Abstract: An optical system for a multi-color, multi-emitter LED-based lighting device can include a lens array. The lens array can include a number of color-mixing rod members extending parallel to each other along an optical axis, the color-mixing rod members being arranged and spaced so that the rear end of each color-mixing rod member aligns with a different one of the emitters. A beam-forming section can be formed at the front ends of the color mixing rod members. The beam-forming section can include nonplanar (e.g., convex or concave) front surface features, each nonplanar front surface feature being aligned with a front end of a corresponding one of the color-mixing rod members. The beam-forming section and color-mixing rod members can be formed as a unitary structure.

Abstract: A bot characteristic detection method and apparatus, where the apparatus obtains a first dynamic behavior file and a second dynamic behavior file, where the first dynamic behavior file is a behavior file resulting from dynamic behavior detection performed on a malicious file in a first sandbox, and the second dynamic behavior file is a behavior file resulting from dynamic behavior detection performed on the malicious file in a second sandbox. The apparatus determines a bot characteristic of the malicious file based on a common characteristic of the first dynamic behavior file and the second dynamic behavior file.

Abstract: A method, an apparatus, and a device for detecting an electronic mail (E-mail) attack. The device receives a data flow, obtains an E-mail traffic parameter of each statistic period within a predetermined number of statistic periods, where within each statistic period, the E-mail traffic parameter of each of the statistic periods is determined according to a protocol type of the received data flow, and determines that an E-mail attack is detected when the E-mail traffic parameter of each statistic period within the predetermined number of statistic periods matches a first threshold.

Abstract: A method, an apparatus, and a device for detecting an E-mail attack. The device receives a data flow; obtains an E-mail traffic parameter of each statistic period within a predetermined number of statistic periods, where within each statistic period, the E-mail traffic parameter of each of the statistic periods is determined according to a protocol type of the received data flow; and determines that an E-mail attack is detected when the E-mail traffic parameter of each statistic period within the predetermined number of statistic periods matches a first threshold. By applying the disclosed embodiments, a detection result of the E-mail attack is more accurate.

Abstract: A method, a device, and a system for alerting against unknown malicious codes includes judging whether any suspicious code exists in the packet, recording a source path of the suspicious code and sending alert information that carries the source path to a monitoring device. The embodiments of the present disclosure report the source paths of suspicious codes proactively at the earliest possible time, which lays a foundation for shortening the time required for overcoming virus threats, and avoids the trouble of installing software on the terminal.

Abstract: An LED-based lamp can be made to have a form factor compatible with fixtures designed for MR16 lamps. Such a lamp can have a housing that provides an external electrical connection. Inside the housing is disposed a single emitter structure having a substrate with multiple light-emitting diodes (LEDs) arranged thereon. Different LEDs produce light of different colors (or color temperatures). For example, at least one LED can produce a warm white light, while at least one other LED produces a cool white light and at least one other LED produces a red light. A total-internal-reflection (TIR) lens is positioned to collect light emitted from the single emitter structure and adapted to mix the light from the LEDs to produce a uniform white light. A diffusive coating is applied to a front face of the TIR lens for further color mixing.

Abstract: A software defined networking (SDN)-based distributed denial of service (DDoS) attack prevention method, an apparatus, and a system, where a controller delivers a traffic statistics collection instruction to a first packet forwarding device. The traffic statistics collection instruction instructs the first packet forwarding device to perform traffic statistics collection, and carries a destination Internet Protocol (IP) address. The controller collects statistical data reported by the first packet forwarding device, obtains, according to the statistical data, a statistical value of global traffic flowing to the destination IP address, and delivers a DDoS prevention policy to a second packet forwarding device based on a determining result that the statistical value of the global traffic exceeds the preset threshold.

Abstract: A network security protection method and apparatus are provided. The method is executed by a network security protection device, and includes obtaining at least one of network environment data or threat detection data of a host that is in a protected network and that is connected to the network security protection device, where the network environment data includes an identifier of an operating system, a parameter of the operating system, an identifier of software with a network port access function, or a parameter of the software; and the threat detection data includes a threat type or a threat identifier, where the threat type includes a vulnerability or a malicious program; searching, according to the obtained at least one of network environment data or threat detection data, for corresponding information used to eliminate a security threat in the host; and sending the found information to the host.

Abstract: A method, a device, and a system for alerting against unknown malicious codes are disclosed. The method includes: detecting characteristics of a packet; judging whether any suspicious code exists in the packet according to a result of the detection; recording a source address of the suspicious code if the suspicious code exists in the packet; and sending alert information that carries the source address to a monitoring device. The embodiments of the present invention can report source addresses of numerous suspicious codes proactively at the earliest possible time, lay a foundation for shortening the time required for overcoming virus threats, and avoid the trouble of installing software on the client.

Abstract: A lamp includes a single emitter structure having a substrate with 25 or more light emitting diodes (LEDs) arranged thereon and a power rating of 80 Watts or more, a total internal reflection (TIR) lens with a plurality of refractive surface regions disposed on the step-shaped upper surface of the optical body, and a holder having a plurality of tabs disposed along an inside rim of the holder and configured for radial compression fit with a flange of the lens, and three or more support members configured for centering the optical body member with respect to the single emitter structure.

Abstract: A total internal reflection (TIR) lens can have a back surface tapered to provide total internal reflection of light toward the front surface. The front surface can have a stepped shape defining a cavity that extends into the lens body, with a width of the cavity increasing toward a front side of the lens. The front surface can further have a convex central surface segment that extends from the front surface within a central portion of the cavity. A peripheral cover member can be formed integrally with the lens body, with a front surface extending laterally outward from an outer edge of the front surface of the lens body and a back surface extending laterally outward from an outer edge of the back surface of the lens body.

Abstract: A method and a device for optimizing and configuring a detection rule, where the method includes: a network entity receives network traffic; extracts a packet from the network traffic, and identifies, according to a feature of the packet, protocol related information used in the network; saves the protocol related information and correspondence between pieces of information in the protocol related information to a first learning association table; and matches a corresponding rule from a vulnerability rule base according to the protocol related information to generate a first compact rule set. Through the generated compact rule set in the present invention, subsequent protocol detection is performed only for a protocol threat that may occur in a live network; therefore, content that needs to be detected subsequently is reduced, the detection efficiency is improved, and unnecessary performance consumption is avoided at the same time.

Abstract: A method and a system for identifying a file type. A modification interface may be provided so that a user inputs a file feature parameter, and the file feature parameter input by the user is added to a file type configuration file, then the file type configuration file is loaded to a state machine to perform file type identification. Therefore, the user can modify a file feature parameter in the original file type configuration file, and when a file feature parameter of a file of a certain type is changed or a file of a new type appears, the user can update a file feature parameter in the state machine in time to identify the changed file or the file of the new type. In this way, the user does not need to search for an identification tool on the Internet.

Abstract: A method, a device, and a system for alerting against unknown malicious codes are disclosed. The method includes: detecting characteristics of a packet; judging whether any suspicious code exists in the packet according to a result of the detection; recording a source path of the suspicious code if the suspicious code exists in the packet; and sending alert information that carries the source path to a monitoring device. The embodiments of the present disclosure can report source path of numerous suspicious codes proactively at the earliest possible time, lay a foundation for shortening the time required for overcoming virus threats, and avoid the trouble of installing software on the terminal.

Abstract: A data detecting method and apparatus for a firewall device connected with a network to identify security threat in the data, where the method is implemented by a fast forwarder in the firewall device and includes: the fast forwarder receives application data; obtains application information in the received application data; determines an application protocol type corresponding to the application data according to the application information and an application identifying table; queries a configuration item for threat detection according to the application protocol type to determine whether the application data requires threat detection; and if the application data does not require threat detection, forwarding the application data. The data detecting method avoids a problem that performance of a firewall is degraded because all application data is sent to a detecting processor in the firewall device for detection, thereby improving an performance of the firewall device.

Abstract: An IPS detection processing method, a network security device and a system are disclosed. The method includes: determining, by a network security device, whether an internal network device is a client or a server; if the internal network device is the client, simplifying an IPS signature rule base to obtain an IPS signature rule base corresponding to the client, or if the internal network device is the server, simplifying the IPS signature rule base to obtain an IPS signature rule base corresponding to the server; generating a state machine according to a signature rule in the IPS signature rule base obtained through simplifying processing; and performing IPS detection on flowing-through traffic by applying the state machine. In embodiments of the present invention, the network security device performs IPS detection by adopting the state machine with a redundant state removed, thereby improving IPS detection efficiency.

Abstract: A lens system includes a TIR (Total Internal Reflection) lens and a diffuser. The lens has an optical body member including an upper end, a lower end opposite the upper end, and an outer surface. The outer surface is shaped to provide total internal reflection for light from a light source. An upper surface extends in a series of steps from the upper end to a first interior portion of the optical body member. A substantially cylindrical cavity extends from the lower end to a second interior portion of the optical body member. A middle portion separates the first and second interior portions and has a flat upper surface and a curved lower surface. The diffuser has a curved shell configured for disposing over a light source and configured to fit inside the cylindrical cavity of the optical body member, the diffuser having a circular rim fused to the lower end of the optical body member.

Abstract: A method and an apparatus for filtering a uniform resource locator (URL). According to the method, a first category corresponding to a URL connection request can be found in a pre-stored category information table; when the first category conforms to a predetermined URL passing through policy, the URL connection request is allowed to pass through; the URL connection request is forwarded to a corresponding server; a second category corresponding to a URL is determined according to web page content returned by the server; if the second category conforms to the predetermined URL passing through policy, the web page content is sent to a client; if the second category does not conform to the predetermined URL passing through policy, the web page content is blocked. A category to which a URL belongs can be determined in real time, and implementing a function of accurate category filtration.

Abstract: An LED light emitter includes a single emitter structure having a substrate with a plurality of light emitting diodes (LEDs) arranged thereon, wherein the plurality of LEDs includes at least one first LED die that produces a first color light, and at least one second LED die that produces a second color light. The LED light emitter also includes a total internal reflection (TIR) lens positioned to collect light emitted from the single emitter structure and adapted to mix the light from the plurality of LEDs to produce a uniform light. The plurality of LEDs are selected such that the light output by the LED light emitter has a desired color temperature when an equal current is supplied to all of the plurality of LEDs.

Abstract: The present invention discloses a method for network attack protection, a device, and a system thereof. The method includes: receiving information about attack source, in which the information about the attack source carries address information about an attacker; obtaining address information about a gateway corresponding to the attacker according to the address information about the attacker and a preset mapping relationship between the attacker and the gateway corresponding to the attacker; and sending a first control message to the gateway corresponding to the attacker according to the address information about the gateway corresponding to the attacker, wherein the first control message instructs the gateway corresponding to the attacker to control traffic of the attacker. The present invention may be used on a communications network to prevent the attacker from attacking victim hosts on the network from the root, avoid blockage on the upstream network of the victim hosts.