8 results about "Server Message Block" patented technology

Inline detection of ransomware attacks using network traffic, such as server message block (SMB) traffic, is disclosed. A network communication between a client and a server is received. A determination is made, using the received network traffic, that a ransomware attack is being attempted against the server. In response to detecting the attempted ransomware attack, a remedial action is performed.

The invention provides a method, equipment and a product for a server message block (SMB). The method includes determining an interruption rate of a file as an object of SMB lease during the SMB lease, and determining a turning point of the interruption rate, where the turning point indicates a critical point between enabling the SMB lease and disabling the SMB lease. The method further includes determining to enable or disable the SMB lease based on the disruption rate and the turning point. According to the method for SMB disclosed by the invention, the overall IO performance of the system can be improved.

The subject technology relates to a Server Message Block (SMB). For instance, an example method includes determining a break rate of a file serving as an object of an SMB lease in the SMB lease process, and determining a turning point of the break rate, wherein the turning point indicates a critical point between enabling the SMB lease and disabling the SMB lease. The method further includes determining to enable or disable the SMB lease based on the break rate and the turning point. According to the example technologies used for an SMB, the overall input / output (IO) performance of a system can be improved.

Inline detection of ransomware attacks using network traffic, such as server message block (SMB) traffic, is disclosed. A network communication between a client and a server is received. A determination is made, using the received network traffic, that a ransomware attack is being attempted against the server. In response to detecting the attempted ransomware attack, a remedial action is performed.

The subject technology relates to a Server Message Block (SMB). For instance, an example method includes determining a break rate of a file serving as an object of an SMB lease in the SMB lease process, and determining a turning point of the break rate, wherein the turning point indicates a critical point between enabling the SMB lease and disabling the SMB lease. The method further includes determining to enable or disable the SMB lease based on the break rate and the turning point. According to the example technologies used for an SMB, the overall input / output (IO) performance of a system can be improved.

The present disclosure provides a service state detection method and device and electronic equipment, and relates to the technical field of network security, wherein the method is applied to a low-privilege environment with a privilege lower than that of an administrator, and comprises: loading a configuration file, the configuration file containing a target service name and a target host address; according to the configuration file, calling a local security mechanism of the target host based on a remote procedure call interface, remotely querying a service account, detecting a service installation state, the target host being a detected object and having a local security account service interface and a named pipe communication capability; if it is detected that the service has been installed, accessing a named pipe associated with the service according to a server message block protocol based on a pre-set mapping relationship between the service name and the named pipe, and detecting a service running state; and combining the service installation state and the service running state, outputting a service state detection result. The present disclosure can perform concealed detection on the service state of a remote target host in a low-privilege environment.

This application relates to a method and apparatus for tracing the operation of shared files. The method includes obtaining the data packet characteristics corresponding to a first event. The event type of the first event includes a Server Message Block (SMB) request event and an SMB response event. The SMB request event includes information about the initiator of the SMB request and data packet characteristics. The SMB response event includes information about the responder and data packet characteristics of the SMB request event associated with the SMB response event. The SMB response corresponds to the execution of a shared file operation. The method further includes querying a storage area for a second event that contains data packet characteristics and has a different event type than the first event. If a second event containing data packet characteristics is found in the storage area, the first event and the second event are associated to generate an associated event containing shared file operation information. The associated event is used to trace the operation of shared files, thereby improving the accuracy of tracing the operation of shared files.

The invention provides a service state detection method and device and electronic equipment, and relates to the technical field of network security, the method is applied to a low-permission environment with the permission lower than that of an administrator, and the method comprises the steps that a configuration file is loaded, and the configuration file comprises a target service name and a target host address; according to the configuration file, a local security mechanism of a target host is called based on a remote procedure calling interface, a service account is remotely inquired, a service installation state is detected, and the target host is a detected object and has a local security account service interface and named pipeline communication capability; if it is detected that the service is installed, accessing a named pipeline associated with the service according to a server message block protocol based on a preset mapping relationship between a service name and the named pipeline, and detecting a service operation state; and outputting a service state detection result in combination with the service installation state and the service operation state. According to the invention, hidden detection can be carried out on the service state of the remote target host in a low-permission environment.