Help Center/ Host Security Service/ Service Overview/ Features

Updated on 2024-11-11 GMT+08:00

View PDF

Features

HSS comes in basic, professional, enterprise, premium, web tamper protection, and container editions. It provides the following functions: Dashboard, Asset Overview, Server Management, Container Management, Server Fingerprints, Container Fingerprints, Vulnerability Management, Baseline Check, Container Image Security, Application Protection, Web Tamper Protection, Ransomware Protection, File Integrity Management, Virus Scanning, Dynamic Port Honeypot, Container Firewall, Application Process Control, Container Cluster Protection, Server Alarms, Container Alarms, Whitelist Management, Policy Management, Handling History, Security Reports, Container Audit, Installation and Configuration on Servers. The functions supported by each edition are different. You can select a proper edition based on your service requirements.

To protect test servers or individual users' servers, use the basic edition. It can protect any number of servers, but only part of the security scan capabilities are available. This edition does not provide protection capabilities.
If you have advanced protection requirements, you are advised to use the premium edition.
For servers that need to protect websites and key systems from tampering, the WTP edition is recommended.
For containers that need to enhance image security and container runtime security, the container edition is recommended.
If your servers store important data assets, have high security risks, use publicly available EIPs, or there are databases running on your servers, you are advised to use the premium or Web Tamper Protection edition.

You are advised to deploy HSS on all your servers so that if a virus infects one of them, it will not be able to spread to others and damage your entire network.
After you purchase a protection quota, you can upgrade or switch its edition. For details, see Upgrading Protection Quotas and Switching the HSS Quota Edition.
The meanings of the symbols in the table are as follows:
- √: supported
- ×: not supported

Dashboard

Dashboard displays the overall security score and protection configuration of assets on the cloud, helping you learn about asset security status.

**Table 1** Functions
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Dashboard	You can check the security score, risks, and protection overview of all your assets in real time, including servers and containers.	√	√	√	√	√	√

Assets

Asset management displays the asset status and their statistics.

**Table 2** Assets
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Assets	Collect statistics on asset status and usage of all servers, including the agent status, protection status, quota status, and asset fingerprint.	√	√	√	√	√	√

Servers & Quota

Server management allows users to view and manage target servers by server.

**Table 3** Server management functions
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Servers & Quota	Manage all server assets, including their protection statuses, quotas, and policies. You can install agents on all the Linux servers in batches.	√	√	√	√	√	√

Containers & Quota

Container management allows you to view and manage target servers by container.

**Table 4** Containers & Quota
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Containers & Quota	Manage container nodes and images (private image repositories and local images).	×	×	×	×	×	√

Server Fingerprints

Server fingerprints can collect asset information about ports, processes, web applications, web services, web frameworks, and auto-startup items on hosts. Users can use the server fingerprint function to centrally check asset information on servers and detect unsafe assets in a timely manner.

**Table 5** Server fingerprint function
Check Item	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Accounts	Check and manage server accounts all in one place. Supported OSs: Linux and Windows. Scan time: automatic scan every hour.	×	×	√	√	√	√
Open ports	Check open ports all in one place and identify high-risk and unknown ports. Supported OSs: Linux and Windows. Scan time: automatic scan every 30s.	×	×	√	√	√	√
Processes	Check running applications all in one place and identify malicious applications. Supported OSs: Linux and Windows. Scan time: automatic scan every hour.	×	×	√	√	√	√
Software	Check and manage server software all in one place and identify insecure versions. Supported OSs: Linux and Windows. Scan time: automatic scan every day.	×	×	√	√	√	√
Auto-started items	Check auto-started items and collect statistics on their changes in a timely manner. Supported OSs: Linux and Windows. Scan time: automatic scan every hour.	×	×	√	√	√	√
Web applications	You can check details about software used for web content push and release, including versions, paths, configuration files, and associated processes of all software. Supported OSs: Linux and Windows (Tomcat only). Scan time: once a week (04:10 a.m. every Monday).	×	×	√	√	√	√
Web services	Check details about the software used for web content access, including versions, paths, configuration files, and associated processes of all software. Supported OSs: Linux. Scan time: once a week (04:10 a.m. every Monday).	×	×	√	√	√	√
Web frameworks	Check statistics about frameworks used for web content presentation, including their versions, paths, and associated processes. Supported OSs: Linux. Scan time: once a week (04:10 a.m. every Monday).	×	×	√	√	√	√
Websites	Check statistics about web directories and sites that can be accessed from the Internet. You can view the directories and permissions, access paths, external ports, and key processes of websites. Supported OSs: Linux. Scan time: once a week (04:10 a.m. every Monday).	×	×	√	√	√	√
Middleware	Check information about servers, versions, paths, and processes associated with middleware. Supported OSs: Linux and Windows. Scan time: once a week (04:10 a.m. every Monday).	×	×	√	√	√	√
Databases	You can check details about software that provides data storage, including versions, paths, configuration files, and associated processes of all software. Supported OSs: Linux and Windows (MySQL only). Scan time: once a week (04:10 a.m. every Monday).	×	×	√	√	√	√
Kernel modules	Check information about all the program module files running in kernels, including associated servers, version numbers, module descriptions, driver file paths, file permissions, and file hashes. Supported OSs: Linux. Scan time: once a week (04:10 a.m. every Monday).	×	×	√	√	√	√

Container Fingerprints

Container fingerprints collect asset information such as accounts, ports, processes, clusters, services, and workloads in containers. You can use the container fingerprint function to centrally check asset information in containers and detect unsafe assets in a timely manner.

**Table 6** Asset fingerprints
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Account	Check and manage container accounts all in one place. Supported OSs: Linux. Scan time: automatic scan every hour.	×	×	×	×	×	√
Open ports	Check container open ports all in one place and identify high-risk and unknown ports. Supported OSs: Linux. Scan time: automatic scan every 30s.	×	×	×	×	×	√
Process	Check running applications all in one place and identify malicious applications. Supported OSs: Linux. Scan time: automatic scan every hour.	×	×	×	×	×	√
Installed software	Check and manage container software all in one place and identify insecure versions. Supported OSs: Linux. Scan time: automatic scan every day.	×	×	×	×	×	√
Auto-started items	Check auto-started items and collect statistics on their changes in a timely manner. Supported OSs: Linux. Scan time: automatic scan every hour.	×	×	×	×	×	√
Web application	You can check details about software used for web content push and release, including versions, paths, configuration files, and associated processes of all software. Supported OSs: Linux. Scan time: once a week (04:10 a.m. every Monday).	×	×	×	×	×	√
Web service	You can check details about the software used for web content access, including versions, paths, configuration files, and associated processes of all software. Supported OSs: Linux. Scan time: once a week (04:10 a.m. every Monday).	×	×	×	×	×	√
Web frameworks	You can check statistics about frameworks used for web content presentation, including their versions, paths, and associated processes. Supported OSs: Linux. Scan time: once a week (04:10 a.m. every Monday).	×	×	×	×	×	√
Website	Check statistics about web directories and sites that can be accessed from the Internet. You can view the directories and permissions, access paths, external ports, and key processes of websites. Supported OSs: Linux. Scan time: once a week (04:10 a.m. every Monday).	×	×	×	×	×	√
Middleware	You can also check information about servers, versions, paths, and processes associated with middleware. Supported OSs: Linux. Scan time: once a week (04:10 a.m. every Monday).	×	×	×	×	×	√
Database	You can check details about software that provides data storage, including versions, paths, configuration files, and associated processes of all software. Supported OSs: Linux. Scan time: once a week (04:10 a.m. every Monday).	×	×	×	×	×	√
Clusters	Collect statistics on and display cluster details. You can view the type, node, version, and status of all clusters. Supported OSs: Linux. Scan time: manual scan at any time.	×	×	×	×	×	√
Services	Collect statistics on and display details about services and breakpoints. You can view information about all services, such as namespaces and clusters to which the services belong. Supported OSs: Linux. Scan time: manual scan at any time.	×	×	×	×	×	√
Workloads	Collect statistics on and display details about workloads (StatefulSets, deployments, DaemonSets, normal jobs, cron jobs, and container groups). You can view the status, number of instances, and namespace of all workloads. Supported OSs: Linux. Scan time: manual scan at any time.	×	×	×	×	×	√
Container instances	Collect statistics on and display container instance details. You can view the status, pods, and clusters of all container instances. Supported OSs: Linux. Scan time: manual scan at any time.	×	×	×	×	×	√

Vulnerability Management

Vulnerability management detects Linux software vulnerabilities, Windows system vulnerabilities, Web-CMS vulnerabilities, application vulnerabilities and emergency vulnerabilities, helping users identify potential risks.

**Table 7** Vulnerabilities
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Linux vulnerability detection	Based on the vulnerability database, check and handle vulnerabilities in the software (such as kernel, OpenSSL, vim, glibc) you obtained from official Linux sources and have not compiled. Supported OSs: Linux. Scan time: automatic scan (every day by default), scheduled scan (once a week by default, not supported in the basic edition), and manual scan at any time(not supported in the basic edition).	√	√	√	√	√	√
Windows vulnerability detection	Detect vulnerabilities in Windows OS based on the official patch releases of Microsoft. Supported OSs: Windows. Scan time: automatic scan (every day by default), scheduled scan (once a week by default, not supported in the basic edition), and manual scan at any time(not supported in the basic edition).	√	√	√	√	√	×
Web-CMS vulnerability detection	Scan for Web-CMS vulnerabilities in web directories and files. Supported OSs: Linux and Windows. Scan time: automatic scan (every day by default), scheduled scan (once a week by default), and manual scan at any time.	×	√	√	√	√	√
Application vulnerability detection	Detect vulnerabilities in JAR packages, ELF files, and other files of open source software, such as Log4j and spring-core. Supported OSs: Linux and Windows. Scan time: automatic scan (every Monday by default), scheduled scan (once a week by default), and manual scan at any time.	×	×	√	√	√	√
Emergency vulnerability detection	Checks whether the software and any dependencies running on the server have vulnerabilities through version comparison and POC verification. Reports risky vulnerabilities to the console and provides vulnerability alarms for you. Supported OSs: Linux. Scan time: scheduled scan (which needs to be manually enabled) and manual scan at any time.	×	√	√	√	√	√

Baseline Inspection

Baseline inspection can scan risky configurations, weak passwords, and password complexity policies of server systems and key software. The supported detection baselines include security practices. You can customize sub-baseline items and fix vulnerability risks.

**Table 8** Baseline checks
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Password complexity policies	Check password complexity policies and modify them based on suggestions provided by HSS to improve password security. Supported OSs: Linux. Scan time: automatic scan in the early morning every day and manual scan at any time.	√	√	√	√	√	√
Common weak passwords	Change weak passwords to stronger ones based on HSS scan results and suggestions. Supported OSs: Linux and Windows. Scan time: automatic scan in the early morning every day and manual scan at any time.	√	√	√	√	√	√
Unsafe configuration	Check the unsafe Tomcat, Nginx, and SSH login configurations found by HSS. Supported OSs: Linux and Windows. Scan time: automatic scan in the early morning every day and manual scan at any time.	×	×	√	√	√	√

Container Image Security

Container image security allows you to scan the image repository and running container images, detect vulnerabilities and malicious files in the images, and provide repair suggestions, helping you obtain secure images.

**Table 9** Container images
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
SWR image repository vulnerabilities	Detect system and application vulnerabilities in SWR image repository based on a vulnerability database and handle critical vulnerabilities in a timely manner. Supported OSs: Linux. Scan time: manual scan at any time.	×	×	×	×	×	√
Viewing Malicious File Detection Results	Scan images for malicious files (such as Trojans, worms, viruses, and adware) and identify risks. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√

Application protection

Application protection provides security defense for running applications. You simply need to add probes to applications, without having to modify application files. Currently, only Linux servers are supported, and only Java applications can be connected.

**Table 10** Application protection
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
SQL injection	Detect and defend against SQL injection attacks, and check web applications for related vulnerabilities. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
OS command injection	Detect and defend against remote OS command injection attacks and check web applications for related vulnerabilities. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
XSS	Detect and defend against stored cross-site scripting (XSS) injection attacks. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
Log4jRCE vulnerability	Detect and defend against remote code execution and intercept attacks. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
Web shell upload	Detect and defend against attacks that upload dangerous files, change file names, or change file name extension types; and check web applications for related vulnerabilities. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
XML External Entity Injection	Detect and defend against XML External Entity Injection (XXE) attacks, and check web applications for related vulnerabilities. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
Deserialization input	Detect deserialization attacks that exploit unsafe classes. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
File directory traversal	Check whether sensitive directories or files are accessed. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
Struts2 OGNL	Detect OGNL code execution. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
Command execution using JSP	Detect command execution using JSP. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
File deletion using JSP	Detects file deletion using JSP. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
Database connection exception	Detect authentication and communication exceptions thrown by database connections. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
0-day vulnerability	Check whether the stack hash of a command is in the whitelist of the web application. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
SecurityManager permission exception	Detect exceptions thrown by SecurityManager. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
JNDI injection	Detect and defend against JNDI injection attacks, and check web applications for related vulnerabilities. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
Expression injection	Detect and defend against expression injection attacks, and check web applications for related vulnerabilities. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√

Web Tamper Protection (WTP)

WTP can detect and prevent tampering of files in specified directories, including web pages, documents, and images, and quickly restore them using valid backup files.

**Table 11** Web Tamper Protection
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Static WTP	Protect the static web page files on website servers from being tampered with. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	×	×	×	√	×
Dynamic WTP	Provide dynamic web tamper protection for Tomcat. Protect the dynamic web pages in website databases from being tampered with. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	√	×

Ransomware prevention

Ransomware prevention supports user-defined ransomware prevention policies, using static and dynamic honeypots to identify attacks launched by known and unknown ransomware.

**Table 12** Ransomware prevention
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Ransomware prevention	Help you identify some unknown ransomware attacks by using static and dynamic honeypot files. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	×	×	√	√	√

Application Process Control

Application process control can detect malicious processes and generate alarms.

**Table 13** Application process control
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Application Process Control	Learn the characteristics of application processes on servers and manage their running. Suspicious and trusted processes are allowed to run, and alarms are generated for malicious processes. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	×	×	√	√	√

Checking File Integrity

File integrity management checks and records changes to key files.

**Table 14** File integrity monitoring
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Monitor file integrity	Check the key files of the Linux system to detect the changes that may be exploited by attacks in a timely manner. Supported OSs: Linux. Scan time: real-time detection.	×	√	√	√	√	√

Virus Scan

Virus scan can detect virus files on the server, helping users eliminate potential malicious threats.

**Table 15** Virus scan
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Virus scan	The function uses the virus detection engine to scan virus files on the server. The scanned file types include executable files, compressed files, script files, documents, images, and audio and video files. Users can perform quick scan and full-disk scan on the server as required. Customize scan tasks and handle detected virus files in a timely manner to enhance the virus defense capability of the service system. Supported OSs: Linux and Windows. Scan time: manual scan at any time.	×	√ (Only quick scan is supported.)	√	√	√	√

Dynamic Port Honeypot

The dynamic port honeypot function uses real ports as bait ports to induce attackers to access the intranet. In the horizontal penetration scenario, the function can effectively detect attackers' scanning and identify faulty servers.

**Table 16** Function
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Dynamic Port Honeypot	The dynamic port honeypot function is a deception trap. It uses a real port as a bait port to induce attackers to access the network. In the horizontal penetration scenario, the function can effectively detect attackers' scanning, identify faulty servers, and protect real resources of the user. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	×	×	√	√	√

Container Firewalls

Container firewalls provides services for container runtime.

**Table 17** Container firewall
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Container Firewalls	Control and intercept network traffic inside and outside a container cluster to prevent malicious access and attacks. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√

Container Cluster Protection

Container cluster protection can detect non-compliant baselines issues, vulnerabilities, and malicious files in images to prevent insecure container images from being deployed in clusters.

**Table 18** Container cluster protection
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Container cluster protection	Check for non-compliance baseline issues, vulnerabilities, and malicious files when a container image is started and report alarms on or block container startup that has not been unauthorized or may incur high risks. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√

Server Alarms

Server intrusion detection identifies and prevents intrusion to servers, discover risks in real time, detect and kill malicious programs, and identify web shells and other threats.

**Table 19** Server alarm function
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Unclassified malware	Check and handle detected malicious programs all in one place, including web shells, Trojan, mining software, worms, and viruses. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	√	√	√	√	√
Viruses	Check servers in real time and report alarms for viruses detected on servers. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	√	√	√	√	√
Worms	Detect and kill worms on servers and report alarms. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	√	√	√	√	√
Trojans	Detect programs that are hidden in normal programs and have special functions such as damaging and deleting files, sending passwords, and recording keyboards. If a program is detected, an alarm is reported immediately. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	√	√	√	√	√
Botnets	Detect whether zombie programs that have been spread exist in servers and report alarms immediately after detecting them. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	√	√	√	√	√
Backdoors	Detect web shell attacks in the server system in real time and report alarms immediately after detecting them. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	√	√	√	√	√
Rootkits	Detect server assets and report alarms for suspicious kernel modules, files, and folders. Supported OSs: Linux. Scan time: real-time detection.	×	√	√	√	√	√
Ransomware	Check for ransomware in web pages, software, emails, and storage media. Ransomware can encrypt and control your data assets, such as documents, emails, databases, source code, images, and compressed files, to leverage victim extortion. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	×	×	√	√	√
Hacker tools	Check whether non-standard tool used to control the server exist and report alarms immediately after detecting them. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	×	√	√	√	√
Webshell	Check whether the files (often PHP and JSP files) detected by HSS in your web directories are web shells. Web shell information includes the Trojan file path, status, first discovery time, and last discovery time. You can choose to ignore warning on trusted files. You can use the manual detection function to detect web shells on servers. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	√	√	√	√	√
Mining	Detect whether mining software exists on servers in real time and report alarms for the detected software. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	√	√	√	√	√
Remote code execution	Check whether the server is remotely called in real time and report an alarm immediately once remote code execution is detected. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	×	√	√	√	√
Redis vulnerability exploits	Detect the modifications made by the Redis process on key directories in real time and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	√	√	√	√	√
Hadoop vulnerability exploits	Detect the modifications made by the Hadoop process on key directories in real time and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	√	√	√	√	√
MySQL vulnerability exploits	Detect the modifications made by the MySQL process on key directories in real time and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	√	√	√	√	√
Reverse shells	Monitor user process behaviors in real time to detect and block reverse shells caused by invalid connections. Reverse shells can be detected for protocols including TCP, UDP, and ICMP. Supported OSs: Linux. Scan time: real-time detection. NOTE: To enable automatic reverse shell blocking, perform the following operations: You can enable automatic reverse shell blocking in the Malicious File Detection rule or configure automatic blocking in the HIPS Detection rule. For details about how to configure policies, see Configuring Policies. Enable malicious program isolation and killing. For details, see Enabling Malicious Program Isolation and Killing ..	×	√	√	√	√	√
File privilege escalation	Check the file privilege escalations in your system. Supported OSs: Linux. Scan time: real-time detection.	×	√	√	√	√	√
Process privilege escalations	The following process privilege escalation operations can be detected: Root privilege escalation by exploiting SUID program vulnerabilities Root privilege escalation by exploiting kernel vulnerabilities Supported OSs: Linux. Scan time: real-time detection.	×	√	√	√	√	√
Important file changes	Receive alarms when critical system files are modified. Supported OSs: Linux. Scan time: real-time detection.	×	√	√	√	√	√
File/Directory change	Monitor system files and directories in real time and generate alarms if such files are created, deleted, moved, or if their attributes or content are modified. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	√	√	√	√	√
Abnormal process behaviors	Check the processes on servers, including their IDs, command lines, process paths, and behavior. Send alarms on unauthorized process operations and intrusions. The following abnormal process behavior can be detected: Abnormal CPU usage Processes accessing malicious IP addresses Abnormal increase in concurrent process connections Supported OSs: Linux and Windows. Scan time: real-time detection.	×	×	√	√	√	√
High-risk command executions	Check executed commands in real time and generate alarms if high-risk commands are detected. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	√	√	√	√	√
Abnormal shells	Detect actions on abnormal shells, including moving, copying, and deleting shell files, and modifying the access permissions and hard links of the files. Supported OSs: Linux. Scan time: real-time detection.	×	√	√	√	√	√
Sensitive file access detection	Detect the unauthorized access to or modifications of sensitive files. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	√	√	√	√	√
Suspicious crontab tasks	Check and list auto-started services, scheduled tasks, pre-loaded dynamic libraries, run registry keys, and startup folders. You can get notified immediately when abnormal automatic auto-start items are detected and quickly locate Trojans. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	×	×	√	√	√
System protection disabling	Detect the preparations for ransomware encryption: Disable the Windows defender real-time protection function through the registry. Once the function is disabled, an alarm is reported immediately. Supported OSs: Windows. Scan time: real-time detection.	×	×	√	√	√	×
Backup deletion	Detect the preparations for ransomware encryption: Delete backup files or files in the Backup folder. Once backup deletion is detected, an alarm is reported immediately. Supported OSs: Windows. Scan time: real-time detection.	×	×	√	√	√	√
Suspicious registry operation	Detect operations such as disabling the system firewall through the registry and using the ransomware Stop to modify the registry and write specific strings in the registry. An alarm is reported immediately when such operations are detected. Supported OSs: Windows. Scan time: real-time detection.	×	×	√	√	√	√
System log deletion	An alarm is generated when a command or tool is used to clear system logs. Supported OSs: Windows. Scan time: real-time detection.	×	×	√	√	√	×
Suspicious command executions	Check whether a scheduled task or an automated startup task is created or deleted by running commands or tools. Detect suspicious remote command execution. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	×	√	√	√	√
Suspicious process execution	Detect and report alarms on unauthenticated or unauthorized application processes. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	×	√	√	√	×
Suspicious process file access	Detect and report alarms on the unauthenticated or unauthorized application processes accessing specific directories. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	×	√	√	√	×
Brute-force attacks	Check for brute-force attack attempts and successful brute-force attacks. Detect password cracking attacks on accounts and block attacking IP addresses to prevent server intrusion. Trigger an alarm if a user logs in to the server by a brute-force attack. Supported OSs: Linux and Windows. Scan time: real-time detection.	√	√	√	√	√	√
Abnormal logins	Check and handle remote logins. If a user's login location is not any common login location you set, an alarm will be triggered. Supported OSs: Linux and Windows. Scan time: real-time detection.	√	√	√	√	√	√
Invalid accounts	Scan accounts on servers and list suspicious accounts in a timely manner. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	√	√	√	√	√
User account added	Detect the commands used to create hidden accounts. Hidden accounts cannot be found in the user interaction interface or be queried by commands. Supported OSs: Windows. Scan time: real-time detection.	×	×	√	√	√	√
Password thefts	Detect the abnormal obtaining of hash value of system accounts and passwords on servers and report alarms. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	×	√	√	√	√
Unknown network access	Detect access to ports that are not listened on by the server. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	×	×	√	√	√
Cloud honeypot	An alarm is reported if a connection to the honeypot port of a server is detected.	×	×	×	√	√	×
Abnormal outbound connections	Report alarms on suspicious IP addresses that initiate outbound connections. Supported OSs: Linux. Scan time: real-time detection.	×	√	√	√	√	√
Port forwarding	Report alarms on port forwarding using suspicious tools. Supported OSs: Linux. Scan time: real-time detection.	×	√	√	√	√	√
Suspicious download request	An alarm is generated when a suspicious HTTP request that uses system tools to download programs is detected. Supported OSs: Windows. Scan time: real-time detection.	×	×	√	√	√	×
Suspicious HTTP request	An alarm is generated when a suspicious HTTP request that uses a system tool or process to execute a remote hosting script is detected. Supported OSs: Windows. Scan time: real-time detection.	×	×	√	√	√	×
Port scan	Detect scanning or sniffing on specified ports and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
Host scan	Detect the network scan activities based on server rules (including ICMP, ARP, and nbtscan) and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	√	√	√
Process injection	Scan for malicious code injection into running processes and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	√	√	√	√	√
Dynamic library injection	Scan for the payloads injected by hijacking functions in the dynamic link library (DLL) and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	√	√	√	√	√
Memory file process	Scan for the behaviors of creating an anonymous malicious file that exists only in the RAM through the memfd_create system call and executing the file, and report alarms on such behaviors. Supported OSs: Linux. Scan time: real-time detection.	×	√	√	√	√	√

Container Alarms

Container alarms can detect intrusion behaviors of Docker and Containerd engines. Scan running containers for malicious programs including miners and ransomware; detect non-compliant security policies, file tampering, and container escape; and provide suggestions.

**Table 20** Container alarm function
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Unclassified malware	Check and handle malicious programs in a container, including web shells, Trojan, mining software, worms, and viruses. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Ransomware	Check and handle alarms on ransomware in containers. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Hacker tools	Check whether non-standard tool used to control the server exist and report alarms immediately after detecting them. Supported OSs: Linux. Scan time: real-time detection.	×	×	√	√	√	√
Webshell	Check whether the files (often PHP and JSP files) in the web directories on containers are web shells. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Vulnerability escape detection	An escape alarm is reported if a container process behavior that matches the behavior of known vulnerabilities is detected. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
File escape detection	An alarm is reported if a container process is found accessing a key file directory (for example, /etc/shadow or /etc/crontab). Directories that meet the container directory mapping rules can also trigger such alarms. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Reverse shells	Monitor user process behaviors in a container environment in real time to detect reverse shells caused by invalid connections. Reverse shells can be detected for protocols including TCP, UDP, and ICMP. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
File privilege escalation	Check the file privilege escalations in the container system. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Process privilege escalations	The following process privilege escalation operations can be detected: Root privilege escalation by exploiting SUID program vulnerabilities Root privilege escalation by exploiting kernel vulnerabilities Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Important file changes	Receive alarms when critical system files are modified. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Abnormal process behaviors	Check the processes on servers in a container environment, including their IDs, command lines, process paths, and behavior. Send alarms on unauthorized process operations and intrusions. The following abnormal process behavior can be detected: Abnormal CPU usage Processes accessing malicious IP addresses Abnormal increase in concurrent process connections Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Abnormal container processes	Malicious container program detection Monitor container process behavior and process file fingerprints. An alarm is reported if it detects a process whose behavior characteristics match those of a predefined malicious program. Abnormal processes The service reports an alarm if it detects that a process not in the whitelist is running in the container. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Abnormal container startup detection	The service monitors container startups and reports an alarm if it detects that a container with too many permissions is started. Container check items include: Privileged container startup (privileged:true) Too many container capabilities (capability:[xxx]) Seccomp not enabled (seccomp=unconfined) Container privilege escalation (no-new-privileges:false) High-risk directory mapping (mounts:[...]) Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
High-risk command executions	Check executed commands in containers and generate alarms if high-risk commands are detected. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
High-risk system calls	You can run tasks in kernels by Linux system calls. The container edition reports an alarm if it detects a high-risk call. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Sensitive file access detection	The service monitors the container image files associated with file protection policies, and reports an alarm if the files are modified. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Container image blocking	If a container contains insecure images specified in Suspicious Image Behaviors, an alarm will be generated and the insecure images will be blocked before a container is started in Docker. Supported OSs: Linux. Scan time: real-time detection. NOTE: You need to install the Docker plug-in.	×	×	×	×	×	√
Suspicious command executions	Check whether a scheduled task or an automated startup task is created or deleted by running commands or tools. Detect suspicious remote command execution. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Brute-force attacks	Detect and report alarms for brute-force attack behaviors, such as brute-force attack attempts and successful brute-force attacks, on containers. Detect SSH, web, and Enumdb brute-force attacks on containers. Supported OSs: Linux. Scan time: real-time detection. NOTE: Currently, brute-force attacks can be detected only in the Docker runtime.	×	×	×	×	×	√
Invalid accounts	Detect suspicious accounts and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Password thefts	Detect the abnormal obtaining of hash value of system accounts and passwords on servers in a container environment and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Abnormal outbound connections	Report alarms on suspicious IP addresses in a container environment that initiate outbound connections. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Port forwarding	Report alarms on port forwarding using suspicious tools in a container environment. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Kubernetes event deletions	Detect the deletion of Kubernetes events and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Abnormal pod behaviors	Detect abnormal operations such as creating privileged pods, static pods, and sensitive pods in a cluster and abnormal operations performed on existing pods and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
User information enumerations	Detect the operations of enumerating the permissions and executable operation list of cluster users and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Binding cluster roles	Detect operations such as binding or creating a high-privilege cluster role or service account and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Process injection	Scan for malicious code injection into running processes and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Dynamic library injection	Scan for the payloads injected by hijacking functions in the dynamic link library (DLL) and report alarms. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√
Memory file process	Scan for the behaviors of creating an anonymous malicious file that exists only in the RAM through the memfd_create system call and executing the file, and report alarms on such behaviors. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√

Whitelist Management

The whitelist function includes Alarm whitelist, Login whitelist and System user whitelist. To reduce false alarms, import events to and export events from the whitelist.

**Table 21** Whitelists
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Alarm whitelist	You can add an alarm to the whitelist when handling it. Supported OSs: Linux and Windows. Scan time: real-time detection.	√	√	√	√	√	√
Login Whitelist	Add IP addresses and usernames to the Login Whitelist as needed. HSS will not report alarms on the access behaviors of these IP addresses and users. Supported OSs: Linux and Windows. Scan time: real-time detection.	√	√	√	√	√	√
System user whitelist	Users (non-root users) that are newly added to the root user group on a server can be added to the system user whitelist. HSS will not report risky account alarms for them. Supported OSs: Linux and Windows. Scan time: real-time detection.	√	√	√	√	√	√

Policy Management

You can configure Policy management and group policies and servers to batch apply policies to servers, easily adapting to your business scenarios.

**Table 22** Policies
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Policy Management	You can define and issue different detection policies for different servers or server groups, implementing refined security operations. Check the policy group list. Create a policy group based on default and existing policy groups. Define a policy. Edit or delete a policy. Modify or disable policies in a group. Apply policies to servers in batches on the Servers & Quota page. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	√ (Only the default professional policy group is supported.)	√ (Only the default enterprise policy group is supported.)	√	√	√

Viewing the Handling History

Handling history displays the handling history of vulnerabilities, viruses, and security alarms.

**Table 23** Handling history
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Handling history	Check historical vulnerability, virus, and alarm handling records, including the handling time and handlers.	×	√	√	√	√	√

Security Report

The HSS can generate Security reports on user assets on a daily, weekly, or monthly basis.

**Table 24** Security report
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Security Report	Check weekly or monthly server security trend, key security events, and risks.	×	√	√	√	√	√

Container Audit

Container audit monitors and records operations and activities of cluster containers, independent containers, and the image repositories of SoftWare Repository for Container (SWR). You can view and analyze their logs on the HSS console.

**Table 25** Container audit
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Container audit	Keep track of the operations and activities in your container clusters, gaining insight into every phase of the container lifecycle, including creating, starting, stopping, and destroying containers; as well as the communication and transmission between containers. Find and handle security problems through audit and analysis in a timely manner, ensuring the security and stability of container clusters. Supported OSs: Linux. Scan time: real-time detection.	×	×	×	×	×	√

Installation and Configuration on Servers

Installation and configuration provides functions such as agent management, common login locations, common login IP addresses, SSH login IP address whitelist, automatic isolation and removal of malicious programs, two-factor authentication, alarm configuration, and container installation and configuration to meet server and container security requirements in different scenarios.

**Table 26** Installation and configuration
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Agent management	You can view the agent status of all servers and upgrade, uninstall, and install agents. Supported OSs: Linux and Windows.	√	√	√	√	√	√
Common login location	For each server, you can configure the locations where users usually log in from. The service will generate alarms on logins originated from locations other than the configured common login locations. A server can be added to multiple login locations. Supported OSs: Linux and Windows.	√	√	√	√	√	√
Common login IP address	For each server, you can configure the IP addresses where users usually log in from. The service will generate alarms on logins originated from IP addresses other than the configured common IP addresses. Supported OSs: Linux and Windows.	√	√	√	√	√	√
Configuring an SSH Login IP Address Whitelist	The SSH login whitelist controls SSH access to servers to prevent account cracking. After you configure the whitelist, SSH logins will be allowed only from whitelisted IP addresses. Supported OSs: Linux.	√	√	√	√	√	√
Malicious program isolation and removal	HSS automatically isolates and kills identified malicious programs, such as web shells, Trojans, and worms, removing security risks. Supported OSs: Linux and Windows. Scan time: real-time detection.	×	√	√	√	√	√
Two-factor Authentication (2FA)	Prevent brute-force attacks by using password and SMS/email authentication. Supported OSs: Linux and Windows.	Pay per use: × Yearly/Monthly: √	√	√	√	√	√
Plug-in management	Install, uninstall, upgrade, and manage plug-ins in a unified manner. Supported OSs: Linux.	×	×	×	×	×	√
Container installation and configuration	Connect your clusters to HSS. Upgrade or uninstall the agent in your clusters or independent containers. Supported OSs: Linux.	√	√	√	√	√	√

HSS Self-protection

Self-protection protects HSS files and processes.

**Table 27** HSS self-protection
Function	Description	Basic Edition	Professional Edition	Enterprise Edition	Premium Edition	WTP Edition	Container Edition
Windows self-protection	Prevent malicious programs from uninstalling the agent, tampering with HSS files, or stopping HSS processes. Supported OSs: Windows. NOTE: Self-protection depends on antivirus detection, HIPS detection, and ransomware protection. It takes effect only when more than one of the three functions are enabled. Enabling the self-protection policy has the following impacts: The agent cannot be uninstalled on the control panel of a server, but can be uninstalled on the HSS console. HSS processes cannot be terminated. In the agent installation path C:\Program Files\HostGuard, you can only access the log and data directories (and the upgrade directory, if your agent has been upgraded).	×	×	×	√	√	×
Linux self-protection	Prevent malicious programs from stopping the HSS process and uninstalling the agent. Supported OSs: Linux. NOTE: Enabling the self-protection policy has the following impacts: The agent cannot be uninstalled using commands but can be uninstalled on the HSS console. HSS processes cannot be terminated.	×	×	×	√	√	×

Previous topic: Scenarios

Next topic: Provided Free of Charge

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot