Network Threat Monitor

Monitor > Network Threat

The Network Threat page displays the attack statistic information within the specified period.

Viewing Threat Monitoring Results

To view the threat monitoring results, take the following steps:

  1. To view the overview of the threat monitoring results, click the Summary tab. With the Summary tab active, you can view the following information:
  2. To view the network layer attack statistics, click Network Layer Attacks tab or click the Details link in the Network Layer Attacks table in the Summary tab. In this page, click Attack Name to show the top 10/20/30 attack names of the network layer attack; click Attacker to show the top 10/20/30 devices the sources are targeting at; click Victim to show top 10/20/30 devices the destinations are targeting at. You can also select an interface/zone from the From Interface/Zone drop-down list to show the attack ranking information in the specified interface/zone.
  3. To view the application layer attack statistics, click Application Layer Attacks tab or click the Details link in the Application Layer Attacks table in the Summary tab. In this page, click Attack Name to show the top 10/20/30 attack names of the application layer attack; click Attacker to show the top 10/20/30 devices the sources are targeting at from the application layer attack; click Victim to show top 10/20/30 devices the destinations are targeting at from the application layer attack. You can also select an interface/zone from the From Interface/Zone drop-down list to show the attack ranking information in the specified interface/zone.
  4. To view the web attack statistics, click Web Attacks tab or click the Details link in the Web Attacks table in the Summary tab. In this page, click Attack Name to show the top 10/20/30 attack names of the web attack; click Attacker to show the top 10/20/30 devices the sources are targeting at from the web attack; click Victim to show top 10/20/30 devices the destinations are targeting at from the web attack. You can also select an interface/zone from the From Interface/Zone drop-down list to show the attack ranking information in the specified interface/zone.
  5. To view the Trojan attack statistics, click Trojan tab or click the Details link in the Trojan Attacks table in the Summary tab. In this page, click Attack Name to show the top 10/20/30 attack names of the Trojan attack; click Attacker to show the top 10/20/30 devices the sources are targeting at from the Trojan attack; click Victim to show top 10/20/30 devices the destinations are targeting at from the Trojan attack. You can also select an interface/zone from the From Interface/Zone drop-down list to show the attack ranking information in the specified interface/zone.
  6. To view the malicious website statistics, click Malicious Website tab or click the Details link in the Malicious Website table in the Summary tab. In this page, click Attack Name to show the top 10/20/30 malicious website names; click Attacker to show the top 10/20/30 devices that visiting the malicious websites; click Victim to show top 10/20/30 devices that suffering from the malicious websites attacks. You can also select an interface/zone from the From Interface/Zone drop-down list to show the attack ranking information in the specified interface/zone.
  7. To view the malware software statistics, click Malware tab or click the Details link in the Malware Attacks table in the Summary tab. In this page, click Attack Name to show the top 10/20/30 malware software names; click Attacker to show the top 10/20/30 devices that downloading the malware softwares; click Victim to show top 10/20/30 devices that suffering from the malware softwares attacks. You can also select an interface/zone from the From Interface/Zone drop-down list to show the attack ranking information in the specified interface/zone.
  8. To view the ARP attack statistics, click ARP tab or click the Details link in the ARP Attacks table in the Summary tab. The page shows top 10/20/30 device MAC addresses that suffering from the ARP attacks. You can also select an interface/zone from the From Interface/Zone drop-down list to show the attack ranking information in the specified interface/zone.
  9. To view the threat map, click Threat Map tab. You can judge the attack areas based on attack source IP, so that the geographical distribution of the attack suffered in the global map is displayed. According to the threat severity the area suffering, the red flashing dot indicates a high level of threats, orange indicates a medium level, and yellow indicates a low level.

Tips: In most pages in Monitor, you can perform the following actions:

Statistical Period

The system supports the predefined time cycle and the custom time cycle. Click Latest 1 Hour ()on the top right corner of each tab to set the time cycle.

Viewing Detailed Information

Hover your mouse over the bar chart of certain monitored objects and then select Details from the pop-up menu. Then the detailed information appears in a new page for your viewing. In addition, in the detailed information page, hover your mouse over the stacked or line that represents a certain object to view the statistics of history trend and other information.

For example, in the Trojan tab, hover your mouse over the bar of Microsoft IE NULL Byte CA SSL Certificate Validation Security Bypass and then select Details in the pop-up menu. The detailed information appears. The stacked chart and the line chart display the statistics of the attack times during different time. Click the Return button to return to the Trojan tab.