# Mappings Between Attack Types and Defense Policies

Table 1 Mapping between attack types and defense policies
Attack Type | Attack Type Displayed on the ATIC | Defense Policy
--- | --- | ---
SYN Flood | SYN flood | error-seq source authentication
right-seq source authentication
First-packet check
SYN-ratio anomaly rate limiting based on the source IP address
ACK Flood | ACK flood | Session strict mode check
Session loose mode check
ACK first-packet check
SYN-ACK Flood | SYN-ACK Flood | Source authentication defense
TCP first-packet check
Abnormal session check
RST/FIN Flood | FIN-RST flood | Session check
TCP first-packet check
TCP Fragmentation Flood | TCP fragment flood | TCP fragment attack defense
TCP Connection Flood | TCP connection flood | New session check based on the source IP address
Concurrent session check based on the source IP address
Null connection check
Retransmission session check
SockStress check
ACK session check
SYN session check
TCP Malformed | TCP Malformed | TCP malformed packet defense
TCP Bandwidth Overflow | TCP Bandwidth Overflow | TCP bandwidth limiting
TCP Fragment Bandwidth Overflow | TCP Fragment Bandwidth Overflow | TCP fragment bandwidth limiting
UDP Flood | UDP Flood | Fingerprint defense
UDP Fragment Flood | UDP Fragment Flood | UDP fragment attack defense
UDP Bandwidth Overflow | UDP Bandwidth Overflow | UDP bandwidth limiting
UDP Fragment Bandwidth Overflow | UDP Fragment Bandwidth Overflow | UDP fragment bandwidth limiting
UDP Malformed | UDP Malformed | UDP malformed packet defense
ICMP Flood | ICMP Flood | ICMP rate limiting
Other Flood | Other Flood | Other defense
Other Bandwidth Overflow | Other Bandwidth Overflow | Other bandwidth limiting
DNS Query Flood | DNS Query Flood | DNS cache server TCP authentication
DNS authorization server CNAME authentication
Passive defense
DNS Reply Flood | DNS Reply flood | Reply authentication defense
Source DNS Query Flow Abnormal | Source DNS Query Flow Abnormal | DNS query packet rate limiting based on the source IP address
Source DNS Reply Flow Abnormal | Source DNS Reply Flow Abnormal | DNS reply packet rate limiting based on the source IP address
DNS Query Domain Flow Abnormal | DNS Query Domain Flow Abnormal | DNS query packet rate limiting based on the domain name
DNS Reply Domain Flow Abnormal | DNS Reply Domain Flow Abnormal | DNS reply packet rate limiting based on the domain name
DNS No Such Name | DNS No Such Name | NXDomain request detection
DNS Format Error | DNS Format Error | DNS packet validity check
DNS Size Abnormal | DNS Size Abnormal | DNS query packet length limiting
DNS reply packet length limiting
SIP Flood | SIP Flood | SIP source detection
SIP Source Rate Abnormity | SIP Source Rate Abnormity | SIP rate limiting based on the source IP address
HTTP Flood | HTTP Flood | 302 redirect
Verification code
Cookie source authentication
JavaScript redirect
HTTP first-packet check
HTTP fingerprint learning
Proxy detection
SYN packet rate limiting
ACK packet rate limiting
Large resource detection
High frequency requests detection
Single URI detection
HTTP Connection Flood | HTTP Connection Flood | HTTP slow attack detection
Abnormal connections detection
HTTPS Flood | HTTPS Flood | HTTPS source authentication defense
Large resource detection
High frequency requests detection
Fixed resource monitoring
TLS Connection Flood | TLS Connection Flood | TLS defense by checking the number of renegotiation times
TLS defense session check
Null connection detection
Single IP Bandwidth Overflow | Single IP Bandwidth Overflow | Bandwidth limiting for a single destination IP address
Zone Bandwidth Overflow | Zone Bandwidth Overflow | Zone bandwidth limiting
IP Reputation | IP Reputation | IP reputation
Host Traffic Over Flow | Host Traffic Over Flow | Second-level blackhole
Malicious Domains Attack | Malicious Domains Attack | Domain audit
Location Attack | Location Attack | Location policy
Filter Attack | Filter Attack | Filter
Blacklist | Blacklist | Blacklist
Global TCP Abnormal | Global TCP Abnormal | TCP blocking
TCP new session rate limiting
Global TCP Fragment Abnormal | Global TCP Abnormal | TCP fragment blocking
Global UDP Abnormal | Global UDP Abnormal | UDP blocking
UDP new session rate limiting
Global Other Abnormal | Global Other Abnormal | Other blocking
Other new session rate limiting

Parent topic: Report

Copyright © Huawei Technologies Co., Ltd.