CN104202206A - Message processing device and method - Google Patents
Message processing device and method Download PDFInfo
- Publication number
- CN104202206A CN104202206A CN201410359678.9A CN201410359678A CN104202206A CN 104202206 A CN104202206 A CN 104202206A CN 201410359678 A CN201410359678 A CN 201410359678A CN 104202206 A CN104202206 A CN 104202206A
- Authority
- CN
- China
- Prior art keywords
- message
- clear text
- business
- processing
- mark
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Landscapes
- Debugging And Monitoring (AREA)
Abstract
The invention discloses a message processing device and a method, belonging to the field of computers. The method comprises the steps of performing pattern matching on message load carried by a message to be processed and at least one service processing identity stored by a multimode state machine so as to obtain a matching result, wherein the matching result contains at least one service processing identity which is for the message to be processed; according to the at least one service processing identity which is for the message in the matching result, performing corresponding service detection on the message so as to obtain a detection result; and performing corresponding processing on the message according to the detection result. According to the embodiment of the invention, one pattern matching only needs to be performed on the load of the message to be processed and the multimode state machine, and the pattern matching does not need to be performed on each service processing, so that the message processing efficiency can be improved.
Description
Technical field
The present invention relates to computer realm, relate in particular to a kind of message process device and method.
Background technology
Gateway device is a kind of equipment with translation function, and gateway device is realized network interconnection more than network layer, is network interconnection apparatus, network interconnection, and gateway device both can interconnect for wide area network, also can be for local area network interconnection.
Gateway device, such as UTM (Unified Threat Management, security gateway), fire compartment wall of future generation, its major function is that applied business is protected, such as IPS (Intrusion Protection System, intrusion prevention system), data protection, URL (Uniform Resource Locator, URL(uniform resource locator)) filtration etc.These functions are separate, and while checking message, message passes through each functional module successively, and message load is repeatedly checked, affects message treatment effeciency.
Summary of the invention
The embodiment of the present invention provides a kind of message process device and method, can improve message treatment effeciency.
The embodiment of the present invention adopts following technical scheme:
A kind of message process device, comprising:
Matching module, carry out pattern matching for message load that clear text is carried and the mark of at least one processing business of multimode state machine storage, obtain matching result, the mark that described matching result comprises at least one Business Processing that described clear text need to carry out.
Detection module, the mark of at least one Business Processing that need to carry out for the described clear text comprising according to described matching result, carries out corresponding business detection to described clear text, obtains testing result.
Processing module, for according to described testing result, carries out corresponding processing to described clear text.
Optionally, described survey module comprises following at least one submodule:
Protocol identification submodule, for identifying the applied agreement of described clear text.
IPS submodule, for carrying out IPS detection to described clear text.
Anti-virus submodule, detects for described clear text being carried out to virus.
Document control submodule, for carrying out document control to described clear text.
Url filtering module submodule, for carrying out url filtering to described clear text.
Data protection submodule, for carrying out data protection detection to described clear text.
Optionally, above-mentioned message process device also comprises:
Logging modle, for recording described testing result.
Optionally, above-mentioned message process device also comprises:
Message recombination module, for out of order message is resequenced, obtains the message of positive sequence.
Agreement pretreatment module, processes the message of described positive sequence for the agreement by prestoring, and obtains described clear text.
Optionally, above-mentioned message process device also comprises:
Matching module, for according to the configuration information prestoring, mates checking to the message of described positive sequence, and the message of verifying by coupling is sent to described agreement pretreatment module.
Optionally, described configuration information comprise following at least one: user ID, source address, source region ID, destination address, object region, protocol type.
A kind of message processing method, comprising:
At least one of the message load that clear text is carried and the storage of multimode state machine processed the mark of business and carried out pattern matching, obtains matching result, the mark that described matching result comprises at least one Business Processing that described clear text need to carry out;
The mark of at least one Business Processing that the described message comprising according to described matching result need to carry out, carries out corresponding business detection to described message, obtains testing result;
According to described testing result, described message is carried out to corresponding processing.
Optionally, described according to described testing result, before described message is carried out to corresponding processing, also comprise:
Record described testing result.
Optionally, the mark of at least one processing business of the described message load that clear text is carried and the storage of multimode state machine also comprises before carrying out pattern matching:
Out of order message is resequenced, obtain the message of positive sequence;
By the agreement prestoring, the message of described positive sequence is processed, obtained described clear text.
Optionally, the described agreement by prestoring is processed the message of described positive sequence, obtains described clear text and comprises:
According to the configuration information prestoring, the message of described positive sequence is mated to checking, the message of verifying by coupling is processed the message of described positive sequence by the agreement prestoring, obtain described clear text.
Based on technique scheme, the message process device machine method of the embodiment of the present invention, at least one of multimode state machine storage processed the mark of business, at least one of the message load that clear text is carried and the storage of multimode state machine processed the mark of business and carried out pattern matching, obtain matching result, the mark of at least one Business Processing that the message comprising according to matching result need to carry out, message is carried out to corresponding business detection, obtain testing result, according to testing result, message is carried out to corresponding processing, the load of clear text and multimode state machine carry out pattern matching one time, process and carry out one by one pattern matching without multiple business, thereby can improve message treatment effeciency.
Brief description of the drawings
In order to be illustrated more clearly in the embodiment of the present invention or technical scheme of the prior art, to the accompanying drawing of required use in embodiment or description of the Prior Art be briefly described below, apparently, accompanying drawing in the following describes is some embodiments of the present invention, for those of ordinary skill in the art, do not paying under the prerequisite of creative work, can also obtain according to these accompanying drawings other accompanying drawing.
Fig. 1 is one of structural representation of the message process device of the embodiment of the present invention;
Fig. 2 be the message process device of the embodiment of the present invention structural representation two;
Fig. 3 is one of flow chart of the message processing method of the embodiment of the present invention;
Fig. 4 be the message processing method of the embodiment of the present invention flow chart two.
Embodiment
For making object, technical scheme and the advantage of the embodiment of the present invention clearer, below in conjunction with the accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is clearly described, obviously, described embodiment is the present invention's part embodiment, instead of whole embodiment.Based on the embodiment in the present invention, those of ordinary skill in the art, not making the every other embodiment obtaining under creative work prerequisite, belong to the scope of protection of the invention.
The embodiment of the present invention can be applied to firewall device of future generation.
As shown in Figure 1, the embodiment of the present invention provides a kind of message process device, comprising:
Matching module 11, carry out pattern matching for message load that clear text is carried and the mark of at least one processing business of multimode state machine storage, obtain matching result, the mark that described matching result comprises at least one Business Processing that described clear text need to carry out.
Concrete, this multimode state machine can be stored the mark (as character string) of each application layer business, is convenient to matching module 11 and carries out pattern matching, obtains matching result.
Detection module 12, the mark of at least one Business Processing that need to carry out for the described clear text comprising according to described matching result, carries out corresponding business detection to described clear text, obtains testing result.
Concrete, the mark location of detection module 12 Business Processing, to corresponding Business Processing submodule, carries out corresponding Business Processing.
Processing module 13, for according to described testing result, carries out corresponding processing to described clear text.
Concrete, every kind of Business Processing, to there being processing action separately, if triggered the event of each Business Processing, can directly be passed through the action of configuration, as the operation of clearance or blocking-up message.
The message process device of the embodiment of the present invention, at least one of multimode state machine storage processed the mark of business, at least one of the message load that clear text is carried and the storage of multimode state machine processed the mark of business and carried out pattern matching, obtain matching result, the mark of at least one Business Processing that the message comprising according to matching result need to carry out, message is carried out to corresponding business detection, obtain testing result, according to testing result, message is carried out to corresponding processing, the load of clear text and multimode state machine carry out pattern matching one time, process and carry out one by one pattern matching without multiple business, thereby can improve message treatment effeciency.
As shown in Figure 2, described survey module 12 comprises following at least one submodule:
Protocol identification submodule 121, for identifying the applied agreement of described clear text.
For example, identification can be passed through the message protocol of firewall box of future generation.
IPS submodule 122, for carrying out IPS detection to described clear text.
For example, detect various fragility leaks.
Anti-virus submodule 123, detects for described clear text being carried out to virus.
Concrete, can carry out virus to described clear text based on message flow and detect.
Document control submodule 124, for carrying out document control to described clear text.
Concrete, can control the file type of specifying according to user's configuration, thereby effectively to identifying through the file of fire compartment wall transmission, and to whether allowing it by effectively controlling.The embodiment of the present invention, by carrying out file type identification with the interlock of protocol identification, like this, even if the suffix name of transfer files has been modified, also can effectively be identified.
Url filtering module submodule 125, for carrying out url filtering to described clear text.
For example, the pre-configured URL white list of user and blacklist, HTTP request message is during through url filtering module submodule 125, if ask in white list, just let pass, if in blacklist, just blocking-up.For improving URL matching efficiency, the embodiment of the present invention is compiled into the url list of user configured black and white lists in multimode matching state machine, to promote throughput performance.
Data protection submodule 126, for carrying out data protection detection to described clear text.
For example, according to user's configuration, keyword is controlled, compared user configured keyword and message load, detect thereby realize data protection.For improving data protection matching efficiency, user configured keyword is compiled into multimode matching state machine by the embodiment of the present invention, to improve throughput performance.
As shown in Figure 2, the message process device of the embodiment of the present invention also comprises:
Logging modle 14, for recording described testing result.
Concrete, after detection module 12 apply and processed and detect, application layer service observation is arrived after corresponding event, and logging modle 14 records its business event, be stored in database, and with the follow-up Business Processing statistics of carrying out.
As shown in Figure 2, the message process device of the embodiment of the present invention also comprises:
Message recombination module 15, for out of order message is resequenced, obtains the message of positive sequence.
Message recombination module 15 completes the task to the rearrangement of out of order message, then the message of positive sequence is delivered to subsequent module and is continued to process, this module pattern matching is below completed across bag detect and become a reality.
Agreement pretreatment module 16, processes the message of described positive sequence for the agreement by prestoring, and obtains described clear text.
Agreement pretreatment module comprises does preliminary treatment to legacy protocol, and such as agreements such as HTTP, FTP, SMTP, SSL, these preliminary treatment are to prepare for completing follow-up application layer protection business; Such as HTTP preprocessor, it is by each territory field information such as the detailed URL, the REFERER etc. that parse HTTP header field.
As shown in Figure 2, the message process device of the embodiment of the present invention also comprises:
Matching module 17, for according to the configuration information prestoring, mates checking to the message of described positive sequence, and the message of verifying by coupling is sent to described agreement pretreatment module.
Concrete, described configuration information comprise following at least one: user ID (Identity Code), source address, source region ID, destination address, object region, protocol type.
The embodiment of the present invention is based on user, source address, source region, destination address, object region, agreement, when user configured these coupling elements are all time, carries out follow-up application layer protection business, such as IPS, AV etc.Strategy matching normally completes in the slow-speed message of session, i.e. front several messages of session, once session matches strategy, subsequent packet is just walked soon and is turned, and is not doing strategy matching, thereby improves message treatment effeciency.
It should be noted that, in the embodiment of the present invention, the numbering of modules, only for distinguishing different modules, does not limit the link order of modules.
The message process device of the embodiment of the present invention, at least one of multimode state machine storage processed the mark of business, at least one of the message load that clear text is carried and the storage of multimode state machine processed the mark of business and carried out pattern matching, obtain matching result, the mark of at least one Business Processing that the message comprising according to matching result need to carry out, message is carried out to corresponding business detection, obtain testing result, according to testing result, message is carried out to corresponding processing, the load of clear text and multimode state machine carry out pattern matching one time, process and carry out one by one pattern matching without multiple business, thereby can improve message treatment effeciency.
Corresponding with the message process device of the embodiment of the present invention, the embodiment of the present invention also provides a kind of message processing method, and as shown in Figure 3, the method comprises:
31, at least one of message load clear text being carried and the storage of multimode state machine processed the mark of business and carried out pattern matching, obtain matching result, the mark that described matching result comprises at least one Business Processing that described clear text need to carry out;
The mark of at least one Business Processing that the described message 32, comprising according to described matching result need to carry out, carries out corresponding business detection to described message, obtains testing result;
33,, according to described testing result, described message is carried out to corresponding processing.
As shown in Figure 4, described according to described testing result, before described message is carried out to corresponding processing, also comprise:
34, record described testing result.
As shown in Figure 4, the mark of at least one processing business of the described message load that clear text is carried and the storage of multimode state machine also comprises before carrying out pattern matching:
35, out of order message is resequenced, obtain the message of positive sequence;
36, by the agreement prestoring, the message of described positive sequence is processed, obtained described clear text.
Concrete, the described agreement by prestoring is processed the message of described positive sequence, obtains described clear text and comprises:
According to the configuration information prestoring, the message of described positive sequence is mated to checking, the message of verifying by coupling is processed the message of described positive sequence by the agreement prestoring, obtain described clear text.
The message processing method of the embodiment of the present invention can be realized by the message process device of the embodiment of the present invention, and the method for the embodiment of the present invention is only concise and to the point description, and implementation procedure, refers to above-mentioned message process device embodiment in detail, does not repeat herein.
The message processing method of the embodiment of the present invention, at least one of multimode state machine storage processed the mark of business, at least one of the message load that clear text is carried and the storage of multimode state machine processed the mark of business and carried out pattern matching, obtain matching result, the mark of at least one Business Processing that the message comprising according to matching result need to carry out, message is carried out to corresponding business detection, obtain testing result, according to testing result, message is carried out to corresponding processing, the load of clear text and multimode state machine carry out pattern matching one time, process and carry out one by one pattern matching without multiple business, thereby can improve message treatment effeciency.
Those skilled in the art can carry out various changes and modification and not depart from the spirit and scope of the present invention the present invention.Like this, if these amendments of the present invention and within modification belongs to the scope of the claims in the present invention and equivalent technologies thereof, the present invention is also intended to comprise these changes and modification interior.
Claims (10)
1. a message process device, is characterized in that, comprising:
Matching module, carry out pattern matching for message load that clear text is carried and the mark of at least one processing business of multimode state machine storage, obtain matching result, the mark that described matching result comprises at least one Business Processing that described clear text need to carry out;
Detection module, the mark of at least one Business Processing that need to carry out for the described clear text comprising according to described matching result, carries out corresponding business detection to described clear text, obtains testing result;
Processing module, for according to described testing result, carries out corresponding processing to described clear text.
2. device according to claim 1, is characterized in that, also comprises:
Logging modle, for recording described testing result.
3. device according to claim 1, is characterized in that, also comprises:
Message recombination module, for out of order message is resequenced, obtains the message of positive sequence;
Agreement pretreatment module, processes the message of described positive sequence for the agreement by prestoring, and obtains described clear text.
4. device according to claim 3, is characterized in that, also comprises:
Matching module, for according to the configuration information prestoring, mates checking to the message of described positive sequence, and the message of verifying by coupling is sent to described agreement pretreatment module.
5. device according to claim 4, is characterized in that, described configuration information comprise following at least one:
User Identity code ID, source address, source region ID, destination address, object region, protocol type.
6. device according to claim 1, is characterized in that, described detection module comprises following at least one submodule:
Protocol identification submodule, for identifying the applied agreement of described clear text;
IPS submodule, for carrying out IPS detection to described clear text;
Anti-virus submodule, detects for described clear text being carried out to virus;
Document control submodule, for carrying out document control to described clear text;
Uniform resource position mark URL filtering module submodule, for carrying out url filtering to described clear text;
Data protection submodule, for carrying out data protection detection to described clear text.
7. a message processing method, is characterized in that, comprising:
At least one of the message load that clear text is carried and the storage of multimode state machine processed the mark of business and carried out pattern matching, obtains matching result, the mark that described matching result comprises at least one Business Processing that described clear text need to carry out;
The mark of at least one Business Processing that the described message comprising according to described matching result need to carry out, carries out corresponding business detection to described message, obtains testing result;
According to described testing result, described message is carried out to corresponding processing.
8. method according to claim 7, is characterized in that, described according to described testing result, before described message is carried out to corresponding processing, also comprises:
Record described testing result.
9. method according to claim 7, is characterized in that, the mark of at least one processing business of the described message load that clear text is carried and the storage of multimode state machine also comprises before carrying out pattern matching:
Out of order message is resequenced, obtain the message of positive sequence;
By the agreement prestoring, the message of described positive sequence is processed, obtained described clear text.
10. method according to claim 9, is characterized in that, the described agreement by prestoring is processed the message of described positive sequence, obtains described clear text and comprises:
According to the configuration information prestoring, the message of described positive sequence is mated to checking, the message of verifying by coupling is processed the message of described positive sequence by the agreement prestoring, obtain described clear text.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410359678.9A CN104202206A (en) | 2014-07-25 | 2014-07-25 | Message processing device and method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410359678.9A CN104202206A (en) | 2014-07-25 | 2014-07-25 | Message processing device and method |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN104202206A true CN104202206A (en) | 2014-12-10 |
Family
ID=52087436
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410359678.9A Pending CN104202206A (en) | 2014-07-25 | 2014-07-25 | Message processing device and method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104202206A (en) |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104980488A (en) * | 2015-03-20 | 2015-10-14 | 深圳市腾讯计算机系统有限公司 | Message transfer method, related devices and communication system |
| CN105592053A (en) * | 2015-09-14 | 2016-05-18 | 杭州华三通信技术有限公司 | Matching method and device for matching rules |
| CN105939314A (en) * | 2015-09-21 | 2016-09-14 | 杭州迪普科技有限公司 | Network protection method and device |
| CN107579949A (en) * | 2016-07-05 | 2018-01-12 | 阿里巴巴集团控股有限公司 | Data message processing method and device |
| CN108512763A (en) * | 2018-04-16 | 2018-09-07 | 广州市品高软件股份有限公司 | A kind of tracking of flow table rule generating process |
| CN108924200A (en) * | 2018-06-21 | 2018-11-30 | 国家电网有限公司 | A kind of message processing method and device |
| CN112448924A (en) * | 2019-08-30 | 2021-03-05 | 北京东土科技股份有限公司 | Message processing method, system and switching equipment compatible with multiple protocols |
| CN114422207A (en) * | 2021-12-30 | 2022-04-29 | 中国人民解放军战略支援部队信息工程大学 | Multi-mode-based C & C communication flow detection method and device |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6766368B1 (en) * | 2000-05-23 | 2004-07-20 | Verizon Laboratories Inc. | System and method for providing an internet-based correlation service |
| CN101009660A (en) * | 2007-01-19 | 2007-08-01 | 杭州华为三康技术有限公司 | Universal method and device for processing the match of the segmented message mode |
| CN101641912A (en) * | 2007-03-12 | 2010-02-03 | 艾利森电话股份有限公司 | Applying policies for managing a service flow |
| CN101764721A (en) * | 2009-12-15 | 2010-06-30 | 中兴通讯股份有限公司 | Detection method and network manager |
| CN103688489A (en) * | 2012-12-03 | 2014-03-26 | 华为技术有限公司 | Method for strategy processing and network equipment |
| CN103746996A (en) * | 2014-01-03 | 2014-04-23 | 汉柏科技有限公司 | Packet filtering method for firewall |
-
2014
- 2014-07-25 CN CN201410359678.9A patent/CN104202206A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6766368B1 (en) * | 2000-05-23 | 2004-07-20 | Verizon Laboratories Inc. | System and method for providing an internet-based correlation service |
| CN101009660A (en) * | 2007-01-19 | 2007-08-01 | 杭州华为三康技术有限公司 | Universal method and device for processing the match of the segmented message mode |
| CN101641912A (en) * | 2007-03-12 | 2010-02-03 | 艾利森电话股份有限公司 | Applying policies for managing a service flow |
| CN101764721A (en) * | 2009-12-15 | 2010-06-30 | 中兴通讯股份有限公司 | Detection method and network manager |
| CN103688489A (en) * | 2012-12-03 | 2014-03-26 | 华为技术有限公司 | Method for strategy processing and network equipment |
| CN103746996A (en) * | 2014-01-03 | 2014-04-23 | 汉柏科技有限公司 | Packet filtering method for firewall |
Cited By (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104980488A (en) * | 2015-03-20 | 2015-10-14 | 深圳市腾讯计算机系统有限公司 | Message transfer method, related devices and communication system |
| CN104980488B (en) * | 2015-03-20 | 2019-01-29 | 深圳市腾讯计算机系统有限公司 | Message transmitting method and relevant apparatus and communication system |
| CN105592053A (en) * | 2015-09-14 | 2016-05-18 | 杭州华三通信技术有限公司 | Matching method and device for matching rules |
| CN105592053B (en) * | 2015-09-14 | 2018-11-27 | 新华三技术有限公司 | A kind of matching process and device of matching rule |
| CN105939314A (en) * | 2015-09-21 | 2016-09-14 | 杭州迪普科技有限公司 | Network protection method and device |
| CN107579949B (en) * | 2016-07-05 | 2021-05-28 | 阿里巴巴集团控股有限公司 | Data message processing method and device |
| CN107579949A (en) * | 2016-07-05 | 2018-01-12 | 阿里巴巴集团控股有限公司 | Data message processing method and device |
| CN108512763A (en) * | 2018-04-16 | 2018-09-07 | 广州市品高软件股份有限公司 | A kind of tracking of flow table rule generating process |
| CN108512763B (en) * | 2018-04-16 | 2019-03-29 | 广州市品高软件股份有限公司 | A kind of tracking of flow table rule generating process |
| CN108924200A (en) * | 2018-06-21 | 2018-11-30 | 国家电网有限公司 | A kind of message processing method and device |
| CN108924200B (en) * | 2018-06-21 | 2021-11-23 | 国家电网有限公司 | Message processing method and device |
| CN112448924A (en) * | 2019-08-30 | 2021-03-05 | 北京东土科技股份有限公司 | Message processing method, system and switching equipment compatible with multiple protocols |
| CN114422207A (en) * | 2021-12-30 | 2022-04-29 | 中国人民解放军战略支援部队信息工程大学 | Multi-mode-based C & C communication flow detection method and device |
| CN114422207B (en) * | 2021-12-30 | 2023-06-02 | 中国人民解放军战略支援部队信息工程大学 | C & C communication flow detection method and device based on multiple modes |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Lee et al. | Security and privacy challenges in the internet of things [security and privacy matters] | |
| CN104202206A (en) | Message processing device and method | |
| US11399288B2 (en) | Method for HTTP-based access point fingerprint and classification using machine learning | |
| CN113228585B (en) | Network security system with feedback loop based enhanced traffic analysis | |
| EP3111330B1 (en) | System and method for verifying and detecting malware | |
| US8756697B2 (en) | Systems and methods for determining vulnerability to session stealing | |
| Shetu et al. | A survey of botnet in cyber security | |
| US20150350161A1 (en) | Network Traffic Analysis to Enhance Rule-Based Network Security | |
| US9338657B2 (en) | System and method for correlating security events with subscriber information in a mobile network environment | |
| CN102404326B (en) | Method, system and device for validating safety of messages | |
| US20170104722A1 (en) | Context sharing between endpoint device and network security device using in-band communications | |
| CN113518042B (en) | Data processing method, device, equipment and storage medium | |
| CN106815511A (en) | Information processor and method | |
| CN111901317B (en) | Access control policy processing method, system and equipment | |
| CN111865996A (en) | Data detection method and device and electronic equipment | |
| CN111182537A (en) | Network access method, device and system for mobile application | |
| KR20120072120A (en) | Method and apparatus for diagnosis of malicious file, method and apparatus for monitoring malicious file | |
| CN101741745B (en) | Method and system for identifying application traffic of peer-to-peer network | |
| CN104067558A (en) | Network access apparatus having a control module and a network access module | |
| CN112788065B (en) | Internet of things zombie network tracking method and device based on honeypots and sandboxes | |
| CN102045310A (en) | Industrial Internet intrusion detection as well as defense method and device | |
| CN109302420A (en) | Network data security transmission method, system and electronic equipment | |
| CN105049437A (en) | Method for filtering network application layer data | |
| CN111079144B (en) | Virus propagation behavior detection method and device | |
| CN110581843B (en) | Mimic Web gateway multi-application flow directional distribution method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination |