Understanding the Theory of SmartDefense

SmartDefense takes a different approach than a standard intrusion detection system (IDS). It does not attempt to counter each new attack that is discovered ; instead, it protects your network against entire classes of attacks. SmartDefense performs strict sanity checks on packet headers and protocol data to prevent any malformed information getting into your network.

For example, instead of watching for an extensive list of attacks that can be used against DNS servers, SmartDefense will check DNS packets for compliance with the RFC standard for DNS packets. This behavior can protect against a large number of current and future exploits, without the need for continual signature updates. This method, of course, will not protect against every available attack, because many attacks are difficult to distinguish from valid traffic flows. Some of these checks may also be too strict and will subsequently drop valid traffic that is required for your applications to function properly, which is why you have the ability to change the sensitivity levels or even turn off the protection entirely.