \n \n \nTable 3.3. Example Stateful Firewall Connection State Table \nApplication-Level Gateway \nAn application-level gateway, also called a proxy server, acts as a relay of application-\nlevel traffic. \n The user contacts the gateway using a TCP/IP application, such as Telnet or FTP, and \nthe gateway asks the user for the name of the remote host to be accessed. When the user \nresponds and provides a valid user ID and authentication information, the gateway \ncontacts the application on the remote host and relays TCP segments containing the \napplication data between the two endpoints. If the gateway does not implement the proxy \ncode for a specific application, the service is not supported and cannot be forwarded \nacross the firewall. Further, the gateway can be configured to support only specific \nfeatures of an application that the network administrator considers acceptable while \ndenying all other features.  \n Application-level gateways tend to be more secure than packet filters. Rather than trying \nto deal with the numerous possible combinations that are to be allowed and forbidden at \nthe TCP and IP level, the application-level gateway need only scrutinize a few allowable \napplications. In addition, it is easy to log and audit all incoming traffic at the application \nlevel.  \nA prime disadvantage of this type of gateway is the additional processing overhead on \neach connection. In effect, there are two spliced connections between the end users, with \nthe gateway at the splice point, and the gateway must examine and forward all traffic in \nboth directions. \n3.7.2.3 Circuit-Level Gateway \nA third type of firewall is the circuit-level gateway (Figure 20.1c). This can be a \nstand-alone system or it can be a specialized function performed by an application-level \ngateway for certain applications. A circuit-level gateway does not permit an end-to-end", "chunk_id": "98f921d8-58ea-453e-8aa7-fa164ad515e0", "chroma:document": "responds and provides a valid user ID and authentication information, the gateway \ncontacts the application on the remote host and relays TCP segments containing the \napplication data between the two endpoints. If the gateway does not implement the proxy \ncode for a specific application, the service is not supported and cannot be forwarded"}


