GA/T 1714-2020Information security technology - Security technology requirements for flow anomaly detection and cleaning products (English PDF)

Foreword

This standard was drafted in accordance with the rules given in GB/T 1.1-2009:

This standard was proposed by the Cyber Security Bureau of the Ministry of Public Security:

This standard is under the jurisdiction of the Information System Security Standardization Technical Committee of the Ministry of Public Security:

Drafting organizations of this standard: Computer Information System Safety Product Quality Supervision and Inspection Center of Ministry of Public Security, Third Research Institute of Ministry of Public Security, Beijing Tian Rongxin Network Security Technology Co:, Ltd:, Beijing China NSFOCUS Technology Co:, Ltd:

1 Scope

This standard specifies the safety function requirements of abnormal flow detection and cleaning products, their own safety function requirements and safety guarantee requirements, etc:

Classification requirements:

This standard applies to the design, development and testing of abnormal flow detection and cleaning products:

2 Normative references

The following documents are indispensable for the application of this document: For dated reference documents, only the dated version applies to this article Pieces: For undated references, the latest version (including all amendments) applies to this document:

GB/T 18336.3-2015 Information Technology Security Technology Information Technology Security Assessment Criteria Part 3: Security Assurance Components GB/T 25069-2010 Information Security Technical Terms

3 Terms and definitions

The following terms and definitions defined in GB/T 18336.3-2015 and GB/T 25069-2010 apply to this document:

Deepflowinspection

The network device summarizes the network traffic and generates protocol packets such as NetFlow and sFlow, and analyzes the traffic characteristics through matching to determine an identification technology of abnormal traffic based on traffic statistics:

Flowcleaning

Block abnormal traffic by cutting connections, ACL filtering, static empty route filtering, etc:, and inject normal traffic back to the network behavior:

4 Abbreviations

The following abbreviations apply to this document:

ACL: Access Control List (AccessControlList) BGP: Border Gateway Protocol (BorderGatewayProtocol) CC: Challenge Black Hole (ChalengeColapsar) DNS: Domain Name System (DomainNameSystem) DOS: Denial of Service (DenialofService) DDOS: Distributed Denial of Service (DistributedDenialofService) GRE: Generic Routing Encapsulation (GenericRoutingEncapsulation) HTTP: HyperText Transfer Protocol (HyperTextTransferProtocol) ICMP: Internet Control Message Protocol (InternetControlMessageProtocol)