Signature analysis is used to look for the telltale signs of a known attack tool.
To be robust against new attacks and prevent false positives, the coordinator also uses a variety of anomaly detection algorithms to confirm that an attack is taking place. These analyses compare observed behavior to models of acceptable network behavior to identify potential traffic anomalies or DoS attacks. Having detected an attack, Asta Networks' technology computes a concise description of the attack and communicates this information to other sensors. Each sensor filters the traffic data according to dynamic criteria provided by the coordinator and periodically returns summaries to its coordinator describing the current traffic matrix. At the same time, the coordinator also creates a picture of all the network devices that are participating in the attack, and the path it is taking through the network.