- What's New
- Function Overview
- Service Overview
- Billing
- Getting Started
-
User Guide
- Creating a User Group and Granting Permissions
- Checking the Dashboard
- Purchasing and Changing the Specifications of CFW
- Enabling Internet Border Traffic Protection
- Enabling VPC Border Traffic Protection
- Enabling NAT Gateway Traffic Protection
-
Configuring Access Control Policies to Control Traffic
- Access Control Policy Overview
- Configuring Protection Rules to Block or Allow Traffic
- Adding Blacklist or Whitelist Items to Block or Allow Traffic
- Viewing Protection Information Using the Policy Assistant
- Managing Access Control Policies
- Managing IP Address Groups
- Domain Name Management
- Service Group Management
- Attack Defense
- Viewing Traffic Statistics
- Viewing CFW Protection Logs
- System Management
- Permissions Management
- Using Cloud Eye to Monitor CFW
- CTS Auditing
-
Best Practices
- CFW Best Practice Summary
- Purchasing and Querying CFW via API
- Migrating Security Policies to CFW in Batches
- Configuration Suggestions for Using CFW with WAF, Advanced Anti-DDoS, and CDN
- Allowing Internet Traffic Only to a Specified Port
- Allowing Outbound Traffic from Cloud Resources Only to a Specified Domain Name
- Using CFW to Defend Against Network Attacks
- Configuring a Protection Rule to Protect Traffic Between Two VPCs
- Configuring a Protection Rule to Protect SNAT Traffic
- Using CFW to Protect Enterprise Resources
- Using CFW to Protect EIPs Across Accounts
- Using CFW to Protect VPCs Across Accounts
-
API Reference
- Before You Start
- API Overview
- API Calling
-
API
-
Firewall Management
- Creating a Firewall
- Obtaining the Status of a CFW Task
- Deleting a Firewall
- Querying the Firewall List
- Changing the East-West Firewall Protection Status
- Querying Firewall Details
- Obtaining East-West Firewall Information
- Creating an East-West Firewall
- Querying the Number of Protected VPCs
- Creating a Tag
- Deleting a Tag
- EIP Management
-
ACL Rule Management
- Creating an ACL Rule
- Deleting an ACL Rule
- Deleting ACL Rules in Batches
- Deleting the Number of Rule Hits
- Updating an ACL Rule
- Updating Rule Actions in Batches
- Setting the Priority of an ACL Protection Rule
- Querying a Protection Rule
- Querying Rule Tags
- Obtaining the Number of Rule Hits
- Viewing the Region List
- Checking the ACL Import Status
- Blacklist/Whitelist Management
- Address Group Management
- Service Group Management
-
Domain Name Resolution and Domain Name Group Management
- Adding a Domain Name Group
- Deleting a Domain Name Group
- Updating a Domain Name Group
- Updating the DNS Server List
- Querying the Domain Name Group List
- Querying the DNS Server List
- Querying an IP Address for Domain Name Resolution
- Obtain the list of domain names in a domain name group
- Adding a Domain Name List
- Deleting a Domain Name List
- Viewing Domain Group Details
- Obtaining the DNS Resolution Result of a Domain Name
- Deleting Domain Groups in Batches
- IPS management
- Log Management
- Packet Capture Management
- Antivirus Management
- Alarm Configuration Management
- Tag Management
- IPS Management
-
Firewall Management
- Appendix
- SDK Reference
-
FAQs
-
About the Product
- Does CFW Support Off-Cloud Servers?
- What Are the QPS, New Connections, and Concurrent Connections Supported by CFW?
- Can CFW Be Shared Across Accounts?
- What Are the Differences Between CFW and WAF?
- What Are the Differences Between CFW, Security Groups, and Network ACLs?
- How Does CFW Control Access?
- What Are the Priorities of the Protection Settings in CFW?
- Can WAF, Advanced Anti-DDoS, and CFW Be Deployed Together?
- Can CFW Protect Resources Across Enterprise Projects?
- How Long Are CFW Logs Stored by Default?
- Regions and AZs
-
Troubleshooting
- What Do I Do If Service Traffic is Abnormal?
- Why Are Traffic and Attack Logs Incomplete?
- Why Does a Protection Rule Not Take Effect?
- What Do I Do If IPS Blocks Normal Services?
- Why Is No Data Displayed on the Access Control Logs Page?
- Why Is the IP Address Translated Using NAT64 Blocked?
- Why Some Permissions Become Invalid After a System Policy Is Granted to an Enterprise Project?
- What Do I Do If a Message Indicating Insufficient Permissions Is Displayed When I Configure LTS Logs?
-
Network Traffic
- How Do I Calculate the Number of Protected VPCs and the Peak Protection Traffic at the VPC Border?
- How Does CFW Collect Traffic Statistics?
- What Is the Protection Bandwidth Provided by CFW?
- What Do I Do If My Service Traffic Exceeds the Protection Bandwidth?
- What Are the Differences Between the Data Displayed in Traffic Trend Module and the Traffic Analysis Page?
- How Do I Verify the Validity of an Outbound HTTP/HTTPS Domain Protection Rule?
- How Do I Obtain the Real IP Address of an Attacker?
- What Do I Do If a High Traffic Warning Is Received?
-
About the Product
- Videos
-
More Documents
-
User Guide (Ankara Region)
- Product Overview
- Checking the Dashboard
- Creating Cloud Firewall
- Enabling Internet Border Traffic Protection
- Enabling VPC Border Traffic Protection
-
Configuring Access Control Policies to Control Traffic
- Access Control Policy Overview
- Configuring Protection Rules to Block or Allow Traffic
- Adding Blacklist or Whitelist Items to Block or Allow Traffic
- Viewing Protection Information Using the Policy Assistant
- Managing Access Control Policies
- Managing IP Address Groups
- Domain Name Management
- Service Group Management
- Attack Defense
- Viewing Traffic Statistics
- Viewing CFW Protection Logs
- System Management
-
FAQs
-
About the Product
- Does CFW Support Off-Cloud Servers?
- What Are the QPS, New Connections, and Concurrent Connections Supported by CFW?
- Can CFW Be Shared Across Accounts?
- What Are the Differences Between CFW and WAF?
- What Are the Differences Between CFW, Security Groups, and Network ACLs?
- How Does CFW Control Access?
- What Are the Priorities of the Protection Settings in CFW?
- Can WAF and CFW Be Deployed Together?
- Troubleshooting
- Network Traffic
-
About the Product
- Change History
- API Reference (Ankara Region)
-
User Guide (Ankara Region)
- General Reference
Copied.
Using CFW to Defend Against Trojans
You can use CFW to defend against Trojan attacks.
Application Scenarios
Trojans are a type of common network attacks. Trojans are implanted in computers to control the computers, steal user information, and damage computer systems. Trojans are highly disguised and latent, making them difficult to detect and remove.
CFW provides intrusion prevention rules for Trojans, helping you effectively identify and defend against Trojan intrusions.
What Is a Trojan?
Trojans are a type of malware program that invades a computer to implement illegal intents. Trojans usually disguise as legitimate software and induce users to download them. Attackers use Trojans to control users' computer systems and steal personal information, passwords, or other sensitive data, or damage the computer systems.
The difference between Trojans and computer viruses is that Trojans do not replicate themselves, are not infectious, and do not proactively initiate attacks. The main characteristics of Trojans are as follows:
- Disguised: Trojans usually disguise as programs or files that seem normal to deceive users into installing or opening them. There are many ways Trojans disguise themselves, for example, use a normal file icon, such as a text, image, or HTML icon; or to use the name of a system file.
- Hidden: Once a Trojan is implanted in a computer, it can lurk in the computer for a long time and is not easy to detect and remove, waiting for instructions from the attacker. Trojans are hidden in legitimate programs. When a Trojan is running, its icon is not displayed in the taskbar, and it cannot be easily detected by the task manager.
- Destructive: After a Trojan is implanted in a computer, attackers can remotely control the Trojan client to perform a series of illegal behaviors that can cause serious consequences, such as stealing user privacy information, controlling system running, and damaging system data.
Types of Trojans and Their Harms
Common Trojans and their harms include but are not limited to the following:
- Remote control: Remote control is a basic function of Trojans. Without the victim's knowledge, an attacker can deliver commands to remotely control the victim's computer and complete attack instructions, such as tampering with files and data and downloading malware.
- Password theft: This type of Trojan mainly collects all hidden passwords, such as the accounts and passwords of social accounts and online games, and sends out the password information without the victim's knowledge.
- Keylogger: This type of Trojans can record keystrokes, through which an attacker can obtain useful information such as passwords. This type of Trojan is automatically loaded when the OS is started. It can be online or offline, which records users' keystrokes in online or offline states, respectively. Generally, a keylogger Trojan can send recorded information to a controller via email.
How to Defend Against Trojans
The key to defending against Trojans is prevention, that is, blocking attacks before Trojans infect a device and cause losses. In addition to improving cybersecurity awareness, you can also use CFW intrusion prevention rules to defend against Trojans. The specific measures are as follows:
Improving cybersecurity awareness
- Install authorized OSs and applications. Do not download applications from non-official websites.
- Do not open emails or install software from unknown sources. Some seemingly normal emails and software may contain Trojans.
- Do not click pop-up advertisements on websites. Trojans often disguise as such advertisements.
Configuring Trojan prevention rules on CFW
- Log in to the management console.
- Click
in the upper left corner of the management console and select a region or project.
- In the navigation pane on the left, click
and choose Security & Compliance > Cloud Firewall. The Dashboard page will be displayed.
- (Optional) Switch to another firewall instance: Select a firewall from the drop-down list in the upper left corner of the page.
- Click View Effective Rules under Basic Protection. The Basic Protection tab is displayed.
- Filter the rules for defending against Trojans. In the filter above the list, select Trojan from the Attack Types drop-down list.
- Enable protection in batches. Select multiple rules at a time and click Intercept.
NOTE:
Intercept: The firewall records the traffic that matches the current rule in attack event logs and blocks the traffic.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot