Configuring Radware DefensePro for Ransomware Traffic Detection

Ransomware defense begins with identifying the traffic patterns that precede encryption, data theft, and operational disruption. Radware DefensePro can contribute to that effort by inspecting network flows, applying attack signatures, detecting abnormal behavior, and enforcing mitigation policies close to the point of entry.

DefensePro is primarily a network and application-layer attack mitigation platform rather than a replacement for endpoint detection and response. Its value is greatest when it is integrated with firewalls, identity systems, DNS security, EDR, SIEM, and incident response workflows. The appliance can detect suspicious communication and contain traffic while endpoint tools investigate the host.

The exact menu names and available controls depend on the DefensePro software release, deployment mode, licenses, and whether management is performed through APSolute Vision or DefenseFlow. Treat the following process as an operational baseline, then map it to the interface used in your environment.

Establish The Inspection Path

First, confirm how traffic reaches DefensePro. In inline mode, the appliance can block malicious sessions directly. In out-of-path or hybrid deployments, traffic may be redirected through DefensePro using a network diversion mechanism when an event occurs. The design determines how quickly a ransomware-related policy can move from detection to enforcement.

Document the protected services, transit interfaces, VLANs, routing boundaries, and expected traffic volumes. Include outbound internet access, remote-access services, east-west data center traffic, and connections to cloud workloads. Ransomware activity often spreads through trusted internal paths, so monitoring only public-facing applications leaves an important visibility gap.

Verify that management access, NTP, DNS, logging, and update connectivity are working before enabling aggressive mitigation. Accurate time is particularly important when correlating DefensePro events with Windows logs, firewall records, EDR alerts, and authentication data.

Build A Baseline Before Blocking

Behavioral detection depends on a useful baseline. Observe normal traffic for representative business periods, including backups, patch windows, month-end processing, software distribution, and scheduled vulnerability scans. A sudden increase in SMB, LDAP, RDP, or outbound encrypted sessions may be suspicious in one environment and routine in another.

Create separate baselines for internet-facing applications, server networks, user VLANs, and administrative segments. A single global threshold can hide meaningful anomalies because a busy application server and a workstation have very different communication patterns. Where available, use DefensePro’s behavioral or anomaly-detection controls to model rate, connection, protocol, and destination changes.

Review historical events before enabling automatic drops. Look for repeated source addresses, unusual destination countries, connection bursts, scans across internal subnets, and traffic that persists outside normal working hours. This review reduces false positives caused by legitimate backup agents or vulnerability-management platforms.

Configure Detection And Mitigation Policies

Use a layered policy rather than one broad rule. Enable current attack signatures and maintain the relevant security feeds for the deployed DefensePro release. Signature protection can identify known exploit delivery, scanning, malformed traffic, and command-and-control patterns, while behavioral protection can detect changes that do not match a published signature.

Apply stricter controls to high-risk protocols and zones. Common ransomware-related indicators include abnormal SMB connection rates, excessive remote-service authentication attempts, rapid access to many file servers, and unusual outbound connections from systems that normally communicate only with internal services. These signals should be combined with source reputation and asset context instead of treated as proof by themselves.

Start with alerting, logging, and preferably a rate-limit or challenge response where supported. After validating the event data, move selected rules to blocking or connection termination. Configure exception objects for backup servers, vulnerability scanners, software repositories, and approved administrative jump hosts, restricting those exceptions by source, destination, service, and schedule.

Detection signal	Useful DefensePro control	Initial response	Validation source
Sudden connection burst from a workstation subnet	Behavioral anomaly and connection-rate policy	Alert, then rate-limit	NetFlow, EDR, switch telemetry
Repeated access to many SMB servers	Protocol and rate controls	Block offending source or segment	Windows events, file-server logs
Known malicious command-and-control address	Reputation or signature policy	Drop and log	DNS, proxy, threat intelligence
Abnormal outbound encrypted traffic	Flow anomaly and destination policy	Alert or restrict egress	Firewall, proxy, TLS metadata
Exploit traffic against an exposed service	Application and attack signatures	Block immediately	Web server and vulnerability logs

Tune Encrypted Traffic And Application Visibility

Ransomware operators commonly use TLS to hide command-and-control traffic and exfiltration. DefensePro can still provide useful flow-level indicators, such as connection frequency, destination changes, session duration, and traffic volume, but payload inspection is limited when encryption is not terminated.

If policy and privacy requirements permit, place inspection at an approved TLS termination point before traffic reaches protected services. Coordinate certificates, cipher policies, privacy controls, and performance capacity with the application team. Do not assume that enabling decryption on the appliance automatically provides complete ransomware identification.

For web applications, combine DefensePro application-layer protections with reverse-proxy, WAF, DNS, and endpoint telemetry. A suspicious HTTP request may be an initial access attempt, while the later encryption activity occurs over internal protocols that require separate visibility.

Connect Alerts To Incident Response

Send DefensePro security events to a centralized syslog collector or SIEM with source address, destination, service, policy name, action, timestamp, and event severity. Preserve enough detail to distinguish a blocked attack from a detected anomaly. Normalize timestamps and confirm that the collector can handle event bursts during an incident.

Use automation carefully. A high-confidence signature match or confirmed malicious reputation event may justify immediate blocking. A behavioral anomaly should usually create an investigation record, enrich the event with asset ownership and EDR status, and then trigger containment only after validation. DefenseFlow or an orchestration platform can help coordinate diversion and mitigation across multiple DefensePro devices.

When an alert fires, correlate the network event with endpoint process creation, authentication failures, file-share access, DNS requests, and unusual privilege changes. The network control can stop propagation, but the affected host still requires isolation, credential review, forensic collection, and recovery from known-good backups.

Validate The Policy Safely

Test detection in a maintenance window using approved security-testing traffic and representative load. Confirm that legitimate backups, replication, domain services, monitoring, and remote administration continue to work. Verify that a blocked event produces the expected log, alert, and SIEM record.

Measure false positives, mitigation latency, CPU and memory utilization, interface throughput, and dropped-session counts. Review the results after major application changes, network redesigns, firmware upgrades, or threat-feed updates. A policy that worked during deployment can become unsafe when traffic patterns change.

Recommended Operational Practices

• Keep DefensePro firmware, attack signatures, licenses, and reputation feeds aligned with the supported release.
• Use separate policies and thresholds for user, server, management, backup, and internet-facing network zones.
• Begin behavioral rules in detect or report mode before enabling automatic blocking.
• Send detailed events to a SIEM and correlate them with EDR, DNS, firewall, and authentication records.
• Test emergency blocking, traffic diversion, rollback, and bypass procedures during a documented exercise.

A strong DefensePro deployment treats ransomware detection as a coordinated control, not a single checkbox. Establish the traffic baseline, apply layered signatures and behavioral rules, limit trusted exceptions, and connect every meaningful event to an investigation workflow. With those controls in place, DefensePro can reduce attack traffic, slow lateral movement, and give responders valuable time to isolate systems before the incident expands.