Deep mining virus
-
most of the powerful zombie programs can't be found by conventional killing software; That's why so many companies are harbouring malware on their computers, but it knows nothing about it; The botnet virus prompted by the firewall is based on the server address or access parameters of the intranet computer to connect, not to scan the program on the computer; Therefore, it belongs to non detection analysis and diagnosis; Just like the traffic police who catch drinking and driving, the traffic police do not track what you drink, but check the alcohol content in your blood / breath to determine whether you drink. At present, this is an effective and reliable detection method
① identification (that is, the identification of all users, websites and application systems, and Shenxin can automatically identify the functionality of websites and software, such as entertainment, office or games)
② flow control: flow control, Now that we know what each software is doing, we can control the traffic, such as the control of P2P software, so that we can ensure the normal operation of our office
③ Management: we can restrict or prohibit a certain software or web page on the Internet, which can be specific to the traffic of a certain software
④ security: Internet behavior management can maintain the security of our client computers, which is to prevent network viruses and alert software vulnerabilities. Then is to prevent leakage, such as some QQ leakage and e-mail leakage, to prevent the loss of the company
⑤ audit: the retention of the company's employees' online records, including browsing, software, e-mail, chat records, and all other online behaviors, for future reference. And there are deep trust patents for SSL audit
Shenxin should be the Internet behavior management proct with the highest market share at present.
main parameters
device type next generation firewall
number of concurrent connections 100000
network throughput layer 3 throughput: 600mbps, layer 7 throughput: 200Mbps
network port 4 electric ports
VPN support
intrusion detection intelligence DOS, DDoS attack protection, 2500 + vulnerability feature library, 1000 + web application threat feature library, It has passed CVE compatibility certification
general parameters
single power supply, 60W
shape design 1U
applicable environment working temperature: 0-40 ℃
storage temperature: - 20-70 ℃
relative humidity: 5% - 95% (non condensing state)
other performance bypass: 1 way
traditional firewall: covering the functions of traditional firewall, including access control, NAT support, routing protocol VLAN attributes, etc.
virus protection: support stream engine based virus detection technology, check and kill HTTP, FTP, SMTP, POP3 and other protocols
Web attack protection: SQL injection, XSS cross site scripting, CSRF Cross Site Request Forgery, etc.
other functions: webpage tamper proof, sensitive information leakage proof, intelligent protection linkage, unified and centralized management
1. Don't open strangers or unknown e-mails to prevent attacks through e-mail attachments
2. Try not to click the office macro running prompt to avoid virus infection from office components
3. Download the required software from the official website, do not double-click to open. JS,. VBS and other suffix files
4. Upgrade NGAF to the latest anti-virus and other security features library
5. Upgrade the anti-virus software to the latest anti-virus library to prevent the attack of existing virus samples
6. Regularly back up important data and files in different places, and recover them in case of virus< According to the characteristics of the blackmail virus, we can judge that its variants can usually hide features, but can not hide its key behavior. After summarizing, the behavior of the blackmail virus in the process of running mainly includes the following aspects:
1. HTTP request through script file; 2
2. Download files through script files
3. Read remote server files
4. Collect computer information
5. Traverse the file
6. Call the encryption algorithm library.
Internet behavior management includes many filtering rules, including some network viruses, or traffic with virus characteristics will be filtered along with it. It does not use anti-virus software.
let's start with the conclusion: it's all the same
this question is like asking which mobile phone of Xiaomi Meizu oppo Huawei is reliable; BYD Geely Great Wall Wuling which car is reliable
no price, no scene, no demand, I can only say that they are almost the same. So we should answer this question from two aspects, and the premise is the same price
1. Hardware: first divide domestic firewall manufacturers into two camps: self-developed hardware and non self-developed hardware, or multi-core and x86; Huawei, Huasan, Depp and Shanshi have the ability of hardware research and development. The advantage is that the performance of the equipment is stable and the relative cost will be lower. This is also the reason why operators participate in centralized purchasing. The disadvantage of multi-core is that the function development is not flexible enough, and the performance of the whole machine drops seriously after the application layer function is turned on. Other manufacturers install CentOS on their x86 instrial computer and then run their own software. In essence, they are software developers. The advantages are that the proct has rich functions and friendly interface. However, in the high throughput scenario (the actual throughput is more than 20g), the stability is poor, the fast transfer mole is lacking, and the forwarding and high concurrency processing capabilities are poor. In addition, the al machine networking is only the simplest VRRP, and the switching is slow, The requirements of this scenario cannot be met. However, most enterprises, governments and schools export only a few g, so data centers and operators will use such a large throughput. The scenarios of tens of gigabytes and hundreds of gigabytes, HW H3C DP Hillstone, are all organic frame devices. The others are only owned by Tianrongxin, but the operator scenarios are rarely seen. Qiming also has new procts in recent years, with few scenarios and cases. So in terms of hardware, in the high throughput scenario, self-developed hardware manufacturers are reliable. Oh, by the way, self-developed hardware manufacturers also have many ports, represented by Huawei Huasan, A Gigabit firewall can have more than ten Gigabit interfaces, when the switch is OK
2. Software: the proct features of the non self-developed hardware manufacturers mentioned above are based on x86 architecture, which is relatively flexible. Unlike MIPS architecture, there are many compatibility problems in the underlying hardware drivers. Therefore, the functions of these manufacturers are very rich, and there are all kinds of fancy functions, In particular, deep trust is the first. But need to be clear, the essence of firewall is security protection, access control, namely state detection + threat identification
state detection is a very mature technology, and almost no new pattern is found in every country. It only adds some application layer behavior recognition, such as online behavior management, APP recognition, terminal and leakage (text) detection, etc. The most important thing is threat identification, that is, intrusion prevention system (IPS) + anti-virus (AV), which requires manufacturers to have their own identification algorithm and feature library. In recent years, unknown threat detection has become popular again.
here, I would like to add that Huawei Huasan has started the above-mentioned companies. We all know that Huawei Huasan started with digital communication, and only in recent years has it started to work on security, lacking a professional security team, Tianrongxin started out as a firewall manufacturer. Netcom was the first firewall manufacturer in China. It started out as an Internet behavior management company, and then merged with netgod. Now it's called Qianxin. Deeply convinced is the Internet behavior management + VPN, so you see, these are not professional engaged in security background. Qiming star and Lvmeng are the security start-ups of domestic security manufacturers. At first, Qiming sold intrusion detection, a proct that ate feature library, and had its own special attack and defense team. In the early days, Lvmeng was the hacker group of Green Corps. (Lvmeng was a fun start-up, but I'll talk about it again when I have time). At first, its proct was vulnerability scanning, which also ate feature library, and had its own professional attack and defense team, So if you want to spell the feature library, the title of these companies are half the weight, but the feature library can only defend against known threats, that is to say, the first attack, extracting features, can be added to the feature library, then the feature library more or less
deeply convinced that the next generation firewall NGAF has three most significant features
First: complete application layer security defense
deeply convinced that NGAF can provide complete application layer security defense functions, including mainstream web attacks, vulnerability attacks and other types of application layer attacks, eliminating the weakness of user network in application layer security protection
Second: unique two-way content detection
deeply convinced that NGAF can not only detect whether there are attacks in the external and internal traffic, but also conct in-depth content security detection on the external traffic of servers and terminals. Including whether there is the risk of information leakage in the data sent out, whether malicious traffic is sent out after the terminal is poisoned, and whether there is information that can be used by hackers in the information returned by the normal server
Third: intelligent security defense system
deeply convinced that NGAF not only meets the Gartner definition of tightly integrated intrusion prevention, but also has its own characteristics in intelligence. At present, it includes two aspects:
1. Automatic modeling technology, which adopts the form of automatic learning and automatic generation of white list to prevent unknown attacks; 2
The intelligent linkage between moles includes the linkage between moles, risk assessment and strategy linkage. The linkage between moles refers to the linkage between the application layer security protection mole and the firewall access control mole, which can automatically generate access control strategies through linkage, improve the cost of hacker attacks and rece security risksin addition, we deeply believe that the risk assessment and policy linkage technology in NGAF will actively discover the security risks of the server, so as to generate targeted security policies with one click, which can simplify the operation and maintenance of users
the protection function of the next generation firewall is more professional and comprehensive than UTM
from the protection level:
the next generation firewall can provide more comprehensive L2-L7 layer attack protection, especially the application layer attack, such as Web attack, vulnerability attack, virus Trojan horse, etc, There is no short board in network security protection; The next generation firewall can not only protect the attack itself, but also check the traffic of the server or terminal, check whether the terminal has malicious traffic, and whether the server still has the problem of information leakage
in terms of Architecture:
the next generation firewall adopts a single resolution engine, and the application layer security detection mole is unified into a unified detection engine. In this way, the packets passing through the firewall do not have to go through multiple L2-L7 unpacking, which can greatly improve the detection efficiency of the next generation firewall
from the perspective of linkage:
both of them are integrated procts, and each functional mole in the next generation firewall is not separated, and can form linkage