https://www.clearsec.org/wikis/ise/ises/15_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1/Recent content in 主动防御 on ClearSec WikiHugozh-cnFri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/15_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1/15.1_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%85%A5%E4%BE%B5%E9%98%BB%E6%96%AD-%E8%BD%AF%E4%BB%B6%E7%99%BD%E5%90%8D%E5%8D%95-%E6%B5%81%E9%87%8F%E6%B8%85%E6%B4%97/Fri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/15_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1/15.1_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%85%A5%E4%BE%B5%E9%98%BB%E6%96%AD-%E8%BD%AF%E4%BB%B6%E7%99%BD%E5%90%8D%E5%8D%95-%E6%B5%81%E9%87%8F%E6%B8%85%E6%B4%97/<p>网络安全主动防御技术与应用</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.1_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%85%A5%E4%BE%B5%E9%98%BB%E6%96%AD-%E8%BD%AF%E4%BB%B6%E7%99%BD%E5%90%8D%E5%8D%95-%E6%B5%81%E9%87%8F%E6%B8%85%E6%B4%97/d16be1b8975a239e81eec744d058aa35_MD5.png" alt=""></p> <h3 id="入侵阻断ips">入侵阻断IPS</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.1_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%85%A5%E4%BE%B5%E9%98%BB%E6%96%AD-%E8%BD%AF%E4%BB%B6%E7%99%BD%E5%90%8D%E5%8D%95-%E6%B5%81%E9%87%8F%E6%B8%85%E6%B4%97/56bb34c09d2a24be1d200bccc3ac9f27_MD5.png" alt=""></p> <p>串行部署面临通信瓶颈与高可用性问题。</p> <p>商用IPS一般是硬件方式旁路部署，配合路由策略可以检测制定区域的流量。通过旁路注入报文阻断流量。</p> <p>引流使用策略路由或者SDN。</p> <h3 id="软件白名单技术与应用">软件白名单技术与应用</h3> <p>现在国内应用商店就是白名单制度，未过审不上架。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.1_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%85%A5%E4%BE%B5%E9%98%BB%E6%96%AD-%E8%BD%AF%E4%BB%B6%E7%99%BD%E5%90%8D%E5%8D%95-%E6%B5%81%E9%87%8F%E6%B8%85%E6%B4%97/ea47ef0824b84ecc944710887c25268f_MD5.png" alt=""></p> <h3 id="网络流量清洗">网络流量清洗</h3> <p>流量清洗一般是大型网络出口使用。用于防范大规模DDOS攻击（分布式拒绝服务攻击）</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.1_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%85%A5%E4%BE%B5%E9%98%BB%E6%96%AD-%E8%BD%AF%E4%BB%B6%E7%99%BD%E5%90%8D%E5%8D%95-%E6%B5%81%E9%87%8F%E6%B8%85%E6%B4%97/4b1a818693be3230184b924b05d5f91f_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.1_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%85%A5%E4%BE%B5%E9%98%BB%E6%96%AD-%E8%BD%AF%E4%BB%B6%E7%99%BD%E5%90%8D%E5%8D%95-%E6%B5%81%E9%87%8F%E6%B8%85%E6%B4%97/353418748c5b5744547135eccfc45053_MD5.png" alt=""></p> <p>流量清洗中心可以是硬件设备也可以是云服务。</p> <p>LAND利用TCP三次握手漏洞，让服务方一直挂起空连接耗费资源。<img src="https://www.clearsec.org/wikis/_resources/%C2%A715.1_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%85%A5%E4%BE%B5%E9%98%BB%E6%96%AD-%E8%BD%AF%E4%BB%B6%E7%99%BD%E5%90%8D%E5%8D%95-%E6%B5%81%E9%87%8F%E6%B8%85%E6%B4%97/1556682ff7d77d81c57d790152d26f87_MD5.png" alt=""></p> <p>Smurf，在网络中，A假冒B的源地址向广播地址发送报文（例如ping），该网络内每个主机都向B回复报文。</p> <ul> <li><strong>LAND 攻击</strong>：此攻击发送一个欺骗性的 TCP SYN 数据包，其中<strong>源地址和目标地址设置为相同的 IP 地址</strong>，导致系统自行响应，从而形成可能导致系统崩溃的循环。</li> <li><strong>Fraggle 攻击</strong>：类似于 Smurf 攻击，但使用 UDP 数据包而不是 ICMP。攻击者向网络的广播地址发送大量 UDP 数据包，并将源地址伪装成受害者的 IP。这会向受害者发送大量响应。</li> <li><strong>Smurf 攻击</strong>：这是一种** DDoS 攻击**，攻击者向网络的广播地址发送 <strong>ICMP 数据包</strong>，将源 IP 地址伪装成受害者的 IP。然后网络上的设备向受害者发送大量响应，导致系统不堪重负。</li> <li><strong>WinNuke</strong>：此攻击针对<strong>旧版本 Windows 操作系统中的漏洞</strong>，通过向<strong>端口 139 发送带外 (OOB) 数据</strong>，导致系统崩溃或重新启动。</li> <li><strong>Ping of Death</strong>：此攻击涉及向目标发送<strong>格式错误或超大的数据包</strong>。它会导致无法处理这些超大数据包的系统发生缓冲区溢出，从而导致系统崩溃或重启。</li> <li><strong>Teardrop 攻击</strong>：此攻击利用了<strong>碎片重组中的漏洞</strong>。它会发送碎片数据包，这些数据包在重组时会重叠，从而导致系统崩溃或行为异常。</li> <li><strong>TCP 错误标志攻击</strong>：这涉及操纵 TCP 标志设置以创建异常数据包，混淆目标系统或防火墙并可能导致其崩溃或绕过安全规则。</li> </ul> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.1_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%85%A5%E4%BE%B5%E9%98%BB%E6%96%AD-%E8%BD%AF%E4%BB%B6%E7%99%BD%E5%90%8D%E5%8D%95-%E6%B5%81%E9%87%8F%E6%B8%85%E6%B4%97/bc316c06dced0a9db27cb2673983add2_MD5.png" alt=""></p>https://www.clearsec.org/wikis/ise/ises/15_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1/15.2_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%8F%AF%E4%BF%A1%E8%AE%A1%E7%AE%97-%E6%95%B0%E5%AD%97%E6%B0%B4%E5%8D%B0%E6%8A%80%E6%9C%AF/Fri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/15_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1/15.2_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%8F%AF%E4%BF%A1%E8%AE%A1%E7%AE%97-%E6%95%B0%E5%AD%97%E6%B0%B4%E5%8D%B0%E6%8A%80%E6%9C%AF/<h3 id="可信计算">可信计算</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.2_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%8F%AF%E4%BF%A1%E8%AE%A1%E7%AE%97-%E6%95%B0%E5%AD%97%E6%B0%B4%E5%8D%B0%E6%8A%80%E6%9C%AF/d32a7fe535fcd24a4b166915b72820ac_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.2_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%8F%AF%E4%BF%A1%E8%AE%A1%E7%AE%97-%E6%95%B0%E5%AD%97%E6%B0%B4%E5%8D%B0%E6%8A%80%E6%9C%AF/296e10d087ece58e57be22c4915c1bbc_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.2_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%8F%AF%E4%BF%A1%E8%AE%A1%E7%AE%97-%E6%95%B0%E5%AD%97%E6%B0%B4%E5%8D%B0%E6%8A%80%E6%9C%AF/fbd3959df153c39c1ea1794d0e0150b7_MD5.png" alt=""></p> <p>启动和运行时都检查。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.2_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%8F%AF%E4%BF%A1%E8%AE%A1%E7%AE%97-%E6%95%B0%E5%AD%97%E6%B0%B4%E5%8D%B0%E6%8A%80%E6%9C%AF/29f948bd52ecee2f4094427f92a60d9a_MD5.png" alt=""></p> <h3 id="数字水印">数字水印</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.2_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%8F%AF%E4%BF%A1%E8%AE%A1%E7%AE%97-%E6%95%B0%E5%AD%97%E6%B0%B4%E5%8D%B0%E6%8A%80%E6%9C%AF/739c2a58f0a9f148ffecf86dad0afc7f_MD5.png" alt=""></p> <p>变换域方法 利用扩展频谱通信技术和Hash函数。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.2_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E5%8F%AF%E4%BF%A1%E8%AE%A1%E7%AE%97-%E6%95%B0%E5%AD%97%E6%B0%B4%E5%8D%B0%E6%8A%80%E6%9C%AF/819c7bd24d8c6de703a069f2592c1606_MD5.png" alt=""></p>https://www.clearsec.org/wikis/ise/ises/15_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1/15.3_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E9%99%B7%E9%98%B1%E5%85%A5%E4%BE%B5%E5%AE%B9%E5%BF%8D%E9%9A%90%E7%A7%81%E4%BF%9D%E6%8A%A4%E5%8F%8A%E5%89%8D%E6%B2%BF%E6%8A%80%E6%9C%AF/Fri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/15_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1/15.3_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E9%99%B7%E9%98%B1%E5%85%A5%E4%BE%B5%E5%AE%B9%E5%BF%8D%E9%9A%90%E7%A7%81%E4%BF%9D%E6%8A%A4%E5%8F%8A%E5%89%8D%E6%B2%BF%E6%8A%80%E6%9C%AF/<h3 id="网络攻击诱骗陷阱技术-蜜罐陷阱">网络攻击诱骗陷阱技术-蜜罐&amp;陷阱</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.3_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E9%99%B7%E9%98%B1%E3%80%81%E5%85%A5%E4%BE%B5%E5%AE%B9%E5%BF%8D%E3%80%81%E9%9A%90%E7%A7%81%E4%BF%9D%E6%8A%A4%E5%8F%8A%E5%89%8D%E6%B2%BF%E6%8A%80%E6%9C%AF/f24b0e1065104f229406ac9f798851d8_MD5.png" alt=""></p> <p>蜜罐和陷阱网络技术是主动的防御方法。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.3_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E9%99%B7%E9%98%B1%E3%80%81%E5%85%A5%E4%BE%B5%E5%AE%B9%E5%BF%8D%E3%80%81%E9%9A%90%E7%A7%81%E4%BF%9D%E6%8A%A4%E5%8F%8A%E5%89%8D%E6%B2%BF%E6%8A%80%E6%9C%AF/556fef2d5169a355474f46af5b0f6504_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.3_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E9%99%B7%E9%98%B1%E3%80%81%E5%85%A5%E4%BE%B5%E5%AE%B9%E5%BF%8D%E3%80%81%E9%9A%90%E7%A7%81%E4%BF%9D%E6%8A%A4%E5%8F%8A%E5%89%8D%E6%B2%BF%E6%8A%80%E6%9C%AF/e88d345e11825e14d299151f40fd12ef_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.3_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E9%99%B7%E9%98%B1%E3%80%81%E5%85%A5%E4%BE%B5%E5%AE%B9%E5%BF%8D%E3%80%81%E9%9A%90%E7%A7%81%E4%BF%9D%E6%8A%A4%E5%8F%8A%E5%89%8D%E6%B2%BF%E6%8A%80%E6%9C%AF/1477ebb69870ec148208e8a7f37dc20e_MD5.png" alt=""></p> <h4 id="陷阱技术应用">陷阱技术应用</h4> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.3_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E9%99%B7%E9%98%B1%E3%80%81%E5%85%A5%E4%BE%B5%E5%AE%B9%E5%BF%8D%E3%80%81%E9%9A%90%E7%A7%81%E4%BF%9D%E6%8A%A4%E5%8F%8A%E5%89%8D%E6%B2%BF%E6%8A%80%E6%9C%AF/3677a81420b95101158556be4461167a_MD5.png" alt=""></p> <h3 id="入侵容忍与系统生存技术">入侵容忍与系统生存技术</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.3_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E9%99%B7%E9%98%B1%E3%80%81%E5%85%A5%E4%BE%B5%E5%AE%B9%E5%BF%8D%E3%80%81%E9%9A%90%E7%A7%81%E4%BF%9D%E6%8A%A4%E5%8F%8A%E5%89%8D%E6%B2%BF%E6%8A%80%E6%9C%AF/a424a5e0e22cb64e1e8fe93e7890f75c_MD5.png" alt=""></p> <p><strong>门限密码，例如 两个人同时持钥匙才能开锁</strong></p> <p>分布式共识，例如 区块链技术……</p> <p><strong>多样性设计</strong>，在系统中使用不同供应商的设备或组件，规避单一来源造成供应链风险。</p> <p><strong>3R 抵抗、识别、恢复</strong></p> <h4 id="应用">应用</h4> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.3_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E9%99%B7%E9%98%B1%E3%80%81%E5%85%A5%E4%BE%B5%E5%AE%B9%E5%BF%8D%E3%80%81%E9%9A%90%E7%A7%81%E4%BF%9D%E6%8A%A4%E5%8F%8A%E5%89%8D%E6%B2%BF%E6%8A%80%E6%9C%AF/524e79459a28e21e6d40c993691745eb_MD5.png" alt=""></p> <h3 id="隐私保护技术与应用">隐私保护技术与应用</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.3_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E9%99%B7%E9%98%B1%E3%80%81%E5%85%A5%E4%BE%B5%E5%AE%B9%E5%BF%8D%E3%80%81%E9%9A%90%E7%A7%81%E4%BF%9D%E6%8A%A4%E5%8F%8A%E5%89%8D%E6%B2%BF%E6%8A%80%E6%9C%AF/5d0530e5b80482879bfcf5534ea1179c_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.3_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E9%99%B7%E9%98%B1%E3%80%81%E5%85%A5%E4%BE%B5%E5%AE%B9%E5%BF%8D%E3%80%81%E9%9A%90%E7%A7%81%E4%BF%9D%E6%8A%A4%E5%8F%8A%E5%89%8D%E6%B2%BF%E6%8A%80%E6%9C%AF/2f0efe8488446892876a80fac168f0e9_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.3_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E9%99%B7%E9%98%B1%E3%80%81%E5%85%A5%E4%BE%B5%E5%AE%B9%E5%BF%8D%E3%80%81%E9%9A%90%E7%A7%81%E4%BF%9D%E6%8A%A4%E5%8F%8A%E5%89%8D%E6%B2%BF%E6%8A%80%E6%9C%AF/97d7c058bbc6962d3ce0a6fc986858e7_MD5.png" alt=""></p> <h3 id="网络安全前沿技术发展动向">网络安全前沿技术发展动向</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.3_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E9%99%B7%E9%98%B1%E3%80%81%E5%85%A5%E4%BE%B5%E5%AE%B9%E5%BF%8D%E3%80%81%E9%9A%90%E7%A7%81%E4%BF%9D%E6%8A%A4%E5%8F%8A%E5%89%8D%E6%B2%BF%E6%8A%80%E6%9C%AF/0f46b2f1d209214f5c8ea96d2dbfb894_MD5.png" alt=""></p> <p>同态加密类似哈希</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A715.3_%E4%B8%BB%E5%8A%A8%E9%98%B2%E5%BE%A1_%E9%99%B7%E9%98%B1%E3%80%81%E5%85%A5%E4%BE%B5%E5%AE%B9%E5%BF%8D%E3%80%81%E9%9A%90%E7%A7%81%E4%BF%9D%E6%8A%A4%E5%8F%8A%E5%89%8D%E6%B2%BF%E6%8A%80%E6%9C%AF/ecde100fc548113499a0c5fe210560b4_MD5.png" alt=""></p> <p>DNSSEC</p> <p>前沿其实还有安全大数据、云、工、移、物等扩展。</p>