SCA BB - Signature Based Worm Detection

fcaldeiro · ‎04-01-2009

Hi,

I`d like to detect worms with a SCE 1010, but in the "Policies: Service Security: Signature Based Worm Detection: View Signatures" in the SCA BB Console I don't see any Worm Signature. Besides, I couldn't find any file (*.dss) in the Cisco web in order to import in the "Signatures Script" tab in the SCA-BB.

I'd like to have some directions to go ahead with this thing.

Thanks in advance.

Flavio Caldeiro.

mchin345 · ‎04-07-2009

The Signature Editor tool allows you to create and modify DSS files that can add and modify protocols and protocol signatures in the Cisco Service Control Application for Broadband (SCA BB), based on your knowledge of new network protocols that are not yet supported by SCA BB.

http://www.cisco.com/en/US/docs/cable/serv_exch/serv_control/broadband_app/rel317/scabbug/12_SCA_BB_UG.html#wp1044466

fcaldeiro · ‎04-08-2009

Thanks for the answer. I thought that Cisco provided worm signatures according to the documentation, see link below. It says that you can import the signatures files from Cisco.

"How to Add New Worm Signatures to a Service Configuration

Step 1 Either import the latest DSS or SPQI file provided by Cisco or create a DSS file containing any worm signatures that you wish to add to the service configuration."

http://www.cisco.com/en/US/docs/cable/serv_exch/serv_control/broadband_app/rel350/scabbug/10_SCA_BB_UG.html#wp1044822