Denial-of-service (DoS) is the category of suspicious traffic signature that George identified in the above scenario. DoS signatures are designed to detect attempts to disrupt or degrade the availability or performance of a system or network by overwhelming it with excessive or malformed traffic. SYN flood and ping of death are examples of DoS attacks that exploit the TCP/IP protocol to consume the resources or crash the target server. A SYN flood attack sends a large number of TCP SYN packets to the target server, without completing the three-way handshake, thus creating a backlog of half-open connections that exhaust the server’s memory or bandwidth. A ping of death attack sends a malformed ICMP echo request packet that exceeds the maximum size allowed by the IP protocol, thus causing the target server to crash or reboot. DoS attacks can cause serious damage to the organization’s reputation, productivity, and revenue, and should be detected and mitigated as soon as possible 1 2 3 . References :

Network Defense Essentials Courseware , EC-Council, 2020, pp. 3-33 to 3-34

What is a denial-of-service attack? , Cloudflare, 2020

Denial-of-service attack - Wikipedia , Wikipedia, March 16, 2021

SIEM stands for Security Information and Event Management. It is a security solution that collects, analyzes, and correlates data from various sources, such as logs, network devices, applications, and security tools. SIEM provides real-time monitoring, threat detection, and security incident response activities. SIEM can help security professionals identify and mitigate security risks, comply with regulations, and improve the overall security posture of the organization 1 2 . References : Network Defense Essentials - EC-Council Learning , What is SIEM? Security Information and Event Management Explained