MindMap Gallery NGFW Next Generation Firewall-Function Planning
This is a mind map about NGFW next-generation firewall-functional planning, which summarizes the capabilities of visibility, governance, presentation, etc.
Edited at 2024-01-22 21:36:37This Valentine's Day brand marketing handbook provides businesses with five practical models, covering everything from creating offline experiences to driving online engagement. Whether you're a shopping mall, restaurant, or online brand, you'll find a suitable strategy: each model includes clear objectives and industry-specific guidelines, helping brands transform traffic into real sales and lasting emotional connections during this romantic season.
This Valentine's Day map illustrates love through 30 romantic possibilities, from the vintage charm of "handwritten love letters" to the urban landscape of "rooftop sunsets," from the tactile experience of a "pottery workshop" to the leisurely moments of "wine tasting at a vineyard"—offering a unique sense of occasion for every couple. Whether it's cozy, experiential, or luxurious, love always finds the most fitting expression. May you all find the perfect atmosphere for your love story.
The ice hockey schedule for the Milano Cortina 2026 Winter Olympics, featuring preliminary rounds, quarterfinals, and medal matches for both men's and women's tournaments from February 5–22. All game times are listed in Eastern Standard Time (EST).
This Valentine's Day brand marketing handbook provides businesses with five practical models, covering everything from creating offline experiences to driving online engagement. Whether you're a shopping mall, restaurant, or online brand, you'll find a suitable strategy: each model includes clear objectives and industry-specific guidelines, helping brands transform traffic into real sales and lasting emotional connections during this romantic season.
This Valentine's Day map illustrates love through 30 romantic possibilities, from the vintage charm of "handwritten love letters" to the urban landscape of "rooftop sunsets," from the tactile experience of a "pottery workshop" to the leisurely moments of "wine tasting at a vineyard"—offering a unique sense of occasion for every couple. Whether it's cozy, experiential, or luxurious, love always finds the most fitting expression. May you all find the perfect atmosphere for your love story.
The ice hockey schedule for the Milano Cortina 2026 Winter Olympics, featuring preliminary rounds, quarterfinals, and medal matches for both men's and women's tournaments from February 5–22. All game times are listed in Eastern Standard Time (EST).
NGFW
ability to see
Internal and external network asset exposure - mapping table
Refer to the related functions of Sangfor NGAF and SIP to infer part of the function implementation.
Domain name, external IP, external port, host field of HTTP request, internal IP, internal port
See the ability of web applications
Mainstream network application identification
Integrate open source or commercial application identification engines and application identification libraries
Industry application software identification
Self-built industry application fingerprint database to identify specific industry application systems
Ability to see security vulnerabilities
Identify vulnerabilities based on traffic analysis
Tenable PAS vulnerability identification
How does SQLMap identify database vulnerabilities?
Principle description of Ansai Technology WebIDS
Identify weak password vulnerabilities and transmit passwords in clear text
The ability to see threat attacks
Detection of successful attacks
Filtering in the ETPro Business Edition Rule Base
Reverse the POC rules of 0day-1day
Combining the experience of the red and blue teams, focusing on getshell behavior echo detection
Part of it comes from threat intelligence detection results, webshell back-connection, and illegal external connection detection results.
Security media forum mining
Threat intelligence detection
The most valuable thing is quality, not quantity.
Virus Trojan Detection
Integrate commercial or open source antivirus engines and virus databases
Abnormal traffic discovery
TopN-based statistical analysis, feature-based analysis
Private routing
It can identify the number of terminals used under a user/IP, regardless of whether the user/IP uses time-sharing and segmented Internet access, or uses NAT routing or a proxy to access the Internet at the same time.
Terminal operating system type
HTTP User-Agent extracts terminal operating system type
Extract endpoint operating system type from network traffic
Web application characteristics
When network applications such as 360 Security Guard and Sogou Input Method connect to the Internet and send data packets, they will carry a unique 32-bit signature bound to the host.
ID field trace characteristics of IP packets
When a Windows XP/7 system sends a TCP packet, the ID field in the IP packet increases incrementally. If a user has multiple Windows 7 and Windows XP systems, it can be observed that there are multiple domain tracks of the ID.
Worm scan
Operating system worm scanning characteristics
The source IP is the same, random or traversing the host IP, the target port accessed is basically the same, the average packet length is small, there are many packet requests and few responses;
Based on some fields of the source data packet, perform TopN statistical sorting
TCP SYN: The number of TCP SYN packets sent is much greater than the number of TCP ACK packets received;
TCP ACK
TCP ACK FIN
Email system worm scanning characteristics
DPI performs post-packet reassembly analysis
Sending emails frequently, with similar email title content and identical email attachments
Password guessing (brute force)
Feature Statistics
ARP attack
ARP format violation (forged MAC address)
ARP request storm
ARP too many unsolicited replies
ARP scan
IP address conflict
DDoS
Based on network attack characteristics
> Normal flow threshold set by machine learning * 130%
Illegal outreach
TeamView, RDP, remote control Trojans, mining Trojans...
covert communication
Seeing threats hidden in encrypted traffic: Interpretation of Cisco ETA algorithm paper.
Identify the content of encrypted traffic
Contents within the NGFW VPN tunnel
Identify SSL communication content and implement it in combination with SSL offloading and HTTPS proxy functions
ability to present
The ability to be seen by users
Let users see threat attacks
Compromised hosts, worms, mining Trojans, ransomware, and overseas IP access;
Let users see problem failures:
Let users see application assets;
way of seeing
WeChat Alert
System homepage
security report
System log
Email alert
Audible alert (browser)
governance capabilities
The ability to self-defense and govern
Collaborative defense and governance capabilities
Restful_API
The ability to send threat intelligence and security policies
Ability to receive threat intelligence and security policies
Connect with cloud security operation center
Docking situational awareness system
Connect with ATD advanced threat detection system
Connecting network equipment