{"id":37437,"date":"2019-10-31T22:17:38","date_gmt":"2019-10-31T19:17:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti\/"},"modified":"2019-10-31T22:17:38","modified_gmt":"2019-10-31T19:17:38","slug":"flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti","title":{"rendered":"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Kur flitet p\u00ebr monitorimin e siguris\u00eb s\u00eb nj\u00eb rrjeti t\u00eb brendsh\u00ebm korporativ ose institucionit, shum\u00eb fillojn\u00eb t\u00eb mendojn\u00eb p\u00ebr kontrollin e rrjedhjes s\u00eb informacionit dhe implementimin e zgjidhjeve DLP. Por n\u00ebse p\u00ebrpiqemi t\u00eb sakt\u00ebsojm\u00eb pyetjen dhe t\u00eb pyesim se si e zbuloni sulmet n\u00eb rrjetin tuaj t\u00eb brendsh\u00ebm, p\u00ebrgjigjja zakonisht \u00ebsht\u00eb p\u00ebrmendja e sistemeve t\u00eb zbulimit t\u00eb sulmeve (intrusion detection systems, IDS). Ajo q\u00eb ishte opsioni i vet\u00ebm 10-20 vjet m\u00eb par\u00eb, sot po b\u00ebhet nj\u00eb anahroniz\u00ebm. Ka nj\u00eb variant m\u00eb efektiv, dhe n\u00eb disa raste dhe variantin e vet\u00ebm p\u00ebr monitorimin e rrjetit t\u00eb brendsh\u00ebm \u2014 p\u00ebrdorimin e protokolleve flow, t\u00eb cilat fillimisht jan\u00eb dizajnuar p\u00ebr t\u00eb gjetur probleme rrjetesh (troubleshooting), por me kalimin e koh\u00ebs jan\u00eb transformuar n\u00eb nj\u00eb mjet shum\u00eb interesant p\u00ebr sigurin\u00eb. N\u00eb k\u00ebt\u00eb artikull do t\u00eb flasim p\u00ebr se \u00e7far\u00eb lloj protokollesh flow ekzistojn\u00eb dhe cilat nga ato ndihmojn\u00eb m\u00eb shum\u00eb n\u00eb zbulimin e sulmeve rrjet\u00ebsore, ku \u00ebsht\u00eb m\u00eb mir\u00eb t\u00eb implementohet monitorimi i flow, \u00e7far\u00eb duhet t\u00eb kemi parasysh gjat\u00eb implementimit t\u00eb k\u00ebtij skenari, dhe si mund ta realizojm\u00eb k\u00ebt\u00eb n\u00eb paisje tona vendase.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Nuk do t\u00eb ndalem n\u00eb pyetjen 'P\u00ebrse \u00ebsht\u00eb e nevojshme monitorimi i siguris\u00eb s\u00eb infrastruktur\u00ebs s\u00eb brendshme?' P\u00ebrgjigjja p\u00ebr k\u00ebt\u00eb duket e qart\u00eb. Por n\u00ebse akoma d\u00ebshironi t\u00eb siguroheni se sot nuk ka asnj\u00eb formul\u00eb p\u00ebr ta anashkaluar k\u00ebt\u00eb, <noindex><a rel=\"nofollow\" href=\"https:\/\/gblogs.cisco.com\/ru\/17attackvectors\/\">shikoni<\/a><\/noindex> nj\u00eb video e vog\u00ebl q\u00eb tregon se si mund t\u00eb hyhet n\u00eb nj\u00eb rrjet korporativ t\u00eb mbrojtur nga nj\u00eb firewall n\u00eb 17 m\u00ebnyra. Prandaj, le t\u00eb mendojm\u00eb se e kuptojm\u00eb q\u00eb monitorimi i brendsh\u00ebm \u00ebsht\u00eb di\u00e7ka e nevojshme dhe tani ka mbetur vet\u00ebm t\u00eb kuptojm\u00eb se si mund ta organizojm\u00eb at\u00eb.<\/p>\n<p>Un\u00eb do t\u00eb ve\u00e7oja tre burime ky\u00e7e t\u00eb t\u00eb dh\u00ebnave p\u00ebr monitorimin e infrastruktur\u00ebs n\u00eb nivelin e rrjetit:<\/p>\n<ul>\n<li>trafiku 'i pap\u00ebrpunuar' q\u00eb ne e kapim dhe i japim p\u00ebr analiz\u00eb sistemeve t\u00eb ndryshme t\u00eb analiz\u00ebs,<\/li>\n<li>ngjarjet nga pajisjet rrjet\u00ebsore p\u00ebrmes t\u00eb cilave kalon trafiku,<\/li>\n<li>informacioni mbi trafikun q\u00eb merret p\u00ebrmes nj\u00eb nga protokollet flow.<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/09c7087593661d5b159ecc9e9ab39d16.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKapja e trafikut t\u00eb pap\u00ebrpunuar \u00ebsht\u00eb opsioni m\u00eb popullor p\u00ebr ekspert\u00ebt e siguris\u00eb, sepse historikisht ka lindur dhe ka qen\u00eb m\u00eb i pari. Sistemet normale t\u00eb zbulimit t\u00eb sulmeve (sistemi i par\u00eb komercial i zbulimit t\u00eb sulmeve ishte NetRanger nga Wheel Group, i bler\u00eb n\u00eb vitin 1998 nga Cisco) ishin t\u00eb fokusuar n\u00eb kapjen e paketeve (dhe m\u00eb von\u00eb edhe seancave), n\u00eb t\u00eb cilat k\u00ebrkoheshin disa n\u00ebnshkrime (\u2018rregullat vendimtare\u2019 n\u00eb terminologjin\u00eb e FSTEK), q\u00eb sinjalizuan p\u00ebr sulmet. Natyrisht, analiza e trafikut t\u00eb pap\u00ebrpunuar mund t\u00eb b\u00ebhet jo vet\u00ebm me IDS, por edhe me mjete t\u00eb tjera (p.sh., Wireshark, tcpdump ose funksionalitetin NBAR2 n\u00eb Cisco IOS), por zakonisht u mungon baza e njohurive q\u00eb e ndan mjetin e siguris\u00eb nga mjetet normale IT.<\/p>\n<p>Pra, sistemet e zbulimit t\u00eb sulmeve. Metoda m\u00eb e vjet\u00ebr dhe m\u00eb popullore p\u00ebr zbuluar sulmet rrjet\u00ebsore, e cila b\u00ebn nj\u00eb pun\u00eb t\u00eb mir\u00eb n\u00eb perimetrin (s\u2019ka r\u00ebnd\u00ebsi cili \u2014 korporativ, QN, segmenti etj.), por d\u00ebshton n\u00eb rrjetet moderne t\u00eb kaluara dhe ato q\u00eb p\u00ebrcaktohen nga softueri. N\u00eb rastin e nj\u00eb rrjeti t\u00eb nd\u00ebrtuar mbi baz\u00ebn e switcheve t\u00eb zakonshme, infrastruktura e sensor\u00ebve t\u00eb zbulimit t\u00eb sulmeve b\u00ebhet tep\u00ebr e madhe \u2014 do t\u2019ju duhet t\u00eb vendosni nj\u00eb sensor p\u00ebr \u00e7do lidhje me nodin q\u00eb d\u00ebshironi t\u00eb monitoroni. \u00c7do prodhues, natyrisht, do t\u00eb ishte i lumtur t'ju shiste qindra dhe mij\u00ebra sensor\u00eb, por mendoj se buxheti juaj nuk do t\u00eb mbijetonte k\u00ebto shpenzime. Mund t\u00eb them se edhe n\u00eb Cisco (dhe ne jemi zhvilluesit e NGIPS) nuk arrit\u00ebm ta realizonim, ndon\u00ebse, duket, \u00e7\u00ebshtja e \u00e7mimit p\u00ebr ne nuk duhet t\u00eb kishte r\u00ebnd\u00ebsi \u2014 p\u00ebrfundimisht, \u00ebsht\u00eb zgjidhja jon\u00eb. P\u00ebr m\u00eb tep\u00ebr, lind nj\u00eb pyetje, si do t\u00eb lidhesh me sensorin n\u00eb k\u00ebt\u00eb variant? N\u00eb nd\u00ebrprerje? Dhe n\u00ebse vet\u00eb sensori d\u00ebshtoj? A duhet t\u00eb k\u00ebrkohet ekzistenca e nj\u00eb moduli bypass n\u00eb sensor? A duhet t\u00eb p\u00ebrdoren ndar\u00ebs (tap)? T\u00eb gjitha k\u00ebto e rrisin \u00e7mimin e zgjidhjes dhe e b\u00ebjn\u00eb t\u00eb pamundur p\u00ebr kompanit\u00eb e \u00e7do madh\u00ebsie.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/4763c13237dbe9ffa38d62075939ffba.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMund t\u00eb provoni \"t\u00eb lidhni\" sensorin n\u00eb portin SPAN\/RSPAN\/ERSPAN dhe t\u00eb drejtoni trafikun nga portet p\u00ebrkat\u00ebse t\u00eb switchit n\u00eb t\u00eb. Kjo zgjidhje pjes\u00ebrisht zgjidh problemin e p\u00ebrshkruar n\u00eb paragrafin e m\u00ebparsh\u00ebm, por sjell nj\u00eb tjet\u00ebr \u2014 porti SPAN nuk mund t\u00eb pranoj\u00eb gjith\u00eb trafikun q\u00eb do t\u2019i drejtohet \u2014 nuk do t\u00eb ket\u00eb mjaft kapacitet. Do t\u00eb detyroheni t\u00eb b\u00ebni disa sakrifica. Ose t\u00eb lini disa pika pa monitorim (at\u00ebher\u00eb duhet t\u00eb b\u00ebni nj\u00eb priorizim t\u00eb tyre paraprakisht), ose t\u00eb drejtoni vet\u00ebm nj\u00eb lloj t\u00eb caktuar t\u00eb trafikut nga pika. N\u00eb \u00e7do rast, mund t\u00eb humbasim disa sulme. P\u00ebr m\u00eb tep\u00ebr, porti SPAN mund t\u00eb jet\u00eb i z\u00ebn\u00eb p\u00ebr nevoja t\u00eb tjera. N\u00eb fund, do t\u00eb duhet t\u00eb rishikojm\u00eb topologjin\u00eb ekzistuese t\u00eb rrjetit dhe ndoshta t\u00eb b\u00ebjm\u00eb disa ndryshime p\u00ebr t\u00eb mbuluar sa m\u00eb shum\u00eb q\u00eb t\u00eb jet\u00eb e mundur rrjetin tuaj me numrin e sensor\u00ebve q\u00eb keni (dhe ta koordinojm\u00eb k\u00ebt\u00eb me IT-n\u00eb).<\/p>\n<p>\u00c7far\u00eb n\u00ebse rrjeti juaj p\u00ebrdor rute asimetrike? \u00c7far\u00eb n\u00ebse keni implementuar ose planifikoni t\u00eb implementoni SDN? \u00c7far\u00eb n\u00ebse duhet t\u00eb monitoroni makinat virtuale ose kontejner\u00ebt, trafiku i t\u00eb cil\u00ebve nuk arrin n\u00eb switchin fizik? K\u00ebto pyetje nuk i p\u00eblqejn\u00eb prodhuesve t\u00eb IDS traditaionale, sepse nuk din\u00eb si t\u2019u japin p\u00ebrgjigje. Ndoshta do t\u2019ju shpjegojn\u00eb se t\u00eb gjitha k\u00ebto teknologji t\u00eb mod\u00ebs jan\u00eb vet\u00ebm nj\u00eb buj\u00eb dhe se nuk keni nevoj\u00eb p\u00ebr to. Ndoshta do t\u00eb flasin p\u00ebr nevoj\u00ebn p\u00ebr t\u00eb filluar nga e para. Ose ndoshta do t\u2019ju thon\u00eb se duhet t\u00eb vendosni nj\u00eb makin\u00eb t\u00eb fuqishme n\u00eb qend\u00ebr t\u00eb rrjetit dhe t\u00eb drejtoni gjith\u00eb trafikun n\u00eb t\u00eb p\u00ebrmes balancuesve. Cilado qoft\u00eb opsioni q\u00eb ju ofrohet, duhet t\u00eb kuptoni qart\u00eb se sa i p\u00ebrshtatet at\u00eb ju. Dhe vet\u00ebm pas k\u00ebsaj, t\u00eb merrni vendimin p\u00ebr qasjen ndaj monitorimit t\u00eb infrastruktur\u00ebs s\u00eb siguris\u00eb kibernetike. Duke u rikthyer te kapja e paketave, dua t\u00eb theksoj se kjo metod\u00eb vazhdon t\u00eb mbetet shum\u00eb popullore dhe e r\u00ebnd\u00ebsishme, por q\u00ebllimi i saj kryesor \u00ebsht\u00eb kontrolli i kufijve; kufijve midis organizat\u00ebs suaj dhe internetit, kufijve midis qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave dhe rrjetit t\u00eb mbetur, kufijve midis sistemit t\u00eb kontrollit dhe segmentit tuaj korporativ. N\u00eb k\u00ebto vende, IDS\/IPS klasike ende kan\u00eb vend dhe b\u00ebjn\u00eb mjaft mir\u00eb pun\u00ebn e tyre.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/7a5898e0aa9e3e9275dda3e2c7b75c5c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00eb kalojm\u00eb n\u00eb opsionin e dyt\u00eb. Analiza e ngjarjeve q\u00eb vin\u00eb nga pajisjet rrjeti gjithashtu mund t\u00eb p\u00ebrdoret p\u00ebr q\u00ebllime zbulimi t\u00eb sulmeve, por jo si mekanizmi kryesor, pasi ajo lejon t\u00eb identifikoni vet\u00ebm nj\u00eb klas\u00eb t\u00eb vog\u00ebl t\u00eb nd\u00ebrhyrjeve. P\u00ebr m\u00eb tep\u00ebr, kjo metod\u00eb \u00ebsht\u00eb paksa reaktive \u2014 sulmi duhet fillimisht t\u00eb ndodhi, pastaj ai duhet t\u00eb regjistrohet nga pajisja rrjetike, e cila n\u00eb nj\u00ebfar\u00eb m\u00ebnyre do t\u00eb sinjalizoj\u00eb p\u00ebr nj\u00eb problem t\u00eb siguris\u00eb kibernetike. Ka disa m\u00ebnyra p\u00ebr k\u00ebt\u00eb. Mund t\u00eb jet\u00eb syslog, RMON ose SNMP. Dy protokollet e fundit p\u00ebr monitorimin e rrjetit n\u00eb kontekst t\u00eb siguris\u00eb kibernetike p\u00ebrdoren vet\u00ebm n\u00ebse na nevojitet t\u00eb zbulojm\u00eb nj\u00eb sulm DoS ndaj vet\u00eb pajisjes rrjetike, pasi me ndihm\u00ebn e RMON dhe SNMP mund t\u00eb monitorojm\u00eb, p\u00ebr shembull, ngarkes\u00ebn e procesorit t\u00eb pajisjes ose t\u00eb interface-ve t\u00eb saj. Kjo \u00ebsht\u00eb nj\u00eb nga m\u00ebnyrat m\u00eb t\u00eb \"lira\" (syslog ose SNMP i ka \u00e7do njeri), por gjithashtu m\u00eb pak e efektshme nga t\u00eb gjitha m\u00ebnyrat p\u00ebr t\u00eb monitoruar sigurin\u00eb kibernetike n\u00eb infrastruktur\u00ebn e brendshme \u2014 shum\u00eb sulme thjesht jan\u00eb t\u00eb fshehta p\u00ebr t\u00eb. Sigurisht, nuk duhet t\u2019i injoroni dhe analiza e syslog ndihmon p\u00ebr t\u00eb identifikuar n\u00eb koh\u00eb ndryshimet n\u00eb konfiguracionin e pajisjes vet\u00eb, kompromitimin e saj, por zbuluar sulme p\u00ebr t\u00eb gjith\u00eb rrjetin, ajo nuk \u00ebsht\u00eb shum\u00eb e p\u00ebrshtatshme.<\/p>\n<p>Opsioni i tret\u00eb \u2014 \u00ebsht\u00eb analiza e informacionit mbi trafikun q\u00eb kalon p\u00ebrmes nj\u00eb pajisjeje q\u00eb mb\u00ebshtet nj\u00eb ose disa protokolle t\u00eb flukseve. N\u00eb k\u00ebt\u00eb rast, pavar\u00ebsisht nga protokolli, infrastruktura e pun\u00ebs me flukse gjithmon\u00eb p\u00ebrb\u00ebhet nga tre komponente:<\/p>\n<ul>\n<li>Generimi ose eksporti i flukseve. Kjo rol zakonisht i atribuohet nj\u00eb routeri, switchi ose nj\u00eb pajisjeje tjet\u00ebr rrjetike, e cila, duke kaluar trafikun rrjetor, mund\u00ebson nxjerrjen e parametrave ky\u00e7, t\u00eb cilat m\u00eb pas d\u00ebrgohen n\u00eb modulin e grumbullimit. P\u00ebr shembull, te Cisco, protokolli Netflow mb\u00ebshtetet jo vet\u00ebm n\u00eb routera dhe switch-e, p\u00ebrfshir\u00eb ato virtuale dhe industriale, por edhe n\u00eb kontroler\u00ebt e pa tel, firewall-at dhe madje edhe n\u00eb servera.<\/li>\n<li>Grumbullimi i flukseve. Duke e pasur parasysh se n\u00eb rrjetet moderne zakonisht ka m\u00eb shum\u00eb se nj\u00eb pajisje rrjetike, krijohet detyra e grumbullimit dhe konsolidimit t\u00eb flukseve, q\u00eb zgjidhet p\u00ebrmes ashtuquajtur\u00ebs kolektor\u00ebve, t\u00eb cil\u00ebt p\u00ebrpunojn\u00eb flukset e pranuara dhe m\u00eb pas i d\u00ebrgojn\u00eb ato p\u00ebr analiz\u00eb.<\/li>\n<li>Analiza e flukseve. Analizatori merr p\u00ebrsip\u00ebr detyr\u00ebn kryesore intelektuale dhe, duke aplikuar algoritme t\u00eb ndryshme n\u00eb flukse, b\u00ebn p\u00ebrfundime t\u00eb ndryshme. P\u00ebr shembull, brenda funksionit IT, nj\u00eb analizator i till\u00eb mund t\u00eb identifikoj\u00eb ngushticat e rrjetit ose t\u00eb analizoj\u00eb profilin e ngarkes\u00ebs s\u00eb trafikut p\u00ebr optimizimin m\u00eb t\u00eb mir\u00eb t\u00eb rrjetit. N\u00eb fush\u00ebn e siguris\u00eb, nj\u00eb analizator i till\u00eb mund t\u00eb zbuloj\u00eb rrjedhjet e t\u00eb dh\u00ebnave, p\u00ebrhapjen e kodeve t\u00eb d\u00ebmshme ose sulmet DoS. <\/li>\n<\/ul>\n<p>Nuk duhet t\u00eb mendoni se nj\u00eb arkitektur\u00eb tre-pal\u00ebshe \u00ebsht\u00eb shum\u00eb e komplikuar \u2014 t\u00eb gjitha variantet e tjera (p\u00ebrve\u00e7, ndoshta, sistemeve t\u00eb monitorimit t\u00eb rrjetit q\u00eb punojn\u00eb me SNMP dhe RMON) gjithashtu funksionojn\u00eb sipas saj. Ne kemi nj\u00eb gjenerator t\u00eb dh\u00ebnash p\u00ebr analiz\u00eb, q\u00eb \u00ebsht\u00eb nj\u00eb pajisje rrjeti ose nj\u00eb sensor i shk\u00ebputur. Kemi nj\u00eb sistem p\u00ebr mbledhjen e sinjalizimeve dhe nj\u00eb sistem p\u00ebr menaxhimin e gjith\u00eb infrastruktur\u00ebs s\u00eb monitorimit. K\u00ebta dy komponent\u00eb t\u00eb fundit mund t\u00eb jen\u00eb t\u00eb bashkuar n\u00eb nj\u00eb nyje, por n\u00eb rrjetet m\u00eb t\u00eb m\u00ebdha zakonisht jan\u00eb t\u00eb shp\u00ebrndara n\u00eb t\u00eb pakt\u00ebn dy pajisje p\u00ebr t\u00eb siguruar shkall\u00ebzim dhe besueshm\u00ebri.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/65de74b0a7556606355f9b176ef7e19c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb krahasim me analiz\u00ebn e paketave, e cila bazohet n\u00eb shqyrtimin e titujve dhe trupit t\u00eb t\u00eb dh\u00ebnave t\u00eb \u00e7do pakete dhe sesioneve t\u00eb p\u00ebrfshira, analiza e flukseve mb\u00ebshtetet n\u00eb mbledhjen e metadatanave mbi trafikun rrjetor. Kur, sa, nga ku dhe ku, si... k\u00ebto jan\u00eb pyetje q\u00eb p\u00ebrgjigjen nga analiza e telemetris\u00eb rrjetore me ndihm\u00ebn e protokolleve t\u00eb ndryshme t\u00eb flukseve. Fillimisht ato u p\u00ebrdor\u00ebn p\u00ebr analizimin e statistikave dhe identifikimin e problemeve IT n\u00eb rrjet, por m\u00eb von\u00eb, me zhvillimin e mekanizmave analitik\u00eb, u b\u00eb e mundur t\u00eb aplikoheshin n\u00eb t\u00eb nj\u00ebjt\u00ebn telemetri p\u00ebr q\u00ebllime sigurie. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se analiza e flukseve nuk z\u00ebvend\u00ebson dhe as anulon kapjen e paketave. \u00c7do nga k\u00ebto metoda ka fush\u00ebn e saj t\u00eb aplikimit. Por n\u00eb kontekstin e k\u00ebtij artikulli, analiza e flukseve \u00ebsht\u00eb m\u00eb e p\u00ebrshtatshme p\u00ebr monitorimin e infrastruktur\u00ebs s\u00eb brendshme. Keni pajisje rrjeti (dhe nuk ka r\u00ebnd\u00ebsi n\u00ebse punojn\u00eb sipas nj\u00eb paradigme t\u00eb p\u00ebrcaktuar nga software ose sipas rregullave statike) q\u00eb sulmi nuk mund ta kaloj\u00eb. Nj\u00eb sensor klasik IDS mund ta anashkaloj\u00eb, por nj\u00eb pajisje rrjeti q\u00eb mb\u00ebshtet protokollin e flukseve nuk mund ta b\u00ebj\u00eb k\u00ebt\u00eb. Kjo \u00ebsht\u00eb avantazhi i k\u00ebtij metodi. <\/p>\n<p>Nga ana tjet\u00ebr, n\u00ebse keni nevoj\u00eb p\u00ebr prova p\u00ebr organet e rendit ose grupin tuaj t\u00eb hetimit t\u00eb incidenteve, nuk mund t\u00eb shmangni kapjen e paketave \u2014 telemetria rrjetore nuk \u00ebsht\u00eb nj\u00eb kopje e trafikut q\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr mbledhjen e provave; ajo nevojitet p\u00ebr zb discover e shpejt\u00eb dhe marrjen e vendimeve p\u00ebr sigurin\u00eb. Nga ana tjet\u00ebr, duke p\u00ebrdorur analiz\u00ebn e telemetris\u00eb, mund t\u00eb \"shkruani\" jo t\u00eb gjith\u00eb trafikun rrjetor (n\u00ebse ndodhet, Cisco dhe qendrat t\u00eb dh\u00ebnash merret me k\u00ebt\u00eb :-), por vet\u00ebm at\u00eb q\u00eb \u00ebsht\u00eb n\u00eb sulm. Mjetet e analiz\u00ebs s\u00eb telemetris\u00eb plot\u00ebsojn\u00eb mir\u00eb mekanizmat tradicionale t\u00eb kapjes s\u00eb paketave, duke dh\u00ebn\u00eb nj\u00eb komand\u00eb p\u00ebr kapjen dhe ruajtjen selektive. Ndryshe, do t'ju duhet nj\u00eb infrastrukture kolosale p\u00ebr ruajtje.<\/p>\n<p>Le t\u00eb imagjinojm\u00eb nj\u00eb rrjet q\u00eb punon me nj\u00eb shpejt\u00ebsi prej 250 Mbit\/s. N\u00ebse d\u00ebshironi t\u00eb ruani gjith\u00eb k\u00ebt\u00eb volum, do t'ju nevojitet nj\u00eb ruajtje prej 31 MB p\u00ebr nj\u00eb sekond\u00eb transmetimi t\u00eb trafikut, 1.8 GB p\u00ebr nj\u00eb minut\u00eb, 108 GB p\u00ebr nj\u00eb or\u00eb dhe 2.6 TB p\u00ebr nj\u00eb dit\u00eb. P\u00ebr t\u00eb ruajtur t\u00eb dh\u00ebnat ditore nga nj\u00eb rrjet me kapacitet prej 10 Gbit\/s, do t'ju nevojitet nj\u00eb ruajtje prej 108 TB. Disa rregullator\u00eb k\u00ebrkojn\u00eb ruajtjen e t\u00eb dh\u00ebnave p\u00ebr sigurin\u00eb p\u00ebr vite t\u00eb t\u00ebra... Ruajta \"n\u00eb k\u00ebrkes\u00eb\", q\u00eb ju ndihmon t\u00eb realizoni analiza e flukseve, ndihmon n\u00eb reduktimin e k\u00ebtyre vlerave me nj\u00eb rend t\u00eb madh. P\u00ebr m\u00eb tep\u00ebr, n\u00ebse flisni p\u00ebr raportin e sasis\u00eb s\u00eb t\u00eb dh\u00ebnave t\u00eb regjistruara t\u00eb telemetris\u00eb rrjetore dhe kapjen e plot\u00eb t\u00eb t\u00eb dh\u00ebnave, ai \u00ebsht\u00eb rreth 1 ndaj 500. P\u00ebr vlerat e lartp\u00ebrmendura, ruajtja e dekodimit t\u00eb plot\u00eb t\u00eb gjith\u00eb trafikut ditor do t\u00eb jet\u00eb respektivisht 5 dhe 216 GB (madje mund ta regjistroni edhe n\u00eb nj\u00eb USB t\u00eb zakonshme).<\/p>\n<p>N\u00ebse metoda e kapjes s\u00eb t\u00eb dh\u00ebnave t\u00eb pap\u00ebrpunuara t\u00eb rrjetit pothuajse nuk ndryshon nga nj\u00eb ofrues n\u00eb tjetrin p\u00ebr mjetet e analiz\u00ebs, situata \u00ebsht\u00eb ndryshe kur b\u00ebhet fjal\u00eb p\u00ebr analiz\u00ebn e rrjedhave. Ekzistojn\u00eb disa lloje protokollesh t\u00eb rrjedhave, p\u00ebr t\u00eb cilat \u00ebsht\u00eb thelb\u00ebsore t\u00eb njihni ndryshimet n\u00eb kontekstin e siguris\u00eb. Protokolli m\u00eb i njohur \u00ebsht\u00eb Netflow, i zhvilluar nga Cisco. Ekzistojn\u00eb disa versione t\u00eb k\u00ebtij protokolli, t\u00eb cilat ndryshojn\u00eb sipas mund\u00ebsive dhe sasis\u00eb s\u00eb informacionit n\u00eb lidhje me trafikun q\u00eb regjistrohet. Versioni aktual \u00ebsht\u00eb i n\u00ebnti (Netflow v9), mbi t\u00eb cilin \u00ebsht\u00eb zhvilluar standardi industrial Netflow v10, i njohur gjithashtu si IPFIX. Sot, shumica e ofruesve t\u00eb rrjeteve mb\u00ebshtesin pik\u00ebrisht Netflow ose IPFIX n\u00eb pajisjet e tyre. Megjithat\u00eb, ka edhe disa opsione t\u00eb tjera p\u00ebr protokollet e rrjedhave \u2014 sFlow, jFlow, cFlow, rFlow, NetStream etj., nd\u00ebr t\u00eb cil\u00ebt m\u00eb i njohuri \u00ebsht\u00eb sFlow. Ky i fundit shpesh mb\u00ebshtetet nga prodhuesit vendas t\u00eb pajisjeve rrjet, p\u00ebr shkak t\u00eb leht\u00ebsis\u00eb s\u00eb implementimit. Cilat jan\u00eb ndryshimet kryesore midis Netflow, i cili \u00ebsht\u00eb b\u00ebr\u00eb nj\u00eb standard de facto, dhe sFlow? Un\u00eb do t\u00eb ve\u00e7oja disa. S\u00eb pari, Netflow ka fusha t\u00eb personalizuara nga p\u00ebrdoruesi, n\u00eb krahasim me fushat fikse n\u00eb sFlow. S\u00eb dyti, dhe kjo \u00ebsht\u00eb m\u00eb e r\u00ebnd\u00ebsishmja p\u00ebr ne, sFlow mbledh at\u00eb q\u00eb quhet telemetri e samp\u00eblluar; n\u00eb kontrast me telemetrin\u00eb e mosmamp\u00eblluar n\u00eb Netflow dhe IPFIX. Cila \u00ebsht\u00eb diferenca midis tyre?<\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/96782b57ccaddd731d5084c127076d49.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nImagjinoni se keni vendosur t\u00eb njiheni me librin \u201c<noindex><a rel=\"nofollow\" href=\"http:\/\/www.ciscopress.com\/store\/security-operations-center-building-operating-and-maintaining-9780134052014\">Security Operations Center: Building, Operating, and Maintaining your SOC<\/a><\/noindex>\u201d nga koleg\u00ebt e mi \u2014 Gary Makintyre, Joseph Munizza dhe Nadem Alfardan (n\u00eb lidhje, mund t\u00eb shkarkoni nj\u00eb pjes\u00eb t\u00eb librit). Keni tre mund\u00ebsi p\u00ebr t\u00eb arritur q\u00ebllimin e caktuar \u2014 t\u00eb lexoni librin n\u00eb t\u00ebr\u00ebsi, ta kaloni shpejt at\u00eb, duke u ndalur n\u00eb \u00e7do faqe t\u00eb 10-t\u00eb ose 20-t\u00eb, ose t\u00eb provoni t\u00eb gjejni nj\u00eb p\u00ebrmbledhje t\u00eb koncepteve ky\u00e7e n\u00eb ndonj\u00eb blog ose sh\u00ebrbim si SmartReading. K\u00ebshtu, telemetria e mosmamp\u00eblluar \u00ebsht\u00eb leximi i \u00e7do \u201cfaqe\u201d t\u00eb trafikut t\u00eb rrjetit, dmth analiza e t\u00eb dh\u00ebnave meta p\u00ebr \u00e7do paket\u00eb. Telemetria e samp\u00eblluar \u00ebsht\u00eb studimi i p\u00ebrzgjedhur i trafikut me shpres\u00ebn se n\u00eb mostrat e zgjedhura do t\u00eb jet\u00eb ajo q\u00eb ju nevojitet. Sipas shpejt\u00ebsis\u00eb s\u00eb kanalit, telemetria e samp\u00eblluar do t\u00eb d\u00ebrgoj\u00eb p\u00ebr analiz\u00eb \u00e7do 64-t\u00eb, 200-t\u00eb, 500-t\u00eb, 1000-t\u00eb, 2000-t\u00eb ose madje 10000-t\u00eb paket\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/28b798498a11a5e6f72ef847ea2dbaaa.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb kontekstin e monitorimit t\u00eb siguris\u00eb s\u00eb informacionit, kjo do t\u00eb thot\u00eb se telemetria e samp\u00eblluar \u00ebsht\u00eb e p\u00ebrshtatshme p\u00ebr zbule t\u00eb sulmeve DDoS, skanime, shp\u00ebrndarje t\u00eb d\u00ebmtueseve, por mund t\u00eb humbas\u00eb sulmet atomike ose shum\u00ebpaket\u00ebshe, t\u00eb cilat nuk bien n\u00eb mostrat e d\u00ebrguara p\u00ebr analiz\u00eb. Telemetria e mosmamp\u00eblluar nuk ka k\u00ebto mang\u00ebsi dhe me ndihm\u00ebn e saj, spektri i sulmeve t\u00eb zbulueshme \u00ebsht\u00eb shum\u00eb m\u00eb i gjer\u00eb. Ja nj\u00eb list\u00eb e vog\u00ebl e ngjarjeve q\u00eb mund t\u00eb zbulohen p\u00ebrmes mjeteve t\u00eb analiz\u00ebs s\u00eb telemetris\u00eb s\u00eb rrjetit.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/be3a11d4826978d9c882074f22ee97c1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNatyrisht, ndonj\u00eb analizues Netflow me burim t\u00eb hapur nuk do t'ju lejoj\u00eb k\u00ebt\u00eb, pasi detyra e tij kryesore \u00ebsht\u00eb t\u00eb mbledh\u00eb telemetrin\u00eb dhe t\u00eb kryej\u00eb nj\u00eb analiz\u00eb bazike nga perspektiva IT. P\u00ebr t\u00eb zbuluar k\u00ebrc\u00ebnimet e siguris\u00eb s\u00eb informacionit n\u00eb baz\u00eb t\u00eb rrjedh\u00ebs, \u00ebsht\u00eb e nevojshme t\u00eb pajisni analizuesin me motor\u00eb dhe algoritmo q\u00eb do t\u00eb identifikojn\u00eb problemet e kibernetik\u00ebs mbi baz\u00ebn e fushave standarde ose t\u00eb personalizuara t\u00eb Netflow, duke pasuruar t\u00eb dh\u00ebnat standarde me informacione nga burime t\u00eb ndryshme t\u00eb Inteligjenc\u00ebs s\u00eb K\u00ebrc\u00ebnimit etj.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/60e876dbfbdffd160e9899f87aa6303c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPrandaj, n\u00ebse keni nj\u00eb zgjedhje, ndaluni te Netflow ose IPFIX. Por madje edhe n\u00ebse pajisjet tuaja punojn\u00eb vet\u00ebm me sFlow, si\u00e7 \u00ebsht\u00eb rasti me prodhuesit vendas, madje n\u00eb k\u00ebt\u00eb rast mund t\u00eb nxirrni p\u00ebrfitime nga kjo n\u00eb kontekstin e siguris\u00eb. <\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/ee75809ccde4f366ca5f5ead7beed58c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb ver\u00ebn e vitit 2019, un\u00eb kam b\u00ebr\u00eb nj\u00eb analiz\u00eb t\u00eb mund\u00ebsive q\u00eb kan\u00eb prodhuesit rus\u00eb t\u00eb pajisjeve rrjet dhe t\u00eb gjith\u00eb ata, p\u00ebrve\u00e7 NSG, Poligon dhe Kraftway, deklaruan mb\u00ebshtetje p\u00ebr sFlow (t\u00eb pakt\u00ebn, Zelax, Natex, Eltex, QTech, Rusteletech). <\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/acd1ed477af59e1439d941374c596d16.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPyetti pyetje tjet\u00ebr q\u00eb do t'ju shfaqet \u00ebsht\u00eb: ku duhet t\u00eb implementoni mb\u00ebshtetje p\u00ebr flow p\u00ebr q\u00ebllime sigurie? N\u00eb t\u00eb v\u00ebrtet\u00eb, pyetjeja \u00ebsht\u00eb e formulua pak sa gabim. N\u00eb paisjet moderne, mb\u00ebshtetje p\u00ebr protokollet flow \u00ebsht\u00eb pothuajse gjithmon\u00eb e pranishme. Prandaj, do ta riformuloja pyetjen ndryshe: ku \u00ebsht\u00eb m\u00eb efektive t\u00eb mblidhni telemetrin\u00eb nga pik\u00ebpamja e siguris\u00eb? P\u00ebrgjigja \u00ebsht\u00eb mjaft e qart\u00eb: n\u00eb nivelin e aksesit, ku do t\u00eb shihni 100% t\u00eb gjith\u00eb trafik\u00ebve, ku do t\u00eb keni informacion t\u00eb detajuar p\u00ebr hostet (MAC, VLAN, ID e interfaces), ku do t\u00eb mund t\u00eb ndiqni madje trafikun P2P midis hosteve, q\u00eb \u00ebsht\u00eb kritik p\u00ebr zbules\u00ebn e skanimit dhe p\u00ebrhapjen e kodit t\u00eb d\u00ebmsh\u00ebm. N\u00eb nivelin e b\u00ebrtham\u00ebs, nj\u00eb pjes\u00eb e trafikut mund t\u00eb mos e shihni, dhe n\u00eb nivelin e perimetrin do t\u00eb shihni ndoshta nj\u00eb t\u00eb kat\u00ebrt\u00ebn e gjith\u00eb trafikut tuaj rrjetor. Por n\u00ebse p\u00ebr ndonj\u00eb arsye, n\u00eb rrjetin tuaj jan\u00eb vendosur pajisje t\u00eb huaja, duke lejuar sulmuesit t\u00eb \"hyjn\u00eb dhe dalin\" duke anashkaluar perimetrin, at\u00ebher\u00eb analiza e telemetris\u00eb nga ai do t'ju jap\u00eb asgj\u00eb. Prandaj, p\u00ebr mbulimin maksimal, rekomandohet q\u00eb t\u00eb p\u00ebrfshihet mbledhja e telemetris\u00eb pik\u00ebrisht n\u00eb nivelin e aksesit. N\u00eb k\u00ebt\u00eb kuptim, duhet t\u00eb theksohet se madje edhe kur flasim p\u00ebr virtualizimin ose kontejner\u00ebt, n\u00eb switch-at virtual modern zakonisht ka mb\u00ebshtetje p\u00ebr flow, q\u00eb lejon kontrollimin e trafik\u00ebve edhe atje.<\/p>\n<p>Por, q\u00eb ngaq\u00eb e ngrita tem\u00ebn, duhet t'i p\u00ebrgjigjem pyetjes: \u00e7far\u00eb ndodh n\u00ebse paisja, fizike ose virtuale, nuk mb\u00ebshtet protokollet flow? Ose aktivizimi i saj ndalohet (p\u00ebr shembull, n\u00eb segmentet industriale p\u00ebr t\u00eb garantuar q\u00ebndrueshm\u00ebrin\u00eb)? Ose aktivizimi i saj shkakton ngarkes\u00eb t\u00eb lart\u00eb n\u00eb procesorin e qendr\u00ebs (n\u00eb pajisje t\u00eb vjetra ndodh kjo)? P\u00ebr t\u00eb zgjidhur k\u00ebt\u00eb problem ekzistojn\u00eb sensor\u00eb t\u00eb specializuar virtual\u00eb (flow sensor), t\u00eb cil\u00ebt n\u00eb thelb jan\u00eb thjesht ndar\u00ebs q\u00eb kalojn\u00eb trafik dhe e transmetojn\u00eb at\u00eb n\u00eb form\u00ebn e flow p\u00ebr modulin e mbledhjes. Megjithat\u00eb, n\u00eb k\u00ebt\u00eb rast ne p\u00ebrballeshim me gjithsej problemet, t\u00eb cilat i diskutonim m\u00eb par\u00eb n\u00eb lidhje me mjetet e kapjes s\u00eb paketave. K\u00ebshtu, duhet t\u00eb kuptoni jo vet\u00ebm p\u00ebrfitimet e teknologjis\u00eb p\u00ebr analiz\u00ebn e flukseve, por edhe kufizimet e saj.<\/p>\n<p>Nj\u00eb tjet\u00ebr moment i r\u00ebnd\u00ebsish\u00ebm q\u00eb duhet mbajtur mend, kur flasim p\u00ebr mjetet e analiz\u00ebs s\u00eb flukseve. N\u00ebse n\u00eb lidhje me mjetet e zakonshme t\u00eb gjenerimit t\u00eb ngjarjeve t\u00eb sigurimit ne p\u00ebrdorim metrik\u00ebn EPS (ngjarje p\u00ebr sekond\u00eb), at\u00ebher\u00eb p\u00ebr analiz\u00ebn e telemetris\u00eb ky tregues nuk \u00ebsht\u00eb i zbatuesh\u00ebm; ai z\u00ebvend\u00ebsohet me FPS (flow p\u00ebr sekond\u00eb). Ashtu si n\u00eb rastin e EPS, nuk \u00ebsht\u00eb e mundur ta llogarisni paraprakisht, por mund t\u00eb vler\u00ebsoni numrin e p\u00ebraf\u00ebrt t\u00eb flukseve q\u00eb gjeneron nj\u00eb pajisje e caktuar sipas detyr\u00ebs s\u00eb saj. N\u00eb Internet mund t\u00eb gjeni tabela me vlera p\u00ebraf\u00ebrsisht p\u00ebr lloje t\u00eb ndryshme t\u00eb pajisjeve korporative dhe kushteve, q\u00eb do t'ju lejoj\u00eb t\u00eb flisni p\u00ebr licencat q\u00eb ju nevojiten p\u00ebr mjetet e analiz\u00ebs dhe si do t\u00eb jet\u00eb arkitektura e tyre. Problemi \u00ebsht\u00eb se sensori IDS \u00ebsht\u00eb i kufizuar n\u00eb nj\u00eb kapacitet t\u00eb caktuar kalimi q\u00eb do t\u00eb \"p\u00ebrthith\u00eb\" dhe gjithashtu mbledh\u00ebsi i flukseve ka kufizimet e veta q\u00eb duhet t\u00eb kuptoni. Prandaj, n\u00eb rrjetet e m\u00ebdha, t\u00eb shp\u00ebrndara territorialisht zakonisht ka disa mbledh\u00ebs. Kur e p\u00ebrshkrova, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/348532\/\">si monitorohet rrjeti brenda Cisco<\/a><\/noindex>, un\u00eb p\u00ebrmenda numrin e mbledh\u00ebsve tan\u00eb - jan\u00eb 21. Dhe kjo \u00ebsht\u00eb p\u00ebr nj\u00eb rrjet, t\u00eb shp\u00ebrndar\u00eb mbi pes\u00eb kontinente dhe q\u00eb ka rreth gjysm\u00eb milioni pajisje aktive).<\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/a5935ef7f7a3511cbf291fce59e96d71.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSi sistem monitorimi Netflow ne p\u00ebrdorim zgjidhjen ton\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/ru_ru\/products\/security\/stealthwatch\/index.html\">Cisco Stealthwatch<\/a><\/noindex>, i cili \u00ebsht\u00eb ve\u00e7an\u00ebrisht i orientuar drejt zgjidhjes s\u00eb problemeve t\u00eb siguris\u00eb. Ai ka shum\u00eb motor\u00eb t\u00eb integruar t\u00eb zbulimit t\u00eb aktiviteteve anomale, dyshuese dhe duksh\u00ebm shp\u00ebrthyese, duke lejuar identifikimin e nj\u00eb gama t\u00eb gjer\u00eb k\u00ebrc\u00ebnimesh - nga minimi i kriptove deri te rrjedhjet e informacionit, nga shp\u00ebrndarja e kodeve keqja deri te mashtrimi. Ashtu si shumica e analizator\u00ebve t\u00eb rrjedhjeve, Stealthwatch \u00ebsht\u00eb nd\u00ebrtuar mbi nj\u00eb skem\u00eb me tre nivele (generator - kolektor - analizues), por \u00ebsht\u00eb i plot\u00ebsuar me nj\u00eb s\u00ebr\u00eb karakteristikash interesante q\u00eb jan\u00eb t\u00eb r\u00ebnd\u00ebsishme n\u00eb kontekstin e materialeve t\u00eb shqyrtuara. S\u00eb pari, ai integrohet me zgjidhjet e kapjes s\u00eb paketave (p.sh., Cisco Security Packet Analyzer), duke lejuar regjistrimin e sesioneve t\u00eb zgjedhura p\u00ebr hetim dhe analiz\u00eb t\u00eb thell\u00eb. S\u00eb dyti, p\u00ebr t\u00eb zgjeruar detyrat e siguris\u00eb, ne zhvilluam nj\u00eb protokoll t\u00eb ve\u00e7ant\u00eb nvzFlow, i cili lejon 'transmetimin' e aktiviteteve t\u00eb aplikacioneve n\u00eb nyjet fundit (servera, stacione pune etj.) n\u00eb telemetri dhe ta d\u00ebrgoj\u00eb at\u00eb n\u00eb kolektor p\u00ebr analiz\u00eb t\u00eb m\u00ebtejshme. N\u00eb variantin e tij origjinal, Stealthwatch punon me \u00e7do protokoll rrjedhjeje (sFlow, rFlow, Netflow, IPFIX, cFlow, jFlow, NetStream) n\u00eb nivelin e rrjetit, nd\u00ebrsa mb\u00ebshtetja p\u00ebr nvzFlow lejon korelacionin e t\u00eb dh\u00ebnave gjithashtu n\u00eb nivelin e nyj\u00ebs, duke rritur k\u00ebshtu efikasitetin e gjith\u00eb sistemit dhe duke par\u00eb m\u00eb shum\u00eb sulme sesa analizator\u00ebt e zakonsh\u00ebm t\u00eb rrjedhjeve t\u00eb rrjetit.<\/p>\n<p>E qart\u00eb, kur flasim p\u00ebr sistemet e analiz\u00ebs s\u00eb Netflow nga perspektiva e siguris\u00eb, tregu nuk \u00ebsht\u00eb i kufizuar vet\u00ebm n\u00eb nj\u00eb zgjidhje nga Cisco. Ju mund t\u00eb p\u00ebrdorni si zgjidhje komerciale ashtu edhe ato falas ose me kushte t\u00eb caktuara. M\u00eb duket e \u00e7uditshme n\u00ebse un\u00eb n\u00eb blogun e Cisco do t'i jap shembuj zgjidhjesh konkurrent\u00ebsh, prandaj do t\u00eb them disa fjal\u00eb se si telemetria e rrjetit mund t\u00eb analizoh\u00ebt me dy mjete t\u00eb njohura, q\u00eb kan\u00eb emra t\u00eb ngjash\u00ebm, por gjithsesi jan\u00eb t\u00eb ndryshme - SiLK dhe ELK.<\/p>\n<p>SiLK \u00ebsht\u00eb nj\u00eb grup mjetesh (the System for Internet-Level Knowledge) p\u00ebr analiz\u00ebn e trafikut, i zhvilluar nga CERT\/CC n\u00eb Amerik\u00eb dhe q\u00eb mb\u00ebshtet, n\u00eb kontekstin e k\u00ebtij artikulli, Netflow (versionet m\u00eb t\u00eb njohura 5 dhe 9), IPFIX dhe sFlow, dhe me an\u00eb t\u00eb utilitarian\u00eb t\u00eb ndrysh\u00ebm (rwfilter, rwcount, rwflowpack etj.) kryen operacione t\u00eb ndryshme mbi telemetrin\u00eb e rrjetit me q\u00ebllim zbulimin e shenjave t\u00eb veprimeve t\u00eb paautorizuara. Por duhet t\u00eb theksoj disa pika t\u00eb r\u00ebnd\u00ebsishme. SiLK \u00ebsht\u00eb nj\u00eb mjet linj\u00eb komande dhe t\u00eb kryesh nj\u00eb analiz\u00eb operative, gjithmon\u00eb duke futur komanda t\u00eb tilla (zbulimi i paketave ICMP m\u00eb t\u00eb m\u00ebdha se 200 byte):<\/p>\n<p><code>rwfilter --flowtypes=all\/all --proto=1 --bytes-per-packet=200- --pass=stdout | rwrwcut --fields=sIP,dIP,iType,iCode --num-recs=15<\/code><\/p>\n<p>nuk \u00ebsht\u00eb shum\u00eb e p\u00ebrshtatshme. Ju mund t\u00eb p\u00ebrdorni nd\u00ebrfaqen grafike iSiLK, por ajo nuk do t'ju leht\u00ebsoj\u00eb jet\u00ebn shum\u00eb, duke e zgjidhur vet\u00ebm funksionin e vizualizimit, jo z\u00ebvend\u00ebsimin e analistit. Dhe kjo \u00ebsht\u00eb pika tjet\u00ebr. Ndryshe nga zgjidhjet komerciale, t\u00eb cilat tashm\u00eb kan\u00eb nj\u00eb baz\u00eb t\u00eb fort\u00eb analitike, algoritmet e zbulimit t\u00eb anomalis\u00eb, p\u00ebrkat\u00ebsit\u00eb e pun\u00ebs s\u00eb rrjedh\u00ebs etj., n\u00eb rastin e SiLK, ju duhet t'i b\u00ebni t\u00eb gjitha k\u00ebto vet\u00eb, gj\u00eb q\u00eb do t'ju k\u00ebrkoj\u00eb kompetenca t\u00eb ndryshme nga p\u00ebrdorimi i mjeteve tashm\u00eb t\u00eb gatshme p\u00ebr pun\u00eb. Kjo nuk \u00ebsht\u00eb e keqe dhe as e mir\u00eb - \u00ebsht\u00eb nj\u00eb karakteristik\u00eb e pothuajse \u00e7do instrumenti falas, i cili l\u00eb konceptin se ju e dini se \u00e7far\u00eb t\u00eb b\u00ebni, dhe ai vet\u00ebm ju ndihmon n\u00eb k\u00ebt\u00eb (instrumenti komercial \u00ebsht\u00eb m\u00eb pak varur nga kompetencat e p\u00ebrdoruesve, edhe pse gjithashtu supozon q\u00eb analist\u00ebt e kuptojn\u00eb t\u00eb pakt\u00ebn bazat e zhvillimit t\u00eb hetimeve n\u00eb rrjet dhe monitorimin). Por le t\u00eb kthehemi te SiLK. Cikli i pun\u00ebs i analistit me t\u00eb duket si kjo:<\/p>\n<ul>\n<li>Formulimi i hipotez\u00ebs. Duhet t\u00eb kuptojm\u00eb se \u00e7far\u00eb do t\u00eb k\u00ebrkojm\u00eb brenda telemetris\u00eb s\u00eb rrjetit, t\u00eb dim\u00eb atributet unike sipas t\u00eb cilave do t\u00eb identifikojm\u00eb anomali ose k\u00ebrc\u00ebnime t\u00eb caktuara.<\/li>\n<li>Nd\u00ebrtimi i modelit. Pas formulimit t\u00eb hipotez\u00ebs, ne e programojm\u00eb at\u00eb me an\u00eb t\u00eb Python, shell ose mjete t\u00eb tjera q\u00eb nuk jan\u00eb pjes\u00eb e SiLK.<\/li>\n<li>\u0422\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435. \u041d\u0430\u0441\u0442\u0443\u043f\u0430\u0435\u0442 \u0447\u0435\u0440\u0435\u0434 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0448\u0435\u0439 \u0433\u0438\u043f\u043e\u0442\u0435\u0437\u044b, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f \u0438\u043b\u0438 \u043e\u043f\u0440\u043e\u0432\u0435\u0440\u0433\u0430\u0435\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0442\u0438\u043b\u0438\u0442 SiLK, \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u0441 &#8216;rw&#8217;, &#8216;set&#8217;, &#8216;bag&#8217;.<\/li>\n<li>Analiza e t\u00eb dh\u00ebnave reale. N\u00eb p\u00ebrdorim industrial, SiLK na ndihmon t\u00eb zbulojm\u00eb di\u00e7ka dhe analisti duhet t\u00eb p\u00ebrgjigjet n\u00eb pyetje si 'A e gjet\u00ebm at\u00eb q\u00eb supozonim?', 'A \u00ebsht\u00eb kjo n\u00eb p\u00ebrputhje me hipotez\u00ebn ton\u00eb?', 'Si do ta ul\u00eb k\u00ebt\u00eb numrin e rremeve?', 'Si t\u00eb p\u00ebrmir\u00ebsojm\u00eb nivelin e njohjes?' etj.<\/li>\n<li>P\u00ebrmir\u00ebsimi. N\u00eb faz\u00ebn finale ne p\u00ebrmir\u00ebsojm\u00eb at\u00eb q\u00eb kemi b\u00ebr\u00eb m\u00eb par\u00eb - krijojm\u00eb shabllone, p\u00ebrmir\u00ebsojm\u00eb dhe optimizojm\u00eb kodin, riprogramojm\u00eb dhe sakt\u00ebsojm\u00eb hipotez\u00ebn etj.<\/li>\n<\/ul>\n<p>Kyri i k\u00ebtij procesi do t\u00eb jet\u00eb po aq i aplikuesh\u00ebm edhe p\u00ebr Cisco Stealthwatch, por ky i fundit automatizon k\u00ebto pes\u00eb hapa n\u00eb maksimum, duke ulur numrin e gabimeve t\u00eb analist\u00ebve dhe duke rritur shpejt\u00ebsin\u00eb e identifikimit t\u00eb incidenteve. P\u00ebr shembull, n\u00eb SiLK, statistik\u00ebn e rrjetit mund ta pasuroni me t\u00eb dh\u00ebna t\u00eb jashtme p\u00ebr IP-t\u00eb e d\u00ebmshme duke p\u00ebrdorur skripte t\u00eb shkruara nga vet\u00eb, nd\u00ebrsa n\u00eb Cisco Stealthwatch kjo \u00ebsht\u00eb nj\u00eb funksion i nd\u00ebrtuar q\u00eb menj\u00ebher\u00eb ju tregon alarmin n\u00ebse n\u00eb trafikun e rrjetit ka nd\u00ebrveprim me adresa IP nga lista e zez\u00eb.<\/p>\n<p>N\u00ebse shkoni m\u00eb lart n\u00eb piramid\u00ebn e softuer\u00ebve p\u00ebr analizimin e flukseve, pas SiLK krejt\u00ebsisht falas, do t\u00eb vij\u00eb ELK q\u00eb \u00ebsht\u00eb kushtuar pjes\u00ebrisht, e p\u00ebrb\u00ebr\u00eb nga tre komponente kryesore \u2014 Elasticsearch (indeksimi, k\u00ebrkimi dhe analizimi i t\u00eb dh\u00ebnave), Logstash (input\/output i t\u00eb dh\u00ebnave) dhe Kibana (vizualizimi). Ndryshe nga SiLK, ku duhet t\u00eb shkruani gjith\u00e7ka vet\u00eb, ELK ka shum\u00eb biblioteka\/module t\u00eb gatshme (disa jan\u00eb me pages\u00eb, disa jo) q\u00eb automatizojn\u00eb analizimin e telemetris\u00eb rrjetore. P\u00ebr shembull, filtri GeoIP n\u00eb Logstash lejon lidhjen e IP-ve t\u00eb v\u00ebzhguara me vendndodhjen e tyre gjeografike (dhe kjo \u00ebsht\u00eb nj\u00eb funksion i nd\u00ebrtuar n\u00eb Stealthwatch).<\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/addd9d9656f64f81d86a0cce8ee0810b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nELK gjithashtu ka nj\u00eb komunitet t\u00eb konsideruesh\u00ebm q\u00eb shkruan komponente t\u00eb humbura p\u00ebr k\u00ebt\u00eb zgjidhje monitorimi. P\u00ebr shembull, p\u00ebr t\u00eb punuar me Netflow, IPFIX dhe sFlow, mund t\u00eb p\u00ebrdorni modul <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/robcowart\/elastiflow\">elastiflow<\/a><\/noindex>, n\u00ebse nuk jeni t\u00eb k\u00ebnaqur me Modulin Netflow t\u00eb Logstash, i cili mb\u00ebshtet vet\u00ebm Netflow.<\/p>\n<p>Duke ofruar m\u00eb shum\u00eb shpejt\u00ebsi n\u00eb mbledhjen e flukseve dhe k\u00ebrkimin n\u00eb to, ELK aktualisht nuk ka nj\u00eb analiz\u00eb t\u00eb pasur t\u00eb nd\u00ebrtuar p\u00ebr identifikimin e anomaliave dhe k\u00ebrc\u00ebnimeve n\u00eb telemetrin\u00eb rrjetore. Pra, duke ndjekur ciklin e jet\u00ebs t\u00eb p\u00ebrshkruar m\u00eb lart, do t\u00eb duhet t\u00eb p\u00ebrshkruani vet\u00eb modelet e shkeljeve dhe pastaj t'i p\u00ebrdorni ato n\u00eb sistemin e prodhimit (nuk ka modele t\u00eb nd\u00ebrtuara atje).<\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/6d8368f4c130c3a5770890cb6c5fe5ab.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNatyrisht, ekzistojn\u00eb gjithashtu shtesa m\u00eb t\u00eb sofistikuara p\u00ebr ELK, n\u00eb t\u00eb cilat jan\u00eb t\u00eb nd\u00ebrtuara disa modele t\u00eb identifikimit t\u00eb anomaliave n\u00eb telemetrin\u00eb rrjetore, por k\u00ebto shtesa kushtojn\u00eb para dhe k\u00ebtu \u00ebsht\u00eb nj\u00eb pyetje, a ia vlen t\u00eb marr\u00ebsh nj\u00eb model t\u00eb ngjash\u00ebm vet\u00eb, ta blesh implementimin p\u00ebr mjetin tuaj t\u00eb monitorimit ose t\u00eb blesh nj\u00eb zgjidhje t\u00eb gatshme t\u00eb klas\u00ebs Analiz\u00ebs s\u00eb Trafikut Rrjet.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/d938ebb4271c4dfb73a1e4b6e94c91d6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb t\u00eb v\u00ebrtet\u00eb, nuk dua t\u00eb hyj n\u00eb polemik\u00eb mbi at\u00eb q\u00eb \u00ebsht\u00eb m\u00eb mir\u00eb, t\u00eb harxhosh para dhe t\u00eb blesh nj\u00eb zgjidhje t\u00eb gatshme p\u00ebr monitorimin e anomaliave dhe k\u00ebrc\u00ebnimeve n\u00eb telemetrin\u00eb rrjetore (p\u00ebr shembull, Cisco Stealthwatch) ose t\u00eb merresh vete dhe t\u00eb zhvillosh modelet p\u00ebr \u00e7do k\u00ebrc\u00ebnim t\u00eb ri, duke p\u00ebrdorur SiLK, ELK ose nfdump ose OSU Flow Tools (po flas p\u00ebr dy t\u00eb fundit nga k\u00ebto <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/348532\/\">kam folur<\/a><\/noindex> her\u00ebn e kaluar)? \u00c7do kush zgjedh p\u00ebr vete dhe \u00e7do njeri ka motivet e tij p\u00ebr t\u00eb zgjedhur ndonj\u00eb nga t\u00eb dyja opsionet. Un\u00eb thjesht d\u00ebshiroja t\u00eb tregoja se telemetria rrjetore \u00ebsht\u00eb nj\u00eb mjet shum\u00eb i r\u00ebnd\u00ebsish\u00ebm p\u00ebr sigurimin e siguris\u00eb s\u00eb rrjetit t\u00eb infrastruktur\u00ebs tuaj t\u00eb brendshme dhe nuk duhet ta injoroni at\u00eb, n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb mos p\u00ebrfshiheni n\u00eb list\u00ebn e kompanive, emri i t\u00eb cilave p\u00ebrmendet n\u00eb media me epitete si \"e sulmuar\", \"nuk ka p\u00ebrmbushur k\u00ebrkesat p\u00ebr siguri\", \"nuk mendon p\u00ebr sigurin\u00eb e t\u00eb dh\u00ebnave t\u00eb saj dhe t\u00eb dh\u00ebnave t\u00eb klient\u00ebve.\"<\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/de7df67df66b7abe89170c7f92fcefca.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDuke p\u00ebrmbledhur, do doja t\u00eb rendis disa k\u00ebshilla ky\u00e7e q\u00eb duhet t\u00eb ndiqni kur ndihmoni n\u00eb ngritjen e monitorimit t\u00eb siguris\u00eb s\u00eb informacionit n\u00eb infrastruktur\u00ebn tuaj t\u00eb brendshme:<\/p>\n<ol>\n<li>Mos u kufizoni vet\u00ebm n\u00eb perimetrin! P\u00ebrdorni (dhe zgjidhni) infrastruktur\u00ebn rrjetore jo vet\u00ebm p\u00ebr transferimin e trafikut nga pika A n\u00eb pik\u00ebn B, por edhe p\u00ebr zgjidhjen e \u00e7\u00ebshtjeve t\u00eb siguris\u00eb kibernetike.<\/li>\n<li>Hidhni nj\u00eb sy mekanizmave ekzistues t\u00eb monitorimit t\u00eb siguris\u00eb n\u00eb pajisjet tuaja rrjetore dhe angazhohuni me to.<\/li>\n<li>P\u00ebr monitoringun e brendsh\u00ebm preferoni analizimin e telemetris\u00eb \u2014 kjo mund\u00ebson zbulimin e deri n\u00eb 80-90% t\u00eb t\u00eb gjitha incidenteve t\u00eb siguris\u00eb rrjetore, duke b\u00ebr\u00eb at\u00eb q\u00eb \u00ebsht\u00eb e pamundur me kapjen e paketimeve t\u00eb rrjetit dhe duke kursyer hap\u00ebsir\u00ebn p\u00ebr ruajtjen e t\u00eb gjitha ngjarjeve t\u00eb siguris\u00eb.<\/li>\n<li>P\u00ebr monitorimin e flukseve p\u00ebrdorni Netflow v9 ose IPFIX \u2013 ata japin m\u00eb shum\u00eb informacion n\u00eb kontekstin e siguris\u00eb dhe lejojn\u00eb monitorimin jo vet\u00ebm t\u00eb IPv4, por edhe IPv6, MPLS etj.<\/li>\n<li>P\u00ebrdorni nj\u00eb protokoll fluksi t\u00eb pa-samp\u00eblluar \u2013 ai ofron m\u00eb shum\u00eb informacion p\u00ebr zbulimin e k\u00ebrc\u00ebnimeve. P\u00ebr shembull, Netflow ose IPFIX.<\/li>\n<li>Kontrolloni ngarkes\u00ebn e pajisjeve tuaja rrjetore \u2013 ndoshta ajo nuk do t\u00eb jet\u00eb n\u00eb gjendje t\u00eb p\u00ebrballoj\u00eb p\u00ebrpunimin e protokollit fluks. At\u00ebher\u00eb, mendoni p\u00ebr p\u00ebrdorimin e sensor\u00ebve virtual\u00eb ose Netflow Generation Appliance.<\/li>\n<li>Implementoni kontrollin n\u00eb nivele t\u00eb qasjes si prioritet \u2014 kjo do t'ju jap\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb par\u00eb 100% t\u00eb gjith\u00eb trafikut.<\/li>\n<li>N\u00ebse nuk keni alternativ\u00eb dhe p\u00ebrdorni pajisje rrjetore ruse, at\u00ebher\u00eb zgjidhni ato q\u00eb mb\u00ebshtetin protokollet e fluksit ose kan\u00eb porta SPAN\/RSPAN.<\/li>\n<li>Kombinoni sistemet e zbulimit\/parandalimit t\u00eb sulmeve n\u00eb kufij dhe sistemet e analiz\u00ebs s\u00eb flukseve n\u00eb rrjetin e brendsh\u00ebm (p\u00ebrfshir\u00eb edhe n\u00eb \u00e7adrat).<\/li>\n<\/ol>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/c54e4b02a906f470bbfb617f48cdd216.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u0427\u0442\u043e \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u0441\u043e\u0432\u0435\u0442\u0430, \u0442\u043e \u044f \u0431\u044b \u0445\u043e\u0442\u0435\u043b \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u0438\u043b\u043b\u044e\u0441\u0442\u0440\u0430\u0446\u0438\u044e, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0443\u0436\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043b \u0440\u0430\u043d\u044c\u0448\u0435. \u0412\u044b \u0432\u0438\u0434\u0438\u0442\u0435, \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u0440\u0430\u043d\u044c\u0448\u0435 \u0441\u043b\u0443\u0436\u0431\u0430 \u0418\u0411 Cisco \u043f\u043e\u0447\u0442\u0438 \u0446\u0435\u043b\u0438\u043a\u043e\u043c \u0432\u044b\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u043b\u0430 \u0441\u0432\u043e\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0418\u0411 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 \u0438 \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432, \u0442\u043e \u0441\u0435\u0439\u0447\u0430\u0441 \u043d\u0430 \u0438\u0445 \u0434\u043e\u043b\u044e \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432\u0441\u0435\u0433\u043e 20% \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0415\u0449\u0435 20% \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u043e\u0442\u043e\u043a\u043e\u0432, \u0447\u0442\u043e \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u0442\u0438 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u2014 \u043d\u0435 \u0431\u043b\u0430\u0436\u044c, \u0430 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u043b\u0443\u0436\u0431 \u0418\u0411 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f. \u0422\u0435\u043c \u0431\u043e\u043b\u0435\u0435, \u0447\u0442\u043e \u0443 \u0432\u0430\u0441 \u0434\u043b\u044f \u0438\u0445 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0435\u0441\u0442\u044c \u0441\u0430\u043c\u043e\u0435 \u0433\u043b\u0430\u0432\u043d\u043e\u0435 \u2014 \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430, \u0438\u043d\u0432\u0435\u0441\u0442\u0438\u0446\u0438\u0438 \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c, \u0432\u043e\u0437\u043b\u043e\u0436\u0438\u0432 \u043d\u0430 \u0441\u0435\u0442\u044c \u0435\u0449\u0435 \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0418\u0411.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollet e Flow-it si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/2166f265222c43b0b2cbbcf4091c1f8c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u042f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043d\u0435 \u0441\u0442\u0430\u043b \u043a\u0430\u0441\u0430\u0442\u044c\u0441\u044f \u0442\u0435\u043c\u044b \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u043e\u0442\u043e\u043a\u0430\u0445 \u0430\u043d\u043e\u043c\u0430\u043b\u0438\u0438 \u0438\u043b\u0438 \u0443\u0433\u0440\u043e\u0437\u044b, \u043d\u043e \u0434\u0443\u043c\u0430\u044e, \u0447\u0442\u043e \u0438 \u0442\u0430\u043a \u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u0447\u0442\u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u043d\u0435 \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0442\u044c\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435\u043c \u0443\u0433\u0440\u043e\u0437\u044b. \u0417\u0430 \u043d\u0438\u043c \u0434\u043e\u043b\u0436\u043d\u043e \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u044c \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u0436\u0435\u043b\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0432 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0438\u043b\u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435. \u041d\u043e \u044d\u0442\u043e \u0443\u0436\u0435 \u0442\u0435\u043c\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430.<\/p>\n<p>\u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f:<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/products\/ios-nx-os-software\/ios-netflow\/index.html\">\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 Cisco IOS Netflow<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/community.cisco.com\/t5\/security-documents\/netflow-support-matrix\/ta-p\/3644638\">\u041c\u0430\u0442\u0440\u0438\u0446\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Netflow \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u044f\u0445 Cisco<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/dam\/en\/us\/td\/docs\/security\/stealthwatch\/netflow\/Cisco_NetFlow_Configuration.pdf\">\u0420\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u043f\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 Netflow \u043d\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 Cisco<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/sflow.org\">\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e sFlow<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.ciscolive.com\/c\/dam\/r\/ciscolive\/us\/docs\/2015\/pdf\/LTRSEC-3336.pdf\">\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u043d\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430 \u043f\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044e Stealtjwatch, SiLK \u0438 ELK \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 Netflow \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tools.netsa.cert.org\/silk\/\">\u0421\u0430\u0439\u0442 SiLK<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tools.netsa.cert.org\/silk\/analysis-handbook.pdf\">\u0422\u0440\u0435\u0445\u0441\u043e\u0442\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u0435 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u043f\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044e SiLK \u0441 \u043a\u0443\u0447\u0435\u0439 \u043f\u0440\u0438\u043c\u0435\u0440\u043e\u0432<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/logstash\/current\/netflow-module.html\">Logstash Netflow Module<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/blogs.cisco.com\/security\/step-by-step-setup-of-elk-for-netflow-analytics\">\u041f\u043e\u0448\u0430\u0433\u043e\u0432\u043e\u0435 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e Cisco \u043f\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0443 Netflow \u0432 ELK<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/307528\/\">\u0410\u043d\u0430\u043b\u0438\u0437 NetFlow v.9 Cisco ASA \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Logstash (ELK)<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/ru_ru\/products\/security\/stealthwatch\/index.html\">\u0420\u0435\u0448\u0435\u043d\u0438\u0435 Cisco Stealthwatch<\/a><\/noindex><\/li>\n<\/ul>\n<p>\u0417\u042b. \u0415\u0441\u043b\u0438 \u0432\u0430\u043c \u043f\u0440\u043e\u0449\u0435 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043d\u0430 \u0441\u043b\u0443\u0445 \u0432\u0441\u0435, \u0447\u0442\u043e \u0431\u044b\u043b\u043e \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043e \u0432\u044b\u0448\u0435, \u0442\u043e \u0432\u044b \u043c\u043e\u0436\u0435\u0442\u0435 \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0447\u0430\u0441\u043e\u0432\u0443\u044e \u043f\u0440\u0435\u0437\u0435\u043d\u0442\u0430\u0446\u0438\u044e, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043b\u0435\u0433\u043b\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u0443 \u0434\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u043c\u0435\u0442\u043a\u0438.<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"ncDRZsueETo\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/ncDRZsueETo\/hqdefault.jpg\" alt=\"Luaj videon\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/464601\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u0433\u0434\u0430 \u0440\u0435\u0447\u044c \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c DLP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u0410 \u0435\u0441\u043b\u0438 \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u0442\u044c \u0443\u0442\u043e\u0447\u043d\u0438\u0442\u044c \u0432\u043e\u043f\u0440\u043e\u0441 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c, \u043a\u0430\u043a \u0432\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u0431\u0443\u0434\u0435\u0442, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a (intrusion detection systems, IDS). \u0418 \u0442\u043e, \u0447\u0442\u043e \u0431\u044b\u043b\u043e \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28091,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37437","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u0433\u0434\u0430 \u0440\u0435\u0447\u044c \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c DLP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u0410 \u0435\u0441\u043b\u0438 \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u0442\u044c \u0443\u0442\u043e\u0447\u043d\u0438\u0442\u044c \u0432\u043e\u043f\u0440\u043e\u0441 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c, \u043a\u0430\u043a \u0432\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u0431\u0443\u0434\u0435\u0442, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a (intrusion detection systems, IDS). \u0418 \u0442\u043e, \u0447\u0442\u043e \u0431\u044b\u043b\u043e \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Flow-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u0433\u0434\u0430 \u0440\u0435\u0447\u044c \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c DLP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u0410 \u0435\u0441\u043b\u0438 \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u0442\u044c \u0443\u0442\u043e\u0447\u043d\u0438\u0442\u044c \u0432\u043e\u043f\u0440\u043e\u0441 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c, \u043a\u0430\u043a \u0432\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u0431\u0443\u0434\u0435\u0442, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a (intrusion detection systems, IDS). \u0418 \u0442\u043e, \u0447\u0442\u043e \u0431\u044b\u043b\u043e \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:17:38+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:17:38+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Flow-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 | ProHoster","description":"\u041a\u043e\u0433\u0434\u0430 \u0440\u0435\u0447\u044c \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c DLP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u0410 \u0435\u0441\u043b\u0438 \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u0442\u044c \u0443\u0442\u043e\u0447\u043d\u0438\u0442\u044c \u0432\u043e\u043f\u0440\u043e\u0441 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c, \u043a\u0430\u043a \u0432\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u0431\u0443\u0434\u0435\u0442, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a (intrusion detection systems, IDS). \u0418 \u0442\u043e, \u0447\u0442\u043e \u0431\u044b\u043b\u043e \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Flow-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 | ProHoster","og:description":"\u041a\u043e\u0433\u0434\u0430 \u0440\u0435\u0447\u044c \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c DLP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u0410 \u0435\u0441\u043b\u0438 \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u0442\u044c \u0443\u0442\u043e\u0447\u043d\u0438\u0442\u044c \u0432\u043e\u043f\u0440\u043e\u0441 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c, \u043a\u0430\u043a \u0432\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u0431\u0443\u0434\u0435\u0442, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a (intrusion detection systems, IDS). \u0418 \u0442\u043e, \u0447\u0442\u043e \u0431\u044b\u043b\u043e \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:17:38+00:00","article:modified_time":"2019-10-31T19:17:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37437","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 17:49:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:26:28","updated":"2026-01-23 17:49:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/37437","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=37437"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/37437\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/28091"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=37437"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=37437"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=37437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}