Figure 1: GenieATM + Cisco Guard Deployment and Operation

The network mangers of Jinhua Telecom can configure and operate the solution through Web GUI of the GenieATM and Cisco Guard systems. Via GenieATM’s Web UI, network managers not only can easily configure and operate the GenieATM system, but also get abundant real-time and historical analysis reports for both anomalous and normal network traffic.

The followings illustrate the usage of the GenieATM+Cisco Guard solution:

Figure 2 is a report example of GenieATM's real-time Summary of all the detected incidents happened in the past 24 hours. It allows Jinhua Telecom network managers to understand what's happening on their network. In the following example, we can see GenieATM had found several on-going anomalous activities. The network managers can click on those incidents they feel interested to get further details of the selected anomaly (see Figure 3.)

Figure 2: Real-time Summary Console

In the example in figure 3, we can see from the anomaly report that the detected anomaly is an UDP flooding attack, which lasted about 8 minutes, the severity level of the threat is Red (high), and the attacking direction is initiated from the internal network of Jinhua Telecom. The summary report also identified the attacking path and the IP addresses of the attacker and victims. Apart from the detailed anomaly reports, GenieATM also provides statistic reports of all the detected anomalies (see Figure 4.) The statistics can provide network managers the overall understanding of their own network security.

Figure 3: Detail Anomaly Report

Figure 4: Anomaly Events Statistic Report

In addition to the real-time anomaly detection reports, Jinhua Telecom network managers also use GenieATM to mitigate suspicious anomaly traffic automatically. GenieATM can be configured to trigger Cisco Guard automatically and to divert the detected anomalous traffic to Cisco Guard. After Cisco Guard cleans malicious traffic, the legitimate traffic will be redirected back to their original destinations without impacts.
GenieATM system provides logs of all the anomaly mitigation processes (see Figure 5.) This allows network managers to understand all the anomaly mitigation activity details of a detected anomaly, such as the ID of the detected anomaly, the victim IP address(es), the traffic cleaning device, the legitimate traffic volume in the incident, the malicious traffic volume, the time the incident was detected and also the current status of the incident. A network manager can click on the incident he's interested in to get further detailed information of a specific mitigation activity (see Figure 6.)

Figure 5: Anomaly Mitigation Summary Report

Figure 6: Anomaly Mitigation Report

In the example of Figure 6, we can see there is a detected anomaly which has 1.26Gbps total traffic volume. After diverting the suspicious traffic to the Cisco Guard, the malicious traffic (about 97% of the suspicious traffic) is blocked, and the benign traffic (3% of the suspicious traffic) is redirected back to its original targets. Through the complete anomaly detection and mitigation process of GenieATM + Cisco Guard solution, the attacking traffic previously might have caused network congestion and failure will be filtered effectively, and the benign traffic will be left intact for normal service operations.