Malicious Traffic Template Group

The Malicious Traffic group of report templates allows you to view statistics of the malicious events accrued in the system.

Table D-6 lists properties used only by the Malicious Traffic group of report templates.

Table D-6 Properties of Malicious Traffic Group Templates Only
Property	Field Type	Default	Comments
Traffic Parameters
IP protocol	Single Choice	(not set)	—
Filter to port	Free Text	(not set)	—
Detected IP side	Single Choice	(not set)	—

The Malicious Traffic group includes the following report templates:

Global Scan or Attack Rate—Shows the rate (session/sec) of scan/attacks originating from the hosts (typically because of a worm or zombie).

Global DoS Rate—Shows the rate (sessions/sec) of DoS attacks on the targeted host.

Top Scanning or Attacking Hosts—Shows the top hosts identified as DoS attacking.

Top DoS Attacked Hosts—Shows the top DoS-attacked hosts.

Infected Subscribers—Shows the distribution of infected subscribers over time among the different IP protocols in the system.

Infected subscribers vs Active Subscribers—Shows the distribution of infected subscribers over time, compared to all active subscribers.

DoS Attacked Subscribers—Shows the distribution of DoS-attacked subscribers over time among the different IP protocols defined in the system.

Top DoS Attacked Subscribers—Shows the top DoS-attacked subscribers.

Top Scanning or Attacking subscribers—Shows the top subscribers identified as DoS attacking.

Top Scanned or Attacked Ports—Shows the top scanned or attacked ports.