Kuongororwa kweiyo encrypted traffic pasina kuibvisa

Iyo sisitimu yekuongorora traffic pasina kuibvisa. Iyi nzira inongonzi "muchina kudzidza". Zvakazoitika kuti kana vhoriyamu yakakura kwazvo yetraffic yakasiyana-siyana yakadyiswa kune yekuisa yeakakosha classifier, iyo sisitimu inogona kuona zviito zvehutsinye kodhi mukati meiyo encrypted traffic ine yakanyanya dhigirii yekugona.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa

Kutyisidzira kwepamhepo kwakachinja uye kuve nehungwaru. Munguva pfupi yapfuura, iyo pfungwa yekurwisa nekudzivirira yakashanduka. Nhamba yezviitiko pane network yakawedzera zvakanyanya. Kurwiswa kwave kwakanyanya uye ma hackers ane yakakura kusvika.

Zvinoenderana nenhamba dzeCisco, mugore rapfuura, vapambi vakapeta katatu nhamba yemalware yavanoshandisa kumabasa avo, kana kuti, encryption kuvavanza. Zvinozivikanwa kubva mudzidziso kuti "chaiyo" encryption algorithm haigone kutyorwa. Kuti unzwisise zvakavigwa mukati meiyo encrypted traffic, zvinodikanwa kuti uibvise uchiziva kiyi, kana kuyedza kuibvisa uchishandisa matipi akasiyana, kana kubira zvakananga, kana kushandisa imwe mhando yekusagadzikana mune cryptographic protocol.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Mufananidzo wekutyisidzira kwenetiweki yenguva yedu

Machine kudzidza

Ziva tekinoroji mumunhu! Usati wataura nezvekuti muchina wekudzidza-based decryption tekinoroji inoshanda sei, zvinodikanwa kuti unzwisise kuti neural network tekinoroji inoshanda sei.

Kudzidza kweMichina chikamu chakafara chehungwaru hwekugadzira chinoongorora nzira dzekugadzira maalgorithms anogona kudzidza. Iyi sainzi ine chinangwa chekugadzira masvomhu emhando dze "kudzidzisa" komputa. Chinangwa chekudzidza kufanotaura chimwe chinhu. Mukunzwisisa kwevanhu, nzira iyi tinoidaidza kuti izwi "njere". Uchenjeri hunozviratidza kune vanhu vakagara kwenguva yakareba (mwana ane makore maviri haagoni kuva akachenjera). Pakutendeukira kumakomuredhi makuru kuti tipe mazano, tinovapa rumwe ruzivo nezve chiitiko (yekuisa data) uye kuvakumbira rubatsiro. Ivo, zvakare, vanorangarira mamiriro ese kubva kuhupenyu ane hukama nedambudziko rako (ruzivo hwaro) uye, zvichibva paruzivo urwu (data), tipei rudzi rwekufanotaura (mazano). Mazano erudzi urwu akatanga kunzi kufanotaura nekuti munhu arikupa zano haazive zvechokwadi zvichaitika, asi anongofungidzira. Chinoitika choupenyu chinoratidza kuti munhu anogona kuva akarurama, kana kuti anogona kuva asina kururama.

Iwe haufanirwe kuenzanisa neural network neiyo branching algorithm (kana-zvimwe). Izvi zvinhu zvakasiyana uye pane misiyano yakakosha. Iyo branching algorithm ine "kunzwisisa" kwakajeka kwekuita. Ndicharatidza nemienzaniso.

Basa. Sarudza kureba kwemabhureki emotokari zvichienderana nekugadzirwa kwayo uye gore rekugadzira.

Muenzaniso weiyo branching algorithm. Kana motokari iri muchiso 1 uye yakabudiswa muna 2012, mabhureki kureba kwayo - 10 metres, kana zvisina kudaro, kana motokari iri mhando 2 uye yakabudiswa muna 2011, zvichingodaro.

Muenzaniso weneural network. Isu tinounganidza data pamusoro pemabhureki emota madaro mumakore makumi maviri apfuura. Nekuita uye gore, tinonyora tafura yefomu "make-gore rekugadzira-braking kure". Isu tinoburitsa tafura iyi kune neural network uye tinotanga kuidzidzisa. Kudzidziswa kunoitwa seinotevera: isu tinodyisa data kune neural network, asi pasina braking nzira. Iyo neuron inoedza kufanotaura kuti chinhambwe chebhureki chichabva patafura yakatakurwa mairi. Inofanotaura chimwe chinhu uye inobvunza mushandisi "Ndiri chokwadi here?" Pamberi pemubvunzo, anogadzira chikamu chechina, chikamu chekufungidzira. Kana ari chokwadi, anobva anyora 20 muchikamu chechina; kana akakanganisa, anonyora 1. Neural network inoenda kune chiitiko chinotevera (kunyangwe chakanganisa). Aya ndiwo madzidzisirwo etiweki uye kana kudzidziswa kwapera (imwe nzira yekuchinjisa yasvika), tinoendesa data nezve mota yatinofarira uye pakupedzisira tinowana mhinduro.

Kuti ndibvise mubvunzo nezve convergence criterion, ini ndichatsanangura kuti iyi ndiyo masvomhu inotorwa fomula yehuwandu. Muenzaniso unokatyamadza wemafomu maviri akasiyana e convergence. Tsvuku - kusanganisa kwemabhinari, bhuruu - kusanganisa kwakajairika.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Binomial uye zvakajairika mukana wekugovera

Kuti zvijeke, bvunza mubvunzo "Ndeipi mukana wekusangana nedhinaso?" Pane mhinduro mbiri pano. Sarudzo 2 - idiki kwazvo (girafu yebhuruu). Sarudzo 1 - ingave musangano kana kwete (girafu dzvuku).

Zvechokwadi, kombiyuta haisi munhu uye inodzidza zvakasiyana. Kune mhando mbiri dzesimbi bhiza kudzidziswa: case-based learning ΠΈ deductive kudzidza.

Kudzidzisa nemuenzaniso inzira yekudzidzisa uchishandisa mitemo yemasvomhu. Masvomhu anounganidza matafura ezviverengero, dhirowa mhedziso uye kurodha mhedzisiro muneural network - fomula yekuverenga.

Deductive kudzidza - kudzidza kunoitika zvachose neuron (kubva kuunganidzwa kwedata kusvika pakuongorora kwayo). Pano tafura inoumbwa pasina fomu, asi nehuwandu.

Kutarisisa kwakadzama kweiyo tekinoroji kungatora mamwe mashoma ezvinyorwa gumi nemaviri. Parizvino, izvi zvinenge zvakwana kuti tinzwisise.

Neuroplasticity

Mubiology kune pfungwa yakadaro - neuroplasticity. Neuroplasticity kugona kweneuroni (masero europi) kuita "maererano nemamiriro ezvinhu." Somuenzaniso, munhu asingachaoni anonzwa manzwi, munhuwi uye anonzwa zvinhu zviri nani. Izvi zvinoitika nekuda kwekuti chikamu chehuropi (chikamu cheneuroni) chinotarisira kuona chinogovera basa rayo kune mamwe maitiro.

Muenzaniso unoshamisa wehuroplasticity muhupenyu iBrainPort lollipop.

Muna 2009, Yunivhesiti yeWisconsin kuMadison yakazivisa kusunungurwa kwechigadzirwa chitsva chakagadzira pfungwa dze "chiratidziro chemutauro" - chainzi BrainPort. BrainPort inoshanda zvinoenderana neinotevera algorithm: chiratidzo chevhidhiyo chinotumirwa kubva kukhamera kuenda kune processor, iyo inodzora zoom, kupenya uye mamwe ma paramita emifananidzo. Iyo zvakare inoshandura masaini edhijitari kuita manzwiro emagetsi, zvakanyanya kutora mabasa eiyo retina.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
BrainPort lollipop ine magirazi uye kamera

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
BrainPort kubasa

Zvimwe chete nekombuta. Kana iyo neural network ikanzwa shanduko mukuita, inojairana nayo. Iyi ndiyo yakakosha mukana weiyo neural network ichienzaniswa nemamwe maalgorithms - kuzvitonga. Rudzi rwevanhu.

Encrypted Traffic Analytics

Encrypted Traffic Analytics chikamu cheStealthwatch system. Stealthwatch ndiko kupinda kwaCisco mukuchengetedza kuchengetedza uye analytics mhinduro dzinosimudzira bhizinesi telemetry data kubva kune iripo network network.

Stealthwatch Enterprise yakavakirwa paFlow Rate License, Flow Collector, Management Console uye Flow Sensor maturusi.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Cisco Stealthwatch Interface

Dambudziko re encryption rakanyanya kuoma nekuda kwekuti traffic yakawanda yakatanga kuvharirwa. Pakutanga, kodhi chete ndiyo yaive yakavharidzirwa (kazhinji), asi ikozvino traffic yese yakavharidzirwa uye kupatsanura "yakachena" data kubva kumavhairasi kwave kuoma zvakanyanya. Muenzaniso unoshamisa ndewe WannaCry, iyo yakashandisa Tor kuvanza kuvepo kwayo pamhepo.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Kuona kwekukura kwetraffic encryption pane network

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Encryption mune macroeconomics

Iyo Encrypted Traffic Analytics (ETA) system inodiwa chaizvo pakushanda neyakavharidzirwa traffic pasina kuibvisa. Vanorwisa vakangwara uye vanoshandisa crypto-resistant encryption algorithms, uye kuputsa haisi dambudziko chete, asiwo inodhura zvakanyanya kumasangano.

Iyo sisitimu inoshanda seinotevera. Imwe traffic inouya kukambani. Iyo inowira muTLS (yekutakura layer chengetedzo). Ngatitii traffic yakavharwa. Tiri kuedza kupindura mibvunzo yakati wandei pamusoro pemhando yekubatana kwakaitwa.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Iyo Encrypted Traffic Analytics (ETA) system inoshanda sei

Kupindura iyi mibvunzo tinoshandisa muchina kudzidza mune ino system. Tsvagiridzo kubva kuCisco inotorwa uye zvichibva pane izvi zvidzidzo tafura inogadzirwa kubva kune 2 mhinduro - yakaipa uye "yakanaka" traffic. Ehe, isu hatizive zvechokwadi kuti rudzii rwetraffic rwakapinda muhurongwa zvakananga panguva iripo panguva, asi isu tinokwanisa kutsvaga nhoroondo yetraffic mukati nekunze kwekambani tichishandisa data kubva pasirese. Pakupera kwechikamu ichi, tinowana tafura huru ine data.

Zvichienderana nemhedzisiro yekudzidza, hunhu hunoonekwa - mimwe mitemo inogona kunyorwa pasi muchimiro chesvomhu. Iyi mitemo ichasiyana zvakanyanya zvichienderana nemaitiro akasiyana - saizi yemafaira akatamiswa, rudzi rwekubatanidza, nyika kunobva traffic iyi, nezvimwe. Nekuda kwebasa, tafura hombe yakashanduka kuita seti yemirwi yemafomula. Kune vashoma vavo, asi izvi hazvina kukwana basa rakanaka.

Tevere, muchina kudzidza tekinoroji rinoshandiswa - fomula convergence uye kwakavakirwa mugumisiro convergence tinowana chinokonzeresa - chinja, apo kana mashoko ari goho tinowana chinja (mureza) mune yakasimudzwa kana kudzikiswa chinzvimbo.

Nhanho inokonzeresa kuwana seti yezvinokonzeresa zvakafukidza 99% yetraffic.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Matanho ekuongorora traffic muETA

Somugumisiro webasa, rimwe dambudziko rinogadziriswa - kurwisa kubva mukati. Hapasisina kudiwa kwevanhu vari pakati kusefa traffic nemaoko (ndiri kuzvinyudza panguva ino). Chekutanga, hauchadi kushandisa mari yakawanda pane anokwanisa system maneja (ini ndinoramba ndichinyura pachangu). Chechipiri, hapana njodzi yekubira kubva mukati (zvishoma zvishoma).

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Yechinyakare Man-in-the-Middle Concept

Zvino, ngationei kuti system yacho yakavakirwa pai.

Iyo sisitimu inoshanda pane mana ekutaurirana maprotocol: TCP / IP - Internet data transfer protocol, DNS - domain name server, TLS - transport layer security protocol, SPLT (SpaceWire Physical Layer Tester) - physical communication layer tester.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Protocols inoshanda neETA

Kuenzanisa kunoitwa nekuenzanisa data. Kushandisa TCP / IP mapuroteni, mukurumbira wemasaiti unotariswa (kushanya kwenhoroondo, chinangwa chekugadzira saiti, nezvimwewo), nekuda kweiyo DNS protocol, tinogona kurasa "yakaipa" kero dzesaiti. Iyo TLS protocol inoshanda nemunwe wesaiti uye inosimbisa saiti ichipikisana nekombuta yekupindura emergency team (cert). Nhanho yekupedzisira yekutarisa kubatana ndeyekutarisa padanho remuviri. Iwo mameseji eichi nhanho haana kutsanangurwa, asi poindi yacho ndeiyi: kutarisa sine uye cosine curves yedata transmission curves pane oscillographic kuisirwa, i.e. Kutenda kune chimiro chechikumbiro pachikamu chemuviri, tinosarudza chinangwa chekubatanidza.

Nekuda kwekushanda kweiyo system, tinogona kuwana data kubva kune encrypted traffic. Nekuongorora mapaketi, tinogona kuverenga ruzivo rwakawanda sezvinobvira kubva kuminda isina kunyorwa mupaketi pachayo. Nekuongorora pakiti pachikamu chemuviri, tinowana maitiro epakiti (chikamu kana zvachose). Zvakare, usakanganwa nezve mukurumbira wemasaiti. Kana chikumbiro chakabva kune imwe .onion sosi, haufanirwe kuvimba nayo. Kuita kuti zvive nyore kushanda nemhando iyi yedata, mepu ine njodzi yakagadzirwa.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Mhedzisiro yebasa reETA

Uye zvese zvinoita kunge zvakanaka, asi ngatitaure nezve network deployment.

Kuitwa kwenyama kweETA

A akati wandei nuances uye subtleties anomuka pano. Kutanga, pakugadzira rudzi urwu rwe
network ine yepamusoro-level software, kuunganidzwa kwedata kunodiwa. Unganidza data nemaoko zvachose
wild, asi kushandisa hurongwa hwekupindura kwatove kunakidza. Chechipiri, iyo data
panofanirwa kuve nezvakawanda, zvinoreva kuti ma sensors akaiswa network anofanira kushanda
kwete chete kuzvimiririra, asiwo mune yakanyatso kurongeka modhi, izvo zvinogadzira akati wandei matambudziko.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Sensors uye Stealthwatch system

Kuisa sensor chinhu chimwe, asi kuimisa ibasa rakasiyana zvachose. Kugadzirisa masensa, pane yakaoma inoshanda maererano neanotevera topology - ISR = Cisco Integrated Services Router; ASR = Cisco Aggregation Services Router; CSR = Cisco Cloud Services Router; WLC = Cisco Wireless LAN Controller; IE = Cisco Industrial Ethernet Switch; ASA = Cisco Adaptive Security Appliance; FTD = Cisco Firepower Threat Defense Solution; WSA = Webhu Chengetedzo Chishandiso; ISE = Identity Services Engine

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Yakazara yekutarisa uchifunga chero telemetric data

Network administrators vanotanga kuona arrhythmia kubva kuhuwandu hwemashoko "Cisco" mundima yapfuura. Mutengo wechishamiso ichi hausi mudiki, asi hazvisi izvo zvatiri kutaura nezvazvo nhasi ...

Hunhu hwehacker huchaenzanisirwa sezvizvi. Stealthwatch inotarisisa chiitiko chechishandiso chese panetiweki uye inokwanisa kugadzira maitiro ezvakajairika maitiro. Pamusoro pezvo, mhinduro iyi inopa nzwisiso yakadzama mune inozivikanwa maitiro asina kufanira. Mhinduro inoshandisa angangoita zana akasiyana ekuongorora algorithms kana heuristics anogadzirisa akasiyana marudzi ehunhu hwetraffic senge scanning, host alarm mafuremu, brute-force logins, anofungidzirwa data kubatwa, kufungidzirwa kudonha kwedata, nezvimwe. Zviitiko zvekuchengetedza zvakanyorwa zvinowira pasi pechikamu chepamusoro-soro maaramu. Zvimwe zviitiko zvekuchengetedza zvinogonawo kumutsa alarm ivo pachavo. Nekudaro, iyo sisitimu inokwanisa kuwiriranisa akawanda ega ega zviitiko zvisinganzwisisike uye zviise pamwe chete kuti zvione kuti ingangoita mhando yekurwiswa, pamwe nekuibatanidza kune chaiyo mudziyo uye mushandisi (Mufananidzo 100). Mune ramangwana, chiitiko chinogona kudzidzwa nekufamba kwenguva uye tichifunga nezve inosanganisirwa telemetry data. Izvi zvinoumba ruzivo rwemamiriro ezvinhu pakunaka kwayo. Vanachiremba vanoongorora murwere kuti vanzwisise kuti chii chakaipa havatarise zviratidzo zvega. Vanotarisa pamufananidzo mukuru kuti vaite chirwere. Saizvozvowo, Stealthwatch inotora zviitiko zvese zvisinganzwisisike panetiweki uye inoiongorora zvizere kuti itumire mamiriro-anoziva maaramu, nekudaro ichibatsira vashandi vezvekuchengetedza kukoshesa njodzi.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Kuonekwa kweanomaly uchishandisa maitiro ekuenzanisa

Kuiswa kwemuviri kwetiweki kunoratidzika seizvi:

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Bazi network deployment sarudzo (yakareruka)

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Bazi network deployment sarudzo

Iyo network yakaiswa, asi mubvunzo nezve neuron unoramba wakavhurika. Vakaronga network yekutumira data, vakaisa masensa pazvikumbaridzo uye vakatanga chirongwa chekuunganidza ruzivo, asi neuron haina kutora chikamu munyaya yacho. Chisarai.

Multilayer neural network

Iyo sisitimu inoongorora maitiro emushandisi uye emudziyo kuti aone hutachiona hunotyisa, kutaurirana nemirairo uye kutonga maseva, kuburitswa kwedata, uye zvingangove zvisingadiwe zvikumbiro zvinomhanya muzvivakwa zvesangano. Kune akati wandei akaturikidzana ekugadzirisa data uko musanganiswa wehungwaru hwekunyepedzera, kudzidza muchina, uye matekiniki ehuwandu hwemasvomhu anobatsira network yega kuti idzidze basa rayo rakajairwa kuti ione kuita kwakashata.

Iyo network yekuchengetedza yekuongorora pombi, iyo inounganidza telemetry data kubva kumativi ese eiyo network yakawedzera, kusanganisira yakavharidzirwa traffic, chinhu chakasarudzika cheStealthwatch. Iyo inowedzera kukudziridza kunzwisisa kwe "zvisinganzwisisike," yobva yaisa mumapoka chaiwo ega ega e "chiitiko chekutyisidzira," uye pakupedzisira inoita mutongo wekupedzisira wekuti mudziyo kana mushandisi akakanganiswa. Kugona kubatanidza zvidimbu zvidiki izvo pamwe chete zvinoumba humbowo hwekuita sarudzo yekupedzisira pamusoro pekuti asset yakakanganiswa inouya nekunyatso ongorora uye kuwirirana.

Kugona uku kwakakosha nekuti bhizinesi rakajairwa rinogona kugamuchira nhamba huru yemaalarm mazuva ese, uye hazvigoneke kuongorora yega yega nekuti vashandi vekuchengetedza vane zviwanikwa zvishoma. Muchina wekudzidza module unobata huwandu hwakakura hweruzivo munguva pfupi-chaiyo kuona zviitiko zvakakomba zvine chivimbo chepamusoro, uye zvakare inokwanisa kupa akajeka makosi echiito chekukurumidza kugadziriswa.

Ngatitarisei zvakanyanya nzira dzakawanda dzekudzidza muchina dzinoshandiswa neStealthwatch. Kana chiitiko chikatumirwa kune Stealthwatch's muchina wekudzidza injini, inoenda kuburikidza nekuchengetedza yekuongorora funnel inoshandisa musanganiswa weanotariswa uye asina kutariswa maitiro ekudzidza muchina.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Multi-level muchina kudzidza kugona

Level 1. Anomaly kuona uye kuvimba modhi

Padanho iri, 99% yetraffic inoraswa pachishandiswa statistical anomaly detectors. Aya masensa pamwe chete anoumba mhando dzakaoma dzezvakajairwa uye izvo, pane zvinopesana, zvisina kujairika. Zvisinei, chisiri chenguva dzose hachisi hacho chinokuvadza. Zvakawanda zviri kuitika panetiweki yako hazvina chekuita nekutyisidzira β€” zvinongo shamisa. Zvakakosha kuisa maitiro akadaro pasina kutarisa maitiro ekutyisidzira. Nechikonzero ichi, mibairo yema detectors akadaro inowongororwazve kuitira kutora maitiro anoshamisa anogona kutsanangurwa uye kuvimbwa. Pakupedzisira, chikamu chidiki chete chetambo dzakanyanya kukosha uye zvikumbiro zvinoita kuti zvive muzvikamu 2 ne3. Pasina kushandiswa kwemichina yakadaro yekudzidza michina, mari yekushanda yekuparadzanisa chiratidzo kubva kune ruzha ingave yakanyanya kukwirira.

Anomaly discovery. Yekutanga nhanho yekuona anomaly inoshandisa statistical muchina kudzidza matekiniki kuparadzanisa statistically yakajairika traffic kubva kune anoshamisa traffic. Anopfuura makumi manomwe ega ega ekuona anogadzira iyo telemetry data Stealthwatch inounganidza pane traffic inopfuura nepanetiweki yako perimeter, ichiparadzanisa yemukati Domain Name System (DNS) traffic kubva kune proxy server data, kana iripo. Chikumbiro chega chega chinogadziriswa nema detector anodarika makumi manomwe, ne detector yega yega ichishandisa statistical algorithm yayo kuita ongororo yezvakaonekwa zvisirizvo. Zvibodzwa izvi zvinosanganiswa uye nzira dzakawanda dzenhamba dzinoshandiswa kugadzira chibodzwa chimwe chete pamubvunzo wega wega. Ichi chibodzwa chinobva chashandiswa kupatsanura traffic yakajairika uye yakashata.

Modelling trust. Tevere, zvikumbiro zvakafanana zvinoiswa mumapoka, uye aggregate anomaly mamakisi emapoka akadaro anotarwa seavhareji yenguva refu. Nokufamba kwenguva, mibvunzo yakawanda inoongororwa kuti ione chiyero chenguva refu, nekudaro ichideredza nhema dzenhema uye nhema dzisina kunaka. Mhedzisiro yekuvimba yekumisikidza inoshandiswa kusarudza subset yetraffic iyo inomaly mamakisi inodarika imwe dynamically yakatemerwa chikumbaridzo kuti iende kune inotevera kugadzirisa level.

Level 2. Kurongeka kwechiitiko uye kuenzanisa kwechinhu

Pane iyi nhanho, mibairo yakawanikwa pamatanho apfuura inorongwa uye inopihwa kune chaiwo zviitiko zvakashata. Zviitiko zvinokamurwa zvichibva pakukosha kwakapihwa nemakina ekudzidza ekirasi kuti ive nechokwadi chekuenderana kwechiyero pamusoro pe90%. Pakati pavo:

  • mitsetse modhi yakavakirwa paNeyman-Pearson lemma (mutemo wekugovera zvakajairika kubva pagirafu pakutanga kwechinyorwa)
  • tsigira vector michina uchishandisa multivariate kudzidza
  • neural network uye yakasarudzika sango algorithm.

Izvi zviitiko zvekuchengetedza zvakasarudzika zvinobva zvabatanidzwa nekuguma kumwe chete nekufamba kwenguva. Pari padanho rino ndipo panogadzirwa tsananguro yekutyisidzira, zvichibva pane iyo mufananidzo wakazara unogadzirwa wekuti murwi akakodzera akakwanisa sei kuwana mimwe mhedzisiro.

Kurongwa kwezviitiko. Iyo subset ine statistically anomalous kubva padanho rekare inogoverwa muzvikamu zana kana kupfuura vachishandisa classifiers. Zvizhinji zvezvigadziriso zvinoenderana nemaitiro ega, hukama hweboka, kana maitiro pachiyero chepasirese kana chemunharaunda, nepo mamwe achigona kunyatsojeka. Semuyenzaniso, mugadziri anogona kuratidza C&C traffic, inonyumwira kuwedzera, kana isina kutenderwa software yekuvandudza. Zvichienderana nemhedzisiro yeichi nhanho, seti yezviitiko zvisinganzwisisike mune yekuchengetedza system, yakakamurwa mune mamwe mapoka, inoumbwa.

Object modelling. Kana huwandu hwehumbowo hunotsigira fungidziro yekuti chimwe chinhu chinokuvadza hunopfuura chidimbu chezvinhu, kutyisidzira kunotemwa. Zviitiko zvakakosha izvo zvakapesvedzera tsananguro yekutyisidzira zvinosanganiswa nekutyisidzira kwakadaro uye kuva chikamu cheiyo discrete yenguva refu modhi yechinhu. Sezvo humbowo hunounganidza nekufamba kwenguva, sisitimu inoratidza kutyisidzira kutsva kana chikumbaridzo chenyama chasvika. Uku kukosha kwechikumbaridzo kune simba uye kunogadziriswa zvine hungwaru zvichienderana nehuwandu hwekutyisidzira uye zvimwe zvinhu. Mushure meizvi, kutyisidzira kunoonekwa pane yeruzivo yewebhu interface uye inoendeswa kune inotevera nhanho.

Level 3. Relationship Modelling

Chinangwa chekuenzanisa hukama ndechekubatanidza mhedzisiro yakawanikwa pamatanho apfuura kubva pakuona kwepasirese, tichifunga kwete chete yenzvimbo asiwo mamiriro epasi rose echiitiko chakakodzera. Parizvino ndipo paunogona kuona kuti mangani masangano akasangana nekurwiswa kwakadaro kuti unzwisise kuti yaive yakanangana newe here kana kuti chikamu chemushandirapamwe wepasi rose, uye iwe uchangobatwa.

Zviitiko zvinosimbiswa kana kuwanikwa. Chiitiko chakasimbiswa chinoreva 99 kusvika 100% chivimbo nekuti maitiro akabatana uye maturusi akamboonekwa achiitwa pane yakakura (yepasi rose). Zviitiko zvakaonekwa zvakakunakira iwe chete uye zvinoumba chikamu chemushandirapamwe wakanangidzirwa zvakanyanya. Zvakawanikwa zvakapfuura zvinogoverwa nemaitiro anozivikanwa, zvichikuchengetedza nguva nezviwanikwa mukupindura. Ivo vanouya nezvishandiso zvekuferefeta zvaunoda kuti unzwisise kuti ndiani akakurwisa uye nechiyero icho mushandirapamwe wanga wakanangana nebhizinesi rako redhijitari. Sezvaunogona kufungidzira, nhamba yezviitiko zvakasimbiswa zvinodarika nhamba yevakaonekwa nekuda kwechikonzero chakareruka chekuti zviitiko zvakasimbiswa hazvisanganisi mari yakawanda kune vanorwisa, nepo zviitiko zvakaonekwa zvichidaro.
dzinodhura nekuti dzinofanirwa kuve nyowani uye dzakagadziridzwa. Nekugadzira kugona kuona zviitiko zvakasimbiswa, hupfumi hwemutambo hwakazochinja mukufarira vadziviriri, zvichivapa mukana wakasiyana.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Multi-level kudzidziswa kweiyo neural yekubatanidza system yakavakirwa paETA

Mepu yengozi yepasi rose

Mepu yenjodzi yepasirese inogadzirwa kuburikidza nekuongororwa kunoshandiswa nemachina ekudzidza algorithms kune imwe yakakura kwazvo dataset yerudzi rwayo muindasitiri. Inopa huwandu hwakakura hwekuzvibata maererano nemaseva paInternet, kunyangwe asingazivikanwe. Masevha akadaro ane hukama nekurwiswa uye anogona kubatanidzwa kana kushandiswa sechikamu chekurwisa mune ramangwana. Iyi haisi "blacklist", asi mufananidzo wakakwana we server iri mubvunzo kubva pakuchengetedza maonero. Iyi ruzivo rwemamiriro ekunze nezve chiitiko chemaseva aya inobvumira Stealthwatch's muchina kudzidza madetectors uye classifiers kunyatsofanotaura nhanho yenjodzi ine chekuita nekutaurirana nemaseva akadaro.

Unogona kuona makadhi aripo pano.

Kuongororwa kweiyo encrypted traffic pasina kuibvisa
Mepu yenyika inoratidza 460 miriyoni IP kero

Iye zvino network inodzidza uye inosimuka kuchengetedza network yako.

Pakupedzisira, panacea yakawanikwa?

Nhamo, kwete. Kubva pane ruzivo rwekushanda nehurongwa, ndinogona kutaura kuti kune 2 matambudziko enyika.

Dambudziko 1. Mutengo. Iyo yese network inoiswa pane Cisco system. Izvi zvose zvakanaka nezvakaipa. Rutivi rwakanaka nderekuti haufanirwe kunetseka uye nekuisa boka remapulagi senge D-Link, MikroTik, nezvimwe. Iyo yakaderera ndiyo mutengo wakakura wehurongwa. Tichifunga nezvehupfumi hwebhizimisi reRussia, panguva ino chete muridzi akapfuma wekambani huru kana bhangi anogona kukwanisa chishamiso ichi.

Dambudziko rechipiri: Kudzidziswa. Ini handina kunyora muchinyorwa nguva yekudzidziswa kweneural network, asi kwete nekuti haipo, asi nekuti iri kudzidza nguva dzese uye isu hatigone kufanotaura kuti ichadzidza riini. Ehezve, kune maturusi ehuwandu hwemasvomhu (tora iwo magadzirirwo akafanana eiyo Pearson convergence criterion), asi aya matanho ehafu. Isu tinowana mukana wekusefa traffic, uye kunyangwe ipapo chete pasi pemamiriro ekuti kurwiswa kwatove kwakanyatso zivikanwa uye kunozivikanwa.

Zvisinei nezvinetso zviviri izvi, takaita kusvetuka kukuru mukuvandudza kwekuchengetedza ruzivo mune zvese uye kuchengetedza network kunyanya. Ichi chokwadi chinogona kukurudzira pakudzidza kwetiweki tekinoroji uye neural network, zvino yava nzira inovimbisa kwazvo.

Source: www.habr.com

Voeg