Abstract: A network traffic anomaly detection method and apparatus is provided. The method includes: acquiring network flows generated by a network monitoring node within a set period of time; for any one of attributes in the network flows, aggregating the network flows at a set time interval according to the attribute to generate N time sequences with respect to the attribute; determining N samples to be detected corresponding to the network flows according to the N time sequence, calculating respective angular dissimilarity degrees between a first time sequence and N?1 second time sequences corresponding to a first attribute in the other N?1 samples to be detected, and determining a first detection result with respect to the first time sequence; and determining whether each of the samples to be detected is an abnormal data stream according to a detection result.

Abstract: A DNS evaluation method and apparatus. The method comprises: determining, according to a DNS traffic log, M domain names in a DNS system, and multiple pieces of feature dimension information about each category in pre-set categories corresponding to each of the M domain names, where M is an integer greater than or equal to 1; determining association identification information associated with each of the M domain names, wherein the association identification information comprises an IP address and/or identity information; determining, according to an association relationship between each of the M domain names and the association identification information, or attribute information about each of the M domain names, a cluster score for each category in the pre-set categories of the DNS system; and determining, according to the cluster score for each category in the pre-set categories of the DNS system, the total system score for the DNS system. Thus, the accuracy of DNS evaluation is improved.

Abstract: Disclosed are a method for extracting a feature string, a device, a network apparatus, and a storage medium. The method comprises: determining, for each candidate feature string, a transition probability for each pair of adjacent characters in the candidate feature string according to a first-order Markov transition probability matrix; detennining a transition entropy value of the candidate feature string according to the transition probability of each pair of adjacent characters and the logarithm of the transition probability; and labeling a candidate feature string having a transition entropy value greater than a pre-determined threshold as a first usable feature string, and using a valid first usable feature string as an extracted target feature string.

Abstract: A web page clustering method and device, used for clustering web pages according to a web page framework, the method including: acquiring uniform resource locators (URL) of a plurality of web pages to be clustered; for the URL of each web page to be clustered, determining rewriting rules of the URL and classifying the URL according to the rewriting rules of the URL; determining a web page framework of the web page corresponding to each URL in each URL class, and determining whether each URL may be clustered according to the web page framework of the web page corresponding to each URL; and retaining the URL class if each URL may be clustered.

Abstract: Defending a distributed denial of service attack includes intercepting a service packet sent by the client to a server, according to a rule agreed with the client, obtaining the information carried by a first preset field of the service packet, the inherent information carried by an inherent field of the service packet, and the added information carried by at least one second preset field, according to the hash algorithm agreed with the client, performing a hash processing on the inherent information and at least one added information so as to obtain a hash result, and determining the service packet is discarded when the hash result is different from the information carried by the first preset field.

Abstract: The present disclosure provides a method and devices for defending against distributed denial of service attacks. The method comprises: intercepting, by a defending device, a service message transmitted by a client to a server; obtaining, by the defending device, information carried in a first preset field of the service message and information carried in a second preset field of the service message according to a rule agreed on with the client; processing, by the defending device, the information carried in the second preset field and a preset key according to a hash algorithm agreed on with the client, and obtaining a hash value; and discarding, by the defending device, the service message upon determining that the hash value is different from the information carried in the first preset field.

Abstract: Provided are a network attack detection method and device.

Abstract: The disclosed embodiment provides a method and device for vulnerability scanning, the method comprising: a reverse scanning agent module acquires a client message; the reverse scanning agent module transmits the client message to a vulnerability scanner, enabling the vulnerability scanner to identify a vulnerability of the client according to the client message; or the reverse scanning agent module identifies the vulnerability of the client according to the client message and transmits the vulnerability to the vulnerability scanner; the reverse scanning agent module receives a control instruction from the vulnerability scanner, changes operation manner and/or mode according to the control instruction, and updates a vulnerability rule.

Abstract: Defending a distributed denial of service attack includes intercepting a service packet sent by the client to a server, according to a rule agreed with the client, obtaining the information carried by a first preset field of the service packet, the inherent information carried by an inherent field of the service packet, and the added information carried by at least one second preset field, according to the hash algorithm agreed with the client, performing a hash processing on the inherent information and at least one added information so as to obtain a hash result, and determining the service packet is discarded when the hash result is different from the information carried by the first preset field.

Abstract: Disclosed are a method and an apparatus for determining an automatic scanning action.

Abstract: Disclosed are a method and an apparatus for determining an automatic scanning action.