Huawei Technologies Co., Limited

Hon Hai Precision Industry Co., Ltd.

Hong-fu Jin Precision Industry (shenzhen) Co., Ltd.

Chengdu Huawei Symantec Technologies Co., Ltd.

Huawei Digital Technologies (cheng Du) Co., Ltd.

Huawei Digital Technologies Co., Ltd.

Wu Jiang

Tao Wang

Qiang Li

Yong-Zhao Huang

Yun Li

Shiguang Li

Zhihui Xue

Yong-Xing You

Xingshui Dong

Linghong Ruan

Shiguang Wan

Cheng-Chung Lin

Zhenhui Wang

Jianwei Yu

Yu Huai

A network security protection method includes receiving a first data flow, where the first data flow includes a source Internet Protocol (IP) address and a destination IP address, where the source IP address is an IP address of a first electronic device, and where the destination IP address is an IP address of a first server, determining first device attribute information corresponding to the source IP address, determining second device attribute information corresponding to the destination IP address, and forwarding the first data flow when the first device attribute information matches the second device attribute information or blocking the first data flow when the first device attribute information does not match the second device attribute information.

Network security protection method and protection device

This application discloses a network service processing method, a network service processing system, and a gateway device, to alleviate a problem that the gateway device cannot meet increasing additional function requirements. The gateway device identifies a type of a first intranet device, where the first intranet device belongs to an intranet connected to the gateway device. The gateway device obtains a first software package based on the type of the first intranet device, where the first software package is used to implement a first additional function. The gateway device sends a first indication message and the first software package to the first intranet device, where the first indication message is used to indicate the first intranet device to install the first software package and execute the first additional function.

Network service processing method, system, and gateway device

A webshell detection method and apparatus are provided. The apparatus obtains first web traffic of a protected host; generates a web page visit record of the protected host based on the first web traffic, where the web page visit record is used to save at least one uniform resource locator (URL), an IP address visiting each URL, and a total quantity of visits to each URL; determines a suspicious URL from the at least one URL based on the web page visit record, where a total quantity of visits to the suspicious URL is less than a first threshold, and a ratio of a quantity of different IP addresses visiting the suspicious URL to the total quantity of visits to the suspicious URL is less than a second threshold; and determines whether a web page identified by the suspicious URL contains a webshell signature.

Webshell detection method and apparatus

A software defined networking (SDN)-based distributed denial of service (DDoS) attack prevention method, an apparatus, and a system, where a controller delivers a traffic statistics collection instruction to a first packet forwarding device. The traffic statistics collection instruction instructs the first packet forwarding device to perform traffic statistics collection, and carries a destination Internet Protocol (IP) address. The controller collects statistical data reported by the first packet forwarding device, obtains, according to the statistical data, a statistical value of global traffic flowing to the destination IP address, and delivers a DDoS prevention policy to a second packet forwarding device based on a determining result that the statistical value of the global traffic exceeds the preset threshold. Correspondingly, the second packet forwarding device receives the DDoS prevention policy from the controller, and performs, according to the DDoS prevention policy, prevention process on the traffic flowing to the destination IP address.

SDN-based DDoS attack prevention method, apparatus, and system

A bot characteristic detection method and apparatus, where the apparatus obtains a first dynamic behavior file and a second dynamic behavior file, where the first dynamic behavior file is a behavior file resulting from dynamic behavior detection performed on a malicious file in a first sandbox, and the second dynamic behavior file is a behavior file resulting from dynamic behavior detection performed on the malicious file in a second sandbox. The apparatus determines a bot characteristic of the malicious file based on a common characteristic of the first dynamic behavior file and the second dynamic behavior file.

Bot characteristic detection method and apparatus

A network security protection method is executed by a network security protection device and includes obtaining at least one of network environment data or threat detection data of a host that is in a protected network and that is connected to the network security protection device, where the network environment data includes an identifier of an operating system, a parameter of the operating system, an identifier of software with a network port access function, or a parameter of the software; and the threat detection data includes a threat type or a threat identifier, where the threat type includes a vulnerability or a malicious program; searching, according to the obtained at least one of network environment data or threat detection data, for corresponding information used to eliminate a security threat in the host; and sending the found information to the host.

Network security protection method and apparatus

A method, an apparatus, and a device for detecting an electronic mail (E-mail) attack. The device receives a data flow, obtains an E-mail traffic parameter of each statistic period within a predetermined number of statistic periods, where within each statistic period, the E-mail traffic parameter of each of the statistic periods is determined according to a protocol type of the received data flow, and determines that an E-mail attack is detected when the E-mail traffic parameter of each statistic period within the predetermined number of statistic periods matches a first threshold.

Method, apparatus, and device for detecting e-mail attack

SDN-based DDOS attack prevention method, apparatus, and system

A method, an apparatus, and a device for detecting an E-mail attack. The device receives a data flow; obtains an E-mail traffic parameter of each statistic period within a predetermined number of statistic periods, where within each statistic period, the E-mail traffic parameter of each of the statistic periods is determined according to a protocol type of the received data flow; and determines that an E-mail attack is detected when the E-mail traffic parameter of each statistic period within the predetermined number of statistic periods matches a first threshold. By applying the disclosed embodiments, a detection result of the E-mail attack is more accurate.

A method, a device, and a system for alerting against unknown malicious codes includes judging whether any suspicious code exists in the packet, recording a source path of the suspicious code and sending alert information that carries the source path to a monitoring device. The embodiments of the present disclosure report the source paths of suspicious codes proactively at the earliest possible time, which lays a foundation for shortening the time required for overcoming virus threats, and avoids the trouble of installing software on the terminal.

Method, device and system for alerting against unknown malicious codes within a network environment

A method, a device, and a system for alerting against unknown malicious codes are disclosed. The method includes: detecting characteristics of a packet; judging whether any suspicious code exists in the packet according to a result of the detection; recording a source address of the suspicious code if the suspicious code exists in the packet; and sending alert information that carries the source address to a monitoring device. The embodiments of the present invention can report source addresses of numerous suspicious codes proactively at the earliest possible time, lay a foundation for shortening the time required for overcoming virus threats, and avoid the trouble of installing software on the client.

Method, device and system for alerting against unknown malicious codes

A method and a device for optimizing and configuring a detection rule, where the method includes: a network entity receives network traffic; extracts a packet from the network traffic, and identifies, according to a feature of the packet, protocol related information used in the network; saves the protocol related information and correspondence between pieces of information in the protocol related information to a first learning association table; and matches a corresponding rule from a vulnerability rule base according to the protocol related information to generate a first compact rule set. Through the generated compact rule set in the present invention, subsequent protocol detection is performed only for a protocol threat that may occur in a live network; therefore, content that needs to be detected subsequently is reduced, the detection efficiency is improved, and unnecessary performance consumption is avoided at the same time.

Method and device for optimizing and configuring detection rule

A method and a system for identifying a file type. A modification interface may be provided so that a user inputs a file feature parameter, and the file feature parameter input by the user is added to a file type configuration file, then the file type configuration file is loaded to a state machine to perform file type identification. Therefore, the user can modify a file feature parameter in the original file type configuration file, and when a file feature parameter of a file of a certain type is changed or a file of a new type appears, the user can update a file feature parameter in the state machine in time to identify the changed file or the file of the new type. In this way, the user does not need to search for an identification tool on the Internet.

Growing community of inventors

Beijing, China

Wu Jiang