{"id":37437,"date":"2019-10-31T22:17:38","date_gmt":"2019-10-31T19:17:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti\/"},"modified":"2019-10-31T22:17:38","modified_gmt":"2019-10-31T19:17:38","slug":"flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti","title":{"rendered":"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Kur b\u00ebhet fjal\u00eb p\u00ebr monitorimin e siguris\u00eb s\u00eb nj\u00eb rrjeti t\u00eb brendsh\u00ebm korporativ ose t\u00eb institucioneve, shum\u00eb njer\u00ebz shpesh e lidhin k\u00ebt\u00eb me kontrollin e rrjedhjeve t\u00eb informacionit dhe implementimin e zgjidhjeve DLP. Por, n\u00ebse p\u00ebrpiqemi t\u00eb sakt\u00ebsojm\u00eb pyetjen dhe t\u00eb pyesim se si zbuloni sulmet n\u00eb rrjetin tuaj t\u00eb brendsh\u00ebm, p\u00ebrgjigjja zakonisht \u00ebsht\u00eb p\u00ebrmendja e sistemeve t\u00eb zbulimit t\u00eb sulmeve (sistemet e zbulimit t\u00eb sulmeve, IDS). Dhe ajo q\u00eb ishte e vetmja mund\u00ebsi 10-20 vjet m\u00eb par\u00eb, sot \u00ebsht\u00eb b\u00ebr\u00eb nj\u00eb anahroniz\u00ebm. Ekziston nj\u00eb opsion m\u00eb efektiv, dhe n\u00eb disa raste edhe nj\u00eb mund\u00ebsi e vetme p\u00ebr monitorimin e rrjetit t\u00eb brendsh\u00ebm \u2014 p\u00ebrdorimi i protokollave t\u00eb flow, t\u00eb cilat ishin fillimisht t\u00eb destinuara p\u00ebr gjetjen e problemeve t\u00eb rrjetit (troubleshooting), por m\u00eb von\u00eb u shnd\u00ebrruan n\u00eb nj\u00eb instrument shum\u00eb interesante p\u00ebr sigurin\u00eb. K\u00ebtu do t\u00eb flasim p\u00ebr llojet e protokollave t\u00eb flow q\u00eb ekzistojn\u00eb, se cil\u00ebt prej tyre ndihmojn\u00eb m\u00eb mir\u00eb n\u00eb zbulimin e sulmeve n\u00eb rrjet, ku \u00ebsht\u00eb m\u00eb mir\u00eb t\u00eb implementohet monitorimi i flow, \u00e7far\u00eb duhet t\u00eb keni parasysh kur e zhvilloni nj\u00eb skem\u00eb t\u00eb till\u00eb, dhe madje si ta 'ngisni' k\u00ebt\u00eb n\u00eb pajisje vendase.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Nuk do t\u00eb ndalem n\u00eb pyetjen \"Pse \u00ebsht\u00eb i nevojsh\u00ebm monitorimi i siguris\u00eb s\u00eb infrastruktur\u00ebs s\u00eb brendshme?\" P\u00ebrgjigjja p\u00ebr k\u00ebt\u00eb duket e qart\u00eb. Por n\u00ebse e shqyrtoni p\u00ebrs\u00ebri, q\u00eb sot nuk ka rrug\u00eb tjet\u00ebr pa k\u00ebt\u00eb, <noindex><a rel=\"nofollow\" href=\"https:\/\/gblogs.cisco.com\/ru\/17attackvectors\/\">shikoni<\/a><\/noindex> nj\u00eb video t\u00eb shkurt\u00ebr q\u00eb tregon se si mund t\u00eb hyhet n\u00eb rrjetin korporativ t\u00eb mbrojtur nga nj\u00eb firewall me 17 m\u00ebnyra t\u00eb ndryshme. Prandaj, do ta marrim si t\u00eb sigurt q\u00eb monitorimi i brendsh\u00ebm \u00ebsht\u00eb i nevojsh\u00ebm dhe na mbetet vet\u00ebm t\u00eb kuptojm\u00eb se si mund ta organizojm\u00eb at\u00eb.<\/p>\n<p>Do t\u00eb ve\u00e7oja tri burime kryesore t\u00eb t\u00eb dh\u00ebnave p\u00ebr monitorimin e infrastruktur\u00ebs n\u00eb nivel rrjeti:<\/p>\n<ul>\n<li>\"trafiku\" i pap\u00ebrpunuar, i cili kapet dhe analizohet nga disa sisteme analize,<\/li>\n<li>ngjarjet nga pajisjet rrjet q\u00eb kalon trafiku,<\/li>\n<li>informacioni mbi trafikun, i marr\u00eb p\u00ebrmes nj\u00eb nga protokollet e flow.<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/09c7087593661d5b159ecc9e9ab39d16.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKapja e trafikut t\u00eb pap\u00ebrpunuar \u00ebsht\u00eb opsioni m\u00eb popullor p\u00ebr sigurimin, sepse historikisht ka qene, dhe \u00ebsht\u00eb, m\u00eb i pari. Sistemet e zakonshme t\u00eb zbulimit t\u00eb sulmeve n\u00eb rrjet (sistemi i par\u00eb komercial i zbulimit t\u00eb sulmeve ishte NetRanger nga kompania Wheel Group, e bler\u00eb n\u00eb vitin 1998 nga Cisco) realisht merreshin me kapjen e paketave (dhe m\u00eb von\u00eb dhe t\u00eb seancave), ku k\u00ebrkoheshin disa n\u00ebnshkrime (\u201crregullat vendimtare\u201d n\u00eb terminologjin\u00eb e FSTEK), q\u00eb sinjalizojn\u00eb p\u00ebr sulme. Sigurisht, \u00ebsht\u00eb e mundur t\u00eb analizosh trafikun e pap\u00ebrpunuar jo vet\u00ebm me ndihm\u00ebn e IDS, por edhe me mjete t\u00eb tjera (p\u00ebr shembull, Wireshark, tcpdump ose funksionalitetin NBAR2 n\u00eb Cisco IOS), por zakonisht atyre u mungon baza e njohurive q\u00eb ndan mjetin e sigurimit nga nj\u00eb mjet i zakonsh\u00ebm IT.<\/p>\n<p>Pra, sistemet e zbulimit t\u00eb sulmeve. Metoda m\u00eb e vjet\u00ebr dhe m\u00eb popullore p\u00ebr zbulimin e sulmeve n\u00eb rrjet, e cila b\u00ebn mir\u00eb detyr\u00ebn e saj n\u00eb kufi (nuk ka r\u00ebnd\u00ebsi i cili \u2014 korporativ, DC, segmenti etj.), por d\u00ebshton n\u00eb rrjetet moderne t\u00eb shk\u00ebputjes dhe atyre t\u00eb p\u00ebrcaktuara nga programet. N\u00eb rastin e nj\u00eb rrjeti t\u00eb nd\u00ebrtuar n\u00eb baz\u00eb t\u00eb switch-eve t\u00eb zakonshme, infrastruktura e sensor\u00ebve p\u00ebr zbulimin e sulmeve b\u00ebhet shum\u00eb e madhe \u2014 do t'ju duhet t\u00eb vendosni nj\u00eb sensor p\u00ebr \u00e7do lidhje me nodin, sulmet e t\u00eb cilit d\u00ebshironi t\u00eb monitoroni. \u00c7do prodhues do t\u00eb ishte i lumtur t'ju shes\u00eb qindra e mij\u00ebra sensor\u00eb, por mendoj se buxheti juaj nuk do t'i p\u00ebrballoj\u00eb k\u00ebto shpenzime. Mund t\u00eb them se edhe n\u00eb Cisco (dhe ne jemi zhvillues t\u00eb NGIPS) nuk mund\u00ebm ta b\u00ebjm\u00eb k\u00ebt\u00eb, ndon\u00ebse, duket se \u00e7\u00ebshtja e \u00e7mimit nuk duhet t\u00eb paraqes\u00eb v\u00ebshtir\u00ebsi \u2014 ky \u00ebsht\u00eb zgjidhja jon\u00eb. P\u00ebr m\u00eb tep\u00ebr, ka nj\u00eb pyetje, si t\u00eb lidhim sensorin n\u00eb k\u00ebt\u00eb rast? N\u00eb nj\u00eb nd\u00ebrprerje? Dhe n\u00ebse vet\u00eb sensori d\u00ebshtoi? T\u00eb k\u00ebrkosh q\u00eb sensor\u00ebt t\u00eb ken\u00eb nj\u00eb modul bypass? T\u00eb p\u00ebrdor\u00ebsh ato q\u00eb quhen tap? T\u00eb gjitha k\u00ebto i shtojn\u00eb kostot zgjidhjes dhe e b\u00ebjn\u00eb at\u00eb t\u00eb pap\u00ebrballueshme p\u00ebr kompanit\u00eb e \u00e7do shkalle.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/4763c13237dbe9ffa38d62075939ffba.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMund t\u00eb provoni t\u00eb \"varni\" sensorin n\u00eb port\u00ebn SPAN\/RSPAN\/ERSPAN dhe t\u00eb drejtoni trafikun nga portat e nevojshme t\u00eb switchit n\u00eb t\u00eb. Ky opsion pjes\u00ebrisht zgjidh problemin e p\u00ebrshkruar n\u00eb paragrafin e m\u00ebparsh\u00ebm, por krijon nj\u00eb tjet\u00ebr \u2013 porti SPAN nuk mund t\u00eb pranoj\u00eb t\u00ebr\u00eb trafikun q\u00eb do t'i drejtohet - nuk ka mjaftuesh\u00ebm kapacitet. Do t\u00eb duhet t\u00eb sakrifikoni di\u00e7ka. Ose t\u00eb lini disa nyje pa monitorim (n\u00eb k\u00ebt\u00eb rast, duhet t\u00eb b\u00ebni nj\u00eb prioritetizim t\u00eb tyre paraprakisht), ose t\u00eb drejtoni vet\u00ebm nj\u00eb lloj t\u00eb caktuar t\u00eb trafikut nga nyja, jo t\u00ebr\u00eb at\u00eb. N\u00eb \u00e7do rast, mund t\u00eb humbasim disa sulme. P\u00ebr m\u00eb tep\u00ebr, porti SPAN mund t\u00eb jet\u00eb i angazhuar p\u00ebr nevoja t\u00eb tjera. N\u00eb fund, do t\u00eb duhet t\u00eb rishikoni topologjin\u00eb ekzistuese t\u00eb rrjetit dhe t\u00eb b\u00ebni, ndoshta, disa ndryshime p\u00ebr t\u00eb p\u00ebrfshir\u00eb maksimalisht rrjetin tuaj me numrin e sensor\u00ebve n\u00eb dispozicion (dhe ta konfirmoni k\u00ebt\u00eb me IT-n\u00eb).<\/p>\n<p>Por \u00e7far\u00eb ndodh n\u00ebse rrjeti juaj p\u00ebrdor rruge asimetrike? \u00c7far\u00eb ndodh n\u00ebse keni implementuar ose planifikoni t\u00eb implementoni SDN? \u00c7far\u00eb ndodh n\u00ebse duhet t\u00eb monitoroni makina t\u00eb virtualizuara ose konteiner\u00eb, trafiku i t\u00eb cilave nuk arrin aspak n\u00eb switchin fizik? K\u00ebto pyetje nuk i p\u00eblqejn\u00eb prodhuesve t\u00eb IDS-ve tradicionale, sepse nuk din\u00eb si t'u japin p\u00ebrgjigje. Ndoshta do t'ju nxisin q\u00eb t\u00eb konsideroni se t\u00eb gjitha k\u00ebto teknologji moderne jan\u00eb nj\u00eb bam\u00eb dhe nuk keni nevoj\u00eb p\u00ebr to. Ndoshta do t\u00eb flasin p\u00ebr nevoj\u00ebn t\u00eb filloni me pak. Ose ndoshta do t'ju thon\u00eb se duhet t\u00eb vendosni nj\u00eb mulli t\u00eb fuqish\u00ebm n\u00eb qend\u00ebr t\u00eb rrjetit dhe t\u00eb drejtoni t\u00eb gjith\u00eb trafikun n\u00eb t\u00eb duke p\u00ebrdorur balancuesit. \u00c7far\u00ebdo opsioni t'ju ofrohet, ju nevojitet t\u00eb kuptoni qart\u00eb se sa i p\u00ebrshtatsh\u00ebm \u00ebsht\u00eb ai p\u00ebr ju. Dhe vet\u00ebm pas k\u00ebtij kuptimi duhet t\u00eb merrni vendimin p\u00ebr qasjen e monitorimit t\u00eb infrastruktur\u00ebs s\u00eb siguris\u00eb s\u00eb rrjetit. Duke u rikthyer te kapja e paketave, d\u00ebshiroj t\u00eb theksoj se ky metod vazhdon t\u00eb mbetet shum\u00eb i popullarizuar dhe i r\u00ebnd\u00ebsish\u00ebm, por q\u00ebllimi i tij kryesor \u00ebsht\u00eb t\u00eb kontrolloj\u00eb kufijt\u00eb; kufijt\u00eb midis organizat\u00ebs suaj dhe Internetit, kufijt\u00eb midis Qendr\u00ebs s\u00eb t\u00eb Dh\u00ebnave dhe rrjetit tjet\u00ebr, kufijt\u00eb midis sistemit t\u00eb automatizuar dhe segmentit korporativ. N\u00eb k\u00ebto vende, IDS\/IPS klasike ndodhen ende n\u00eb t\u00eb drejt\u00ebn e ekzistenc\u00ebs dhe p\u00ebrballen mir\u00eb me detyrat e caktuara.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/7a5898e0aa9e3e9275dda3e2c7b75c5c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00eb kalojm\u00eb n\u00eb variantin e dyt\u00eb. Analiza e ngjarjeve q\u00eb vijn\u00eb nga pajisjet rrjet, gjithashtu mund t\u00eb p\u00ebrdoret p\u00ebr q\u00ebllime zbardhjeje t\u00eb sulmeve, por jo si mekanizmi kryesor, pasi ajo lejon t\u00eb zbulohet vet\u00ebm nj\u00eb klas\u00eb t\u00eb vog\u00ebl t\u00eb nd\u00ebrhyrjeve. Gjithashtu, ajo ka nj\u00ebfar\u00eb reagueshm\u00ebrie \u2014 s\u00eb pari, sulmi duhet t\u00eb ndodh\u00eb, pastaj ai duhet t\u00eb regjistrohet nga pajisja rrjet, e cila n\u00eb nj\u00eb m\u00ebnyr\u00eb ose tjet\u00ebr do t\u00eb sinjalizoj\u00eb p\u00ebr nj\u00eb problem me sigurin\u00eb e informacionit. Ka disa m\u00ebnyra p\u00ebr k\u00ebt\u00eb. Mund t\u00eb jet\u00eb syslog, RMON ose SNMP. T\u00eb dy protokollet e fundit p\u00ebr monitorimin rrjet n\u00eb kontekstin e siguris\u00eb s\u00eb informacionit p\u00ebrdoren vet\u00ebm n\u00ebse na nevojitet t\u00eb zbulojm\u00eb nj\u00eb sulm DoS ndaj pajisjes rrjet, pasi me ndihm\u00ebn e RMON dhe SNMP mund t\u00eb ndjekim, p\u00ebr shembull, ngarkes\u00ebn e procesorit qendror t\u00eb pajisjes apo t\u00eb interface-ve t\u00eb tij. Ky \u00ebsht\u00eb nj\u00eb nga m\u00ebnyrat m\u00eb \"t\u00eb lira\" (syslog ose SNMP jan\u00eb t\u00eb pranishme nga t\u00eb gjith\u00eb), por gjithashtu dhe m\u00eb pak efektive nga t\u00eb gjitha m\u00ebnyrat e monitorimit t\u00eb siguris\u00eb s\u00eb brendshme \u2014 shum\u00eb sulme jan\u00eb thjesht t\u00eb fshehura nga ajo. Natyrisht, nuk duhet injoruar dhe analiza e syslog ndihmon p\u00ebr t\u00eb identifikuar n\u00eb koh\u00eb ndryshimet n\u00eb konfigurimin e pajisjes vet\u00eb, komprometimin e saj, por nuk \u00ebsht\u00eb shum\u00eb e p\u00ebrshtatshme p\u00ebr t\u00eb zbuluar sulme n\u00eb t\u00eb gjith\u00eb rrjetin.<\/p>\n<p>Varianti i tret\u00eb \u00ebsht\u00eb analiza e informacionit mbi trafikun q\u00eb kalon p\u00ebrmes pajisjes, e cila mb\u00ebshtet nj\u00eb nga disa protokollet e rrjedh\u00ebs. N\u00eb k\u00ebt\u00eb rast, pavar\u00ebsisht nga protokolli, infrastruktura e pun\u00ebs me rrjedh\u00eb p\u00ebrb\u00ebhet patjet\u00ebr nga tre komponent\u00eb:<\/p>\n<ul>\n<li>Gjenerimi ose eksporti i rrjedh\u00ebs. Kjo rol zakonisht i besohet ruterit, switch-it ose ndonj\u00eb pajisjeje tjet\u00ebr rrjeti, e cila, duke kaluar p\u00ebrmes vetes trafikun rrjet, lejon t\u00eb nxirren parametrat ky\u00e7, t\u00eb cil\u00ebt m\u00eb pas d\u00ebrgohen n\u00eb modulin e mbledhjes. P\u00ebr shembull, n\u00eb Cisco, protokolli Netflow mb\u00ebshtetet jo vet\u00ebm n\u00eb ruterat dhe switch-et, p\u00ebrfshir\u00eb ato virtuale dhe industriale, por edhe n\u00eb kontrollet wireless, firewall-e dhe madje edhe n\u00eb server\u00eb.<\/li>\n<li>Mbledhja e rrjedh\u00ebs. Duke pasur parasysh se n\u00eb nj\u00eb rrjet modern zakonisht ka m\u00eb shum\u00eb se nj\u00eb pajisje rrjeti, lind detyra e mbledhjes dhe konsolidimit t\u00eb rrjedhave, e cila zgjidhet me ndihm\u00ebn e atyre q\u00eb quhen kolektues, t\u00eb cil\u00ebt kryejn\u00eb p\u00ebrpunimin e rrjedhave t\u00eb marra dhe pastaj i d\u00ebrgojn\u00eb ato p\u00ebr analiz\u00eb.<\/li>\n<li>Analiza e fluksit. Analizatori merr p\u00ebrsip\u00ebr detyr\u00ebn kryesore intelektuale dhe, duke aplikuar algoritme t\u00eb ndryshme n\u00eb flukse, b\u00ebn p\u00ebrfundime t\u00eb ndryshme. P\u00ebr shembull, n\u00eb kuad\u00ebr t\u00eb funksionit IT, nj\u00eb analizator i till\u00eb mund t\u00eb identifikoj\u00eb ngushticat e rrjetit ose t\u00eb analizoj\u00eb profilin e ngarkes\u00ebs s\u00eb trafikut p\u00ebr optimizimin e m\u00ebtejsh\u00ebm t\u00eb rrjetit. Nd\u00ebrsa p\u00ebr sigurin\u00eb e informacionit, nj\u00eb analizator i till\u00eb mund t\u00eb zbuloj\u00eb rrjedhjet e t\u00eb dh\u00ebnave, p\u00ebrhapjen e kodit t\u00eb d\u00ebmsh\u00ebm ose sulmet DoS. <\/li>\n<\/ul>\n<p>Nuk duhet t\u00eb mendoni se nj\u00eb arkitektur\u00eb me tre nivele \u00ebsht\u00eb shum\u00eb e komplikuar \u2014 t\u00eb gjitha variantet e tjera (p\u00ebrve\u00e7 ndoshta sistemeve t\u00eb monitorimit t\u00eb rrjetit q\u00eb punojn\u00eb me SNMP dhe RMON) funksionojn\u00eb gjithashtu sipas saj. Ne kemi nj\u00eb gjenerues t\u00eb dh\u00ebnash p\u00ebr analiz\u00eb, i cili \u00ebsht\u00eb nj\u00eb pajisje rrjeti ose nj\u00eb sensor i pavarur. Ne kemi nj\u00eb sistem mbledhjeje t\u00eb sinjalizimeve dhe nj\u00eb sistem menaxhimi t\u00eb t\u00eb gjith\u00eb infrastruktur\u00ebs s\u00eb monitorimit. Dy komponent\u00ebt e fundit mund t\u00eb integrohen brenda nj\u00eb nyje, por n\u00eb rrjetet m\u00eb t\u00eb m\u00ebdha ata zakonisht shp\u00ebrndahen n\u00eb t\u00eb pakt\u00ebn dy pajisje p\u00ebr t\u00eb siguruar shkallueshm\u00ebrin\u00eb dhe besueshm\u00ebrin\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/65de74b0a7556606355f9b176ef7e19c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDallimi nga analiza e paketeve, e cila bazohet n\u00eb studimin e headers dhe trupit t\u00eb t\u00eb dh\u00ebnave t\u00eb \u00e7do pakete dhe seancave q\u00eb p\u00ebrb\u00ebhen prej tyre, analiza e flukseve mb\u00ebshtetet n\u00eb mbledhjen e metadatave mbi trafikun rrjetor. Kur, sa, nga ku dhe kah... k\u00ebto jan\u00eb pyetje t\u00eb cilave iu p\u00ebrgjigjet analiza e telemetris\u00eb rrjetore p\u00ebrmes protokolleve t\u00eb ndryshme t\u00eb fluksit. N\u00eb fillim ato u p\u00ebrdor\u00ebn p\u00ebr analizimin e statistikave dhe identifikimin e problemeve IT n\u00eb rrjet, por m\u00eb von\u00eb, me zhvillimin e mekanizmave analitik\u00eb, u b\u00eb e mundur q\u00eb t\u00eb p\u00ebrdoren gjithashtu p\u00ebr t\u00eb nj\u00ebjt\u00ebn telemetri dhe p\u00ebr q\u00ebllime sigurie. K\u00ebtu duhet theksuar p\u00ebrs\u00ebri se analiza e flukseve nuk z\u00ebvend\u00ebson dhe nuk anashkalon kapjen e paketeve. \u00c7do nj\u00ebri nga k\u00ebto metoda ka fush\u00ebn e vet t\u00eb p\u00ebrdorimit. Por n\u00eb kontekstin e k\u00ebtij artikulli, analiza e flukseve \u00ebsht\u00eb m\u00eb e p\u00ebrshtatshme p\u00ebr monitorimin e infrastruktur\u00ebs s\u00eb brendshme. Keni pajisje rrjeti (nuk ka r\u00ebnd\u00ebsi n\u00ebse ato funksionojn\u00eb n\u00eb nj\u00eb paradigm\u00eb t\u00eb definuar nga programi ose sipas rregullave statike), t\u00eb cilat sulmi nuk mund t\u2019i kaloj\u00eb. Nj\u00eb sensor klasik IDS mund ta kaloj\u00eb, por nj\u00eb pajisje rrjeti q\u00eb mb\u00ebshtet protokollin e fluksit jo. Kjo \u00ebsht\u00eb p\u00ebrpar\u00ebsia e k\u00ebtij metode. <\/p>\n<p>Nga ana tjet\u00ebr, n\u00ebse ju nevojitet nj\u00eb prov\u00eb p\u00ebr organet e zbatimit t\u00eb ligjit ose grupin tuaj t\u00eb hetimit t\u00eb incidenteve, nuk do t\u00eb kaloni dot pa kapjen e paketave \u2014 telemetria rrjetore nuk \u00ebsht\u00eb nj\u00eb kopje e trafikut q\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr mbledhjen e d\u00ebshmive; ajo \u00ebsht\u00eb e nevojshme p\u00ebr zbulimin operativ dhe marrjen e vendimeve n\u00eb fush\u00ebn e siguris\u00eb s\u00eb informacionit. Nga ana tjet\u00ebr, duke p\u00ebrdorur analiz\u00ebn e telemetris\u00eb, mund t\u00eb \"shkruani\" jo t\u00eb gjith\u00eb trafikun rrjetor (n\u00ebse \u00ebsht\u00eb ndonj\u00eb gj\u00eb, Cisco dhe qendrat e t\u00eb dh\u00ebnave merret :-), por vet\u00ebm at\u00eb q\u00eb merr pjes\u00eb n\u00eb sulm. Mjetet e analiz\u00ebs s\u00eb telemetris\u00eb n\u00eb k\u00ebt\u00eb drejtim plot\u00ebsojn\u00eb mir\u00eb mekanizmat tradicional\u00eb t\u00eb kapjes s\u00eb paketave, duke dh\u00ebn\u00eb nj\u00eb urdh\u00ebr p\u00ebr kapjen dhe ruajtjen selektive. P\u00ebrndryshe, do t'ju duhet nj\u00eb infrastrukture t\u00eb madhe p\u00ebr ruajtje.<\/p>\n<p>Imagjinoni nj\u00eb rrjet q\u00eb punon me shpejt\u00ebsi 250 Mbit\/sec. N\u00ebse d\u00ebshironi t\u00eb ruani gjith\u00eb k\u00ebt\u00eb volum, do t'ju nevojitet nj\u00eb hap\u00ebsir\u00eb ruajtjeje prej 31 Mb p\u00ebr nj\u00eb sekond\u00eb t\u00eb transmetimit t\u00eb trafikut, 1.8 Gb p\u00ebr nj\u00eb minut\u00eb, 108 Gb p\u00ebr nj\u00eb or\u00eb, dhe 2.6 Tb p\u00ebr nj\u00eb dit\u00eb. P\u00ebr ruajtjen e t\u00eb dh\u00ebnave ditore nga nj\u00eb rrjet me kapacitet 10 Gbit\/sec, do t'ju nevojitet nj\u00eb hap\u00ebsir\u00eb ruajtjeje prej 108 Tb. Dhe disa rregullator\u00eb k\u00ebrkojn\u00eb t\u00eb ruajn\u00eb t\u00eb dh\u00ebna p\u00ebr sigurin\u00eb p\u00ebr vite... Regjistrimi \"n\u00eb k\u00ebrkes\u00eb\", q\u00eb analiza e rrjedhave ndihmon t\u00eb realizohet, ndihmon t\u00eb zvog\u00eblohen k\u00ebto vlera me rend t\u00eb madh. P\u00ebr t'u folur p\u00ebr raportin midis volumit t\u00eb t\u00eb dh\u00ebnave t\u00eb regjistruara t\u00eb telemetris\u00eb rrjetore dhe kapjes s\u00eb plot\u00eb t\u00eb t\u00eb dh\u00ebnave, ai \u00ebsht\u00eb rreth 1 n\u00eb 500. P\u00ebr vlerat e lartp\u00ebrmendura, ruajtja e dekodimit t\u00eb plot\u00eb t\u00eb gjith\u00eb trafikut t\u00eb p\u00ebrditsh\u00ebm do t\u00eb ishte 5 dhe 216 Gb p\u00ebrkat\u00ebsisht (madje mund ta regjistroni edhe n\u00eb nj\u00eb flash drive t\u00eb zakonsh\u00ebm).<\/p>\n<p>N\u00ebse metodologjia e analizes s\u00eb t\u00eb dh\u00ebnave t\u00eb pap\u00ebrpunuara t\u00eb rrjetit ndryshon pak nga nj\u00eb prodhues n\u00eb tjetrin, n\u00eb rastin e analiz\u00ebs s\u00eb rrjedhave situata \u00ebsht\u00eb e ndryshme. Ekzistojn\u00eb disa variante t\u00eb protokolleve t\u00eb rrjedhave, p\u00ebr dallimet e t\u00eb cil\u00ebve \u00ebsht\u00eb e nevojshme t\u00eb dihet pik\u00ebrisht n\u00eb kontekstin e siguris\u00eb. Protokolli m\u00eb i njohur \u00ebsht\u00eb Netflow, i zhvilluar nga Cisco. Ekzistojn\u00eb disa versione t\u00eb k\u00ebtij protokolli, t\u00eb cilat ndryshojn\u00eb sipas mund\u00ebsive t\u00eb tyre dhe volumit t\u00eb informacionit mbi trafikun q\u00eb regjistrohet. Versioni aktual \u00ebsht\u00eb versioni i n\u00ebnt\u00eb (Netflow v9), mbi t\u00eb cilin \u00ebsht\u00eb zhvilluar standardi industrial Netflow v10, gjithashtu i njohur si IPFIX. Sot shumica e prodhuesve t\u00eb rrjetit mb\u00ebshtesin pik\u00ebrisht Netflow ose IPFIX n\u00eb pajisjet e tyre. Por ka dhe variante t\u00eb tjera t\u00eb protokolleve t\u00eb rrjedhave \u2014 sFlow, jFlow, cFlow, rFlow, NetStream dhe k\u00ebshtu me radh\u00eb, nga t\u00eb cilat sFlow \u00ebsht\u00eb m\u00eb i njohur. Ky i fundit mb\u00ebshtetet m\u00eb shpesh nga prodhuesit vendas t\u00eb pajisjeve t\u00eb rrjetit p\u00ebr shkak t\u00eb thjesht\u00ebsis\u00eb s\u00eb implementimit. Cilat jan\u00eb dallimet kryesore midis Netflow, si nj\u00eb standard q\u00eb \u00ebsht\u00eb b\u00ebr\u00eb de-facto, dhe sFlow? Dallimet kryesore do t'i p\u00ebrmendja disa. S\u00eb pari, Netflow ka fusha t\u00eb personalizueshme nga p\u00ebrdoruesi, p\u00ebrndryshe nga fushat fikse n\u00eb sFlow. S\u00eb dyti, dhe kjo \u00ebsht\u00eb m\u00eb e r\u00ebnd\u00ebsishmja n\u00eb rastin ton\u00eb, sFlow mbledh at\u00eb q\u00eb quhet telemetri e samp\u00eblluar; p\u00ebr dallim nga telemetria e pasamp\u00eblluar e Netflow dhe IPFIX. \u00c7far\u00eb \u00ebsht\u00eb ndryshe midis tyre?<\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/96782b57ccaddd731d5084c127076d49.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nImagjinoni se keni vendosur t\u00eb njiheni me librin \u201c<noindex><a rel=\"nofollow\" href=\"http:\/\/www.ciscopress.com\/store\/security-operations-center-building-operating-and-maintaining-9780134052014\">Security Operations Center: Building, Operating, and Maintaining your SOC<\/a><\/noindex>\u201d t\u00eb koleg\u00ebve t\u00eb mi \u2014 Gari McIntyre, Joseph Muniz dhe Nadem Alfarhan (n\u00eb lidhjen mund t\u00eb shkarkoni nj\u00eb pjes\u00eb t\u00eb librit). Keni tre mund\u00ebsi p\u00ebr t\u00eb arritur k\u00ebt\u00eb q\u00ebllim \u2014 t\u00eb lexoni librin e plot\u00eb, ta kaloni me shikim, duke u ndalur n\u00eb \u00e7do faqe t\u00eb 10-t\u00eb ose t\u00eb 20-t\u00eb, ose t\u00eb provoni t\u00eb gjeni nj\u00eb p\u00ebrmbledhje t\u00eb koncepteve kryesore n\u00eb ndonj\u00eb blog apo sh\u00ebrbim si SmartReading. Pra, telemetria e pasamp\u00eblluar \u00ebsht\u00eb leximi i \u00e7do \u201cfaqe\u201d t\u00eb trafikut rrjetit, dometh\u00ebn\u00eb analiza e metadatat p\u00ebr \u00e7do paket\u00eb. Telemetria e samp\u00eblluar \u00ebsht\u00eb studimi selektiv i trafikut me shpres\u00ebn se n\u00eb mostra t\u00eb zgjedhura do t\u00eb gjendet ajo q\u00eb ju nevojitet. N\u00eb var\u00ebsi t\u00eb shpejt\u00ebsis\u00eb s\u00eb kanalit, telemetria e samp\u00eblluar do t\u00eb kthej\u00eb p\u00ebr analiz\u00eb \u00e7do 64-t\u00eb, 200-t\u00eb, 500-t\u00eb, 1000-t\u00eb, 2000-t\u00eb ose madje 10000-t\u00eb paket\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/28b798498a11a5e6f72ef847ea2dbaaa.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb kontekstin e monitorimit t\u00eb siguris\u00eb, kjo n\u00ebnkupton q\u00eb telemetria e mostrave \u00ebsht\u00eb e p\u00ebrshtatshme p\u00ebr zbulimin e sulmeve DDoS, skanimeve, p\u00ebrhapjes s\u00eb kodit t\u00eb d\u00ebmsh\u00ebm, por mund t\u00eb humbas\u00eb sulmet atomike ose shum\u00eb-pako, t\u00eb cilat nuk kan\u00eb r\u00ebn\u00eb n\u00eb mostrat e d\u00ebrguara p\u00ebr analiz\u00eb. Telemetria e pazgjedhur nuk ka k\u00ebto disavantazhe dhe me ndihm\u00ebn e saj, spektri i sulmeve q\u00eb mund t\u00eb zbulohen \u00ebsht\u00eb shum\u00eb m\u00eb i gjer\u00eb. Ja nj\u00eb p\u00ebrmbledhje e vog\u00ebl e ngjarjeve q\u00eb mund t\u00eb zbulohen me an\u00eb t\u00eb mjeteve t\u00eb analiz\u00ebs s\u00eb telemetris\u00eb rrjetit.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/be3a11d4826978d9c882074f22ee97c1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSigurisht, ndonj\u00eb analizues open source Netflow nuk do t'ju lejoj\u00eb k\u00ebt\u00eb, pasi detyra e tij kryesore \u00ebsht\u00eb t\u00eb mbledh\u00eb telemetrin\u00eb dhe t\u00eb kryej\u00eb nj\u00eb analiz\u00eb themelore n\u00eb pik\u00ebpamjen IT. P\u00ebr t\u00eb identifikuar k\u00ebrc\u00ebnimet e siguris\u00eb s\u00eb informacionit mbi baz\u00ebn e flukseve, \u00ebsht\u00eb e nevojshme t\u00eb pajisni analizuesin me engine dhe algoritme t\u00eb ndryshme, t\u00eb cilat do t\u00eb identifikojn\u00eb problemet e siguris\u00eb kibernetike mbi baz\u00ebn e fushave standarde ose t\u00eb personalizuara t\u00eb Netflow, t\u00eb pasurojn\u00eb t\u00eb dh\u00ebnat standarde me t\u00eb dh\u00ebna nga burime t\u00eb ndryshme t\u00eb Inteligjenc\u00ebs mbi K\u00ebrc\u00ebnimet, etj.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/60e876dbfbdffd160e9899f87aa6303c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPrandaj, n\u00ebse keni zgjedhje, zgjidhni Netflow ose IPFIX. Por edhe n\u00ebse pajisjet tuaja punojn\u00eb vet\u00ebm me sFlow, si\u00e7 ndodh me prodhuesit vendas, at\u00ebher\u00eb edhe n\u00eb k\u00ebt\u00eb rast mund t\u00eb nxirrni dobi prej tij n\u00eb kontekstin e siguris\u00eb. <\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/ee75809ccde4f366ca5f5ead7beed58c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb ver\u00ebn e vitit 2019, un\u00eb kryeva nj\u00eb analiz\u00eb t\u00eb mund\u00ebsive q\u00eb kan\u00eb prodhuesit rus\u00eb t\u00eb pajisjeve rrjetore dhe t\u00eb gjith\u00eb ata, p\u00ebrve\u00e7 NSG, Poligonit dhe Kraftveit, deklaruan mb\u00ebshtetje p\u00ebr sFlow (t\u00eb pakt\u00ebn, Zelaks, Natex, Eltex, QTech, Rusteletech). <\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/acd1ed477af59e1439d941374c596d16.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPyetje e ardhshme q\u00eb do t'ju dal\u00eb \u00ebsht\u00eb, ku mund t\u00eb integrohet mb\u00ebshtetje p\u00ebr flow p\u00ebr q\u00ebllime sigurie? N\u00eb t\u00eb v\u00ebrtet\u00eb, pyetja \u00ebsht\u00eb formuluar paksa gabim. N\u00eb pajisjet moderne, mb\u00ebshtetja p\u00ebr protokollet flow \u00ebsht\u00eb pothuajse gjithmon\u00eb e pranishme. Prandaj, un\u00eb do ta riformuloja pyetjen ndryshe \u2014 ku \u00ebsht\u00eb m\u00eb efikase t\u00eb mblidhet telemetria nga pik\u00ebpamja e siguris\u00eb? P\u00ebrgjigjja do t\u00eb jet\u00eb mjaft e qart\u00eb \u2014 n\u00eb nivelin e qasjes, ku do t\u00eb shihni 100% t\u00eb gjith\u00eb trafikut, ku do t\u00eb keni informacion t\u00eb detajuar p\u00ebr host-et (MAC, VLAN, ID e nd\u00ebrfaqes), ku do t\u00eb mund t\u00eb gjurmoni madje edhe trafikun P2P midis host-eve, \u00e7ka \u00ebsht\u00eb thelb\u00ebsore p\u00ebr zbulimin e skanimeve dhe shp\u00ebrndarjen e kodit t\u00eb d\u00ebmsh\u00ebm. N\u00eb nivelin e kernelit, pjesa e trafikut mund t\u00eb mos shihet as nuk do t\u00eb shihni m\u00eb shum\u00eb se nj\u00eb e kat\u00ebrta e gjith\u00eb trafikut tuaj rrjetor n\u00eb nivelin e perimetrit. Por n\u00ebse p\u00ebr ndonj\u00eb arsye keni pajisje t\u00eb huaja n\u00eb rrjetin tuaj, duke lejuar q\u00eb sulmuesit t\u00eb \u201chyn\u00eb dhe dalin\u201d, duke anashkaluar perimetrin, at\u00ebher\u00eb analiza e telemetris\u00eb nga ai do t\u00eb mos ju sjell\u00eb asgj\u00eb. Prandaj, p\u00ebr nj\u00eb mbulim maksimal, rekomandohet q\u00eb mbledhja e telemetris\u00eb t\u00eb b\u00ebhet pik\u00ebrisht n\u00eb nivelin e qasjes. N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, duhet t\u00eb theksohet se edhe n\u00ebse flasim p\u00ebr virtualizimin ose kontejner\u00ebt, n\u00eb switch-at virtual modern\u00eb shpesh gjendet mb\u00ebshtetje p\u00ebr flow, e cila lejon kontrollimin e trafikut edhe aty.<\/p>\n<p>Por pasi e ngrita tem\u00ebn, duhet t\u00eb p\u00ebrgjigjem n\u00eb pyetjen, \u00e7far\u00eb ndodh n\u00ebse pajisja, fizike ose virtuale, nuk mb\u00ebshtet protokollet flow? Apo aktivizimi i saj \u00ebsht\u00eb i ndaluar (p\u00ebr shembull, n\u00eb segmentet industriale p\u00ebr t\u00eb siguruar besueshm\u00ebrin\u00eb)? Ose aktivizimi i saj \u00e7on n\u00eb nj\u00eb ngarkes\u00eb t\u00eb lart\u00eb n\u00eb procesorin qendror (n\u00eb disa raste ndodh me pajisje t\u00eb vjetra)? P\u00ebr zgjidhjen e k\u00ebsaj \u00e7\u00ebshtjeje ekzistojn\u00eb sensora virtual\u00eb t\u00eb specializuar (flow sensor), t\u00eb cil\u00ebt n\u00eb thelb jan\u00eb thjesht deka, q\u00eb kalojn\u00eb trafik dhe e transmetojn\u00eb at\u00eb n\u00eb form\u00ebn e flow n\u00eb modulin e mbledhjes. Megjithat\u00eb, n\u00eb k\u00ebt\u00eb rast ne kemi t\u00eb gjith\u00eb grumbullin e problemeve q\u00eb p\u00ebrmend\u00ebm m\u00eb lart n\u00eb lidhje me mjetet e kapjes s\u00eb paketave. Pra, duhet t\u00eb kuptohet jo vet\u00ebm p\u00ebrfitimet e teknologjis\u00eb s\u00eb analiz\u00ebs s\u00eb protokolleve, por edhe kufizimet e saj.<\/p>\n<p>Nj\u00eb tjet\u00ebr \u00e7\u00ebshtje q\u00eb \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb kemi parasysh, kur flasim p\u00ebr mjetet e analiz\u00ebs s\u00eb rrjedhave. N\u00ebse p\u00ebr mjetet e zakonshme t\u00eb gjenerimit t\u00eb ngjarjeve t\u00eb siguris\u00eb p\u00ebrdorim metriken EPS (ngjarje p\u00ebr sekond\u00eb), p\u00ebr analiz\u00ebn e telemetris\u00eb ky tregues nuk \u00ebsht\u00eb i aplikuesh\u00ebm; ai z\u00ebvend\u00ebsohet me FPS (rrjedha p\u00ebr sekond\u00eb). Po ashtu si me EPS, nuk mund t\u00eb llogaritet paraprakisht, por mund t\u00eb vler\u00ebsohet numri i p\u00ebraf\u00ebrt i rrjedhave q\u00eb gjeneron nj\u00eb pajisje e caktuar n\u00eb var\u00ebsi t\u00eb detyr\u00ebs s\u00eb saj. N\u00eb internet mund t\u00eb gjeni tabela me vlera p\u00ebraf\u00ebrsisht p\u00ebr disa lloje pajisjesh korporative dhe kushteve, q\u00eb do t'ju ndihmojn\u00eb t\u00eb parashikoni se cilat licenca ju nevojiten p\u00ebr mjetet e analiz\u00ebs dhe cila do t\u00eb jet\u00eb arkitektura e tyre. Problemi \u00ebsht\u00eb se sensor\u00ebt IDS kan\u00eb nj\u00eb kapacitet t\u00eb caktuar q\u00eb ata \"shkarkojn\u00eb\", ashtu si kolektor\u00ebt e rrjedhave kan\u00eb kufizimet e tyre, t\u00eb cilat duhet t'i kuptoni. Prandaj, n\u00eb rrjetet e m\u00ebdha dhe gjeografikisht t\u00eb shp\u00ebrndara zakonisht ka disa kolektor\u00eb. Kur po p\u00ebrshkruaja, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/348532\/\">si monitorohet rrjeti brenda Cisco<\/a><\/noindex>, isha duke sjell\u00eb numrin e kolektor\u00ebve tan\u00eb \u2014 ata jan\u00eb 21. Dhe kjo \u00ebsht\u00eb p\u00ebr nj\u00eb rrjet t\u00eb shp\u00ebrndar\u00eb n\u00eb pes\u00eb kontinente dhe me rreth gjysm\u00eb milioni pajisje aktive).<\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/a5935ef7f7a3511cbf291fce59e96d71.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSi sistem monitorimi Netflow ne p\u00ebrdorim zgjidhjen ton\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/ru_ru\/products\/security\/stealthwatch\/index.html\">Cisco Stealthwatch<\/a><\/noindex>, i cili \u00ebsht\u00eb ve\u00e7an\u00ebrisht i orientuar p\u00ebr zgjidhjen e problemeve t\u00eb siguris\u00eb. Ai ka shum\u00eb motor\u00eb t\u00eb integruar p\u00ebr zbulimin e aktivitetit anormal, dyshues dhe qart\u00eb keqdash\u00ebs, duke lejuar identifikimin e nj\u00eb gam\u00eb t\u00eb gjer\u00eb k\u00ebrc\u00ebnimesh \u2014 nga minimi i criptove deri te rrjedhjet e informacionit, nga p\u00ebrhapja e kodit t\u00eb d\u00ebmsh\u00ebm deri te mashtrimi. Si shumica e analizator\u00ebve t\u00eb rrjedhave, Stealthwatch \u00ebsht\u00eb nd\u00ebrtuar sipas nj\u00eb skeme me tre nivele (gjenerator \u2014 mbledh\u00ebs \u2014 analizues), por ai \u00ebsht\u00eb i plot\u00ebsuar me nj\u00eb s\u00ebr\u00eb ve\u00e7orish interesante, t\u00eb r\u00ebnd\u00ebsishme n\u00eb kontekstin e materialit n\u00eb shqyrtim. S\u00eb pari, ai integrohet me zgjidhjet p\u00ebr kapjen e paketeve (p.sh., Cisco Security Packet Analyzer), duke lejuar regjistrimin e seancave rrjetesh t\u00eb zgjedhura p\u00ebr hetim dhe analiz\u00eb t\u00eb thell\u00eb m\u00eb von\u00eb. S\u00eb dyti, p\u00ebr t\u00eb zgjeruar detyrat e siguris\u00eb, ne kemi zhvilluar nj\u00eb protokoll t\u00eb ve\u00e7ant\u00eb nvzFlow, i cili lejon \u201ctransmetimin\u201d e aktivitetit t\u00eb aplikacioneve n\u00eb nyjat fundore (servera, stacione pune etj.) n\u00eb telemetri dhe ta kaloj\u00eb at\u00eb n\u00eb mbledh\u00ebs p\u00ebr nj\u00eb analiz\u00eb t\u00eb m\u00ebtejshme. N\u00eb versionin e tij origjinal, Stealthwatch punon me \u00e7do protokoll rrjedhe (sFlow, rFlow, Netflow, IPFIX, cFlow, jFlow, NetStream) n\u00eb nivelin e rrjetit, nd\u00ebrsa mb\u00ebshtetja p\u00ebr nvzFlow lejon korrelacionin e t\u00eb dh\u00ebnave edhe n\u00eb nivelin e nyj\u00ebs, duke e rritur k\u00ebshtu efikasitetin e gjith\u00eb sistemit dhe duke par\u00eb m\u00eb shum\u00eb sulme se analizator\u00ebt e zakonsh\u00ebm t\u00eb rrjedhave t\u00eb rrjetit.<\/p>\n<p>\u00cbsht\u00eb e qart\u00eb se kur flasim p\u00ebr sistemet e analiz\u00ebs s\u00eb Netflow nga k\u00ebndv\u00ebshtrimi i siguris\u00eb, tregu nuk \u00ebsht\u00eb i kufizuar vet\u00ebm n\u00eb nj\u00eb zgjidhje nga Cisco. Ju mund t\u00eb p\u00ebrdorni si zgjidhje komerciale, ashtu edhe me p\u00ebrmbajtje falas ose gjysm\u00eb t\u00eb lir\u00eb. \u00cbsht\u00eb mjaft e \u00e7uditshme, n\u00ebse un\u00eb n\u00eb blogun e Cisco do t\u00eb p\u00ebrmendja zgjidhjet e konkurrent\u00ebve, prandaj do t\u00eb them disa fjal\u00eb p\u00ebr m\u00ebnyr\u00ebn se si telemetria rrjetore mund t\u00eb analizohet me dy mjete t\u00eb njohura, t\u00eb ngjashme n\u00eb em\u00ebr, por gjithsesi t\u00eb ndryshme \u2014 SiLK dhe ELK.<\/p>\n<p>SiLK \u2014 \u00ebsht\u00eb nj\u00eb grup mjetesh (Sistemi p\u00ebr Njohurin\u00eb n\u00eb Nivelin e Internetit) p\u00ebr analiz\u00ebn e trafikut, i zhvilluar nga CERT\/CC amerikan dhe q\u00eb mb\u00ebshtet, n\u00eb kontekstin e k\u00ebtij artikulli, Netflow (versionet e tij m\u00eb t\u00eb njohura 5 dhe 9), IPFIX dhe sFlow dhe, p\u00ebrmes disa utilitar\u00ebve (rwfilter, rwcount, rwflowpack etj.), kryen operacione t\u00eb ndryshme mbi telemetrin\u00eb rrjetore me q\u00ebllim identifikimin e shenjave t\u00eb veprimeve t\u00eb paautorizuara. Por duhet theksuar disa pika t\u00eb r\u00ebnd\u00ebsishme. SiLK \u00ebsht\u00eb nj\u00eb mjet me komand\u00eb dhe p\u00ebr t\u00eb kryer nj\u00eb analiz\u00eb operacionale, duhet t\u00eb jepni vazhdimisht komanda t\u00eb tipit (identifikimi i paketave ICMP m\u00eb t\u00eb m\u00ebdha se 200 byte):<\/p>\n<p><code>rwfilter --flowtypes=all\/all --proto=1 --bytes-per-packet=200- --pass=stdout | rwrwcut --fields=sIP,dIP,iType,iCode --num-recs=15<\/code><\/p>\n<p>nuk \u00ebsht\u00eb shum\u00eb e p\u00ebrshtatshme. Mund t\u00eb p\u00ebrdorni nd\u00ebrfaqen grafike iSiLK, por ajo nuk do ta leht\u00ebsoj\u00eb shum\u00eb jet\u00ebn tuaj, duke zgjidhur vet\u00ebm funksionin e vizualizimit dhe jo z\u00ebvend\u00ebsimin e analistit. Dhe ky \u00ebsht\u00eb momenti i dyt\u00eb. Ndryshe nga zgjidhjet komerciale, t\u00eb cilat kan\u00eb nj\u00eb baz\u00eb t\u00eb fort\u00eb analitike, algoritme p\u00ebr identifikimin e anomalive, rrjedha pune etj., n\u00eb rastin e SiLK, ju duhet ta b\u00ebni t\u00eb gjith\u00eb k\u00ebt\u00eb vet\u00eb, e cila do t'ju k\u00ebrkoj\u00eb disa kompetenca t\u00eb ndryshme nga p\u00ebrdorimi i mjeteve q\u00eb jan\u00eb tashm\u00eb gati p\u00ebr pun\u00eb. Kjo nuk \u00ebsht\u00eb mir\u00eb dhe as keq \u2014 \u00ebsht\u00eb nj\u00eb ve\u00e7ori e pothuajse \u00e7do instrumenti falas, i cili n\u00ebnkupton se ju dini se \u00e7far\u00eb t\u00eb b\u00ebni dhe ai ju ndihmon vet\u00ebm n\u00eb k\u00ebt\u00eb proces (mjetet komerciale jan\u00eb m\u00eb pak t\u00eb varura nga kompetencat e p\u00ebrdoruesve t\u00eb tyre, megjithat\u00eb, ato gjithashtu presin q\u00eb analist\u00ebt t\u00eb kuptojn\u00eb t\u00eb pakt\u00ebn bazat e hetimeve dhe monitorimit t\u00eb rrjetit). Por le t\u00eb kthehemi te SiLK. Cikli i pun\u00ebs s\u00eb analistit me t\u00eb duket si m\u00eb posht\u00eb:<\/p>\n<ul>\n<li>Formulimi i hipotez\u00ebs. Duhet t\u00eb kuptojm\u00eb se \u00e7far\u00eb do t\u00eb k\u00ebrkojm\u00eb brenda telemetris\u00eb rrjetore, t\u00eb njohim atributet unike me t\u00eb cilat do t\u00eb identifikojm\u00eb anomalit\u00eb ose k\u00ebrc\u00ebnimet e caktuara.<\/li>\n<li>Nd\u00ebrtimi i modelit. Pasi kemi formuluar hipotez\u00ebn, ne e programojm\u00eb at\u00eb duke p\u00ebrdorur t\u00eb nj\u00ebjtin Python, shell apo mjete t\u00eb tjera q\u00eb nuk p\u00ebrfshihen n\u00eb SiLK.<\/li>\n<li>\u0422\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435. \u041d\u0430\u0441\u0442\u0443\u043f\u0430\u0435\u0442 \u0447\u0435\u0440\u0435\u0434 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0448\u0435\u0439 \u0433\u0438\u043f\u043e\u0442\u0435\u0437\u044b, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f \u0438\u043b\u0438 \u043e\u043f\u0440\u043e\u0432\u0435\u0440\u0433\u0430\u0435\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0442\u0438\u043b\u0438\u0442 SiLK, \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u0441 &#8216;rw&#8217;, &#8216;set&#8217;, &#8216;bag&#8217;.<\/li>\n<li>Analiza e t\u00eb dh\u00ebnave reale. N\u00eb operimin industrial, SiLK na ndihmon t\u00eb zbulojm\u00eb di\u00e7ka, dhe analisti duhet t\u00eb p\u00ebrgjigjet n\u00eb pyetjet \"A kemi gjetur at\u00eb q\u00eb supozonim?\", \"A p\u00ebrputhet kjo me hipotez\u00ebn ton\u00eb?\", \"Si ta zvog\u00eblojm\u00eb numrin e alarmave false?\", \"Si ta p\u00ebrmir\u00ebsojm\u00eb nivelin e njohjes?\" etj.<\/li>\n<li>P\u00ebrmir\u00ebsimi. N\u00eb etap\u00ebn p\u00ebrfundimtare, ne p\u00ebrmir\u00ebsojm\u00eb at\u00eb q\u00eb kemi b\u00ebr\u00eb m\u00eb par\u00eb \u2014 krijojm\u00eb template, p\u00ebrmir\u00ebsojm\u00eb dhe optimizojm\u00eb kodin, riformulojm\u00eb dhe sakt\u00ebsojm\u00eb hipotez\u00ebn etj.<\/li>\n<\/ul>\n<p>Ky cik\u00ebl do t\u00eb jet\u00eb i aplikuesh\u00ebm edhe p\u00ebr Cisco Stealthwatch, vet\u00ebm se ky i fundit maksimizuar automatikisht k\u00ebto pes\u00eb hapa, duke zvog\u00ebluar numrin e gabimeve nga analisti dhe duke rritur shpejt\u00ebsin\u00eb e zbulimit t\u00eb incidenteve. P\u00ebr shembull, n\u00eb SiLK, statistik\u00ebn e rrjetit mund ta pasuruar me t\u00eb dh\u00ebna t\u00eb jashtme p\u00ebr IP-t\u00eb keqdash\u00ebse p\u00ebrmes skripteve t\u00eb shkruara vet\u00eb, nd\u00ebrsa n\u00eb Cisco Stealthwatch \u2014 kjo \u00ebsht\u00eb nj\u00eb funksionalitet i nd\u00ebrtuar, q\u00eb menj\u00ebher\u00eb ju tregon nj\u00eb sinjal alarmi n\u00ebse n\u00eb trafikun e rrjetit hasni nd\u00ebrveprime me IP-t\u00eb nga lista e zez\u00eb.<\/p>\n<p>N\u00ebse shohim m\u00eb lart n\u00eb piramid\u00ebn e \"pagesave\" t\u00eb softuerit p\u00ebr analiz\u00ebn e flukseve, pas SiLK krejt\u00ebsisht falas vjen ELK, i cili p\u00ebrb\u00ebhet nga tre komponent\u00eb kryesor\u00eb \u2014 Elasticsearch (indeksimi, k\u00ebrkimi dhe analiza e t\u00eb dh\u00ebnave), Logstash (hyrja\/daljen e t\u00eb dh\u00ebnave) dhe Kibana (vizualizimi). Ndryshe nga SiLK, ku gjith\u00e7ka duhet ta shkruani vet\u00eb, ELK ka shum\u00eb biblioteka\/modula t\u00eb gatsh\u00ebm (disa pages\u00eb, disa jo), q\u00eb automatizojn\u00eb analiz\u00ebn e telemetris\u00eb s\u00eb rrjetit. P\u00ebr shembull, filtri GeoIP n\u00eb Logstash lejon lidhjen e IP-ve t\u00eb v\u00ebzhguara me pozitat e tyre gjeografike (n\u00eb t\u00eb nj\u00ebjtin Stealthwatch kjo \u00ebsht\u00eb nj\u00eb funksionalitet i nd\u00ebrtuar).<\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/addd9d9656f64f81d86a0cce8ee0810b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nELK gjithashtu ka nj\u00eb komunitet t\u00eb madh, q\u00eb shkruan komponent\u00ebt e munguar p\u00ebr k\u00ebt\u00eb zgjidhje monitorimi. P\u00ebr shembull, p\u00ebr t\u00eb punuar me Netflow, IPFIX dhe sFlow mund t\u00eb p\u00ebrdorni modulin <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/robcowart\/elastiflow\">elastiflow<\/a><\/noindex>, n\u00ebse nuk jeni t\u00eb k\u00ebnaqur me Modulin e Netflow t\u00eb Logstash, q\u00eb mb\u00ebshtet vet\u00ebm Netflow.<\/p>\n<p>Duke ofruar m\u00eb shum\u00eb shpejt\u00ebsi n\u00eb mbledhjen e flukseve dhe k\u00ebrkimin n\u00eb to, ELK p\u00ebr momentin nuk ka nj\u00eb analiz\u00eb t\u00eb pasur t\u00eb nd\u00ebrtuar p\u00ebr zbulimin e anomalive dhe k\u00ebrc\u00ebnimeve n\u00eb telemetrin\u00eb e rrjetit. At\u00ebher\u00eb, duke ndjekur ciklin e jet\u00ebs t\u00eb p\u00ebrshkruar m\u00eb sip\u00ebr, do t'ju duhet t'i p\u00ebrshkruani vet\u00eb modelet e shkeljeve dhe m\u00eb pas t\u00eb p\u00ebrdorni ato n\u00eb sistemin e luft\u00ebs (nuk ka modele t\u00eb nd\u00ebrtuara atje).<\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/6d8368f4c130c3a5770890cb6c5fe5ab.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSigurisht, ekzistojn\u00eb edhe zgjatje m\u00eb t\u00eb avancuara p\u00ebr ELK, n\u00eb t\u00eb cilat jan\u00eb t\u00eb inkorporuara disa modele p\u00ebr identifikimin e anomali n\u00eb telemetrin\u00eb rrjetore, por k\u00ebto zgjatje kushtojn\u00eb para dhe k\u00ebtu lind pyetja, a ia vlen p\u00ebrpjekja \u2014 t\u00eb shkruash nj\u00eb model t\u00eb ngjash\u00ebm vet\u00eb, t\u00eb blesh realizimin e tij p\u00ebr mjetin t\u00ebnd t\u00eb monitorimit ose t\u00eb blesh nj\u00eb zgjidhje t\u00eb gatshme t\u00eb klas\u00ebs Analiza e Trafikut t\u00eb Rrjetit.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/d938ebb4271c4dfb73a1e4b6e94c91d6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb t\u00eb v\u00ebrtet\u00eb, nuk dua t\u00eb hyj n\u00eb polemik\u00eb se \u00ebsht\u00eb m\u00eb mir\u00eb t\u00eb shpenzosh para dhe t\u00eb blesh nj\u00eb zgjidhje t\u00eb gatshme p\u00ebr monitorimin e anomali dhe k\u00ebrc\u00ebnimeve n\u00eb telemetrin\u00eb rrjetore (p.sh., Cisco Stealthwatch) ose t\u00eb merresh me t\u00eb vet\u00eb dhe t\u00eb rregullosh p\u00ebr \u00e7do k\u00ebrc\u00ebnim t\u00eb ri t\u00eb nj\u00ebjtin SiLK, ELK ose nfdump ose OSU Flow Tools (kam parasysh dy t\u00eb fundit). <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/348532\/\">kam treguar<\/a><\/noindex> n\u00eb her\u00ebn e fundit)? Secili zgjedh p\u00ebr vete dhe \u00e7do nj\u00ebrin e kan\u00eb motivet e veta p\u00ebr t\u00eb zgjedhur nj\u00eb nga k\u00ebto dy mund\u00ebsi. Un\u00eb vet\u00ebm doja t\u00eb tregoja se telemetria rrjetore \u00ebsht\u00eb nj\u00eb mjet shum\u00eb i r\u00ebnd\u00ebsish\u00ebm n\u00eb sigurimin e siguris\u00eb s\u00eb rrjetit t\u00eb infrastruktur\u00ebs s\u00eb tij t\u00eb brendshme dhe nuk duhet neglizhuar q\u00eb t\u00eb mos p\u00ebrfshin list\u00ebn e kompanive, t\u00eb cilat emri i tyre p\u00ebrmendet n\u00eb media bashk\u00eb me epitetet \"i hackuar\", \"nuk p\u00ebrmbushte k\u00ebrkesat p\u00ebr siguri\" dhe \"nuk mendon p\u00ebr sigurin\u00eb e t\u00eb dh\u00ebnave t\u00eb saj dhe t\u00eb dh\u00ebnave t\u00eb klient\u00ebve\".<\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/de7df67df66b7abe89170c7f92fcefca.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDuke p\u00ebrmbledhur, do doja t\u00eb p\u00ebrmend disa k\u00ebshilla thelb\u00ebsore, t\u00eb cilave ia vlejn\u00eb t\u00eb ndiqen gjat\u00eb nd\u00ebrtimit t\u00eb monitorimit t\u00eb siguris\u00eb s\u00eb brendshme t\u00eb infrastruktur\u00ebs tuaj:<\/p>\n<ol>\n<li>Mos u kufizoni vet\u00ebm n\u00eb perimetrin! P\u00ebrdorni (dhe zgjidhni) infrastruktur\u00ebn rrjetore jo vet\u00ebm p\u00ebr t\u00eb transferuar trafik nga pika A n\u00eb pik\u00ebn B, por gjithashtu p\u00ebr t\u00eb zgjidhur \u00e7\u00ebshtje t\u00eb siguris\u00eb kibernetike.<\/li>\n<li>Studoni mekanizmat ekzistues t\u00eb monitorimit t\u00eb siguris\u00eb n\u00eb pajisjet tuaja rrjetore dhe aktivizoni ato.<\/li>\n<li>P\u00ebr monitorimin e brendsh\u00ebm, preferoni analiz\u00ebn e telemetris\u00eb \u2014 ajo mund t\u00eb zbuloj\u00eb deri n\u00eb 80-90% t\u00eb t\u00eb gjitha incidenteve t\u00eb siguris\u00eb n\u00eb rrjet, duke b\u00ebr\u00eb ato q\u00eb jan\u00eb t\u00eb pamundura me kapjen e paketave rrjetore dhe duke kursyer hap\u00ebsir\u00eb p\u00ebr ruajtjen e t\u00eb gjitha ngjarjeve t\u00eb siguris\u00eb.<\/li>\n<li>P\u00ebr monitorimin e flukseve p\u00ebrdorni Netflow v9 ose IPFIX - ato japin m\u00eb shum\u00eb informacion n\u00eb kontekstin e siguris\u00eb dhe lejojn\u00eb monitorimin jo vet\u00ebm t\u00eb IPv4, por edhe t\u00eb IPv6, MPLS, etj.<\/li>\n<li>P\u00ebrdorni protokollin e flukseve pa kampionim - ai ofron m\u00eb shum\u00eb informacion p\u00ebr zbuluar k\u00ebrc\u00ebnime. P\u00ebr shembull, Netflow ose IPFIX.<\/li>\n<li>Kontrolloni ngarkes\u00ebn e pajisjeve tuaja rrjetore \u2013 ndoshta ato nuk do t\u00eb jen\u00eb n\u00eb gjendje t\u00eb p\u00ebrballojn\u00eb edhe protokollin flow. At\u00ebher\u00eb mendoni p\u00ebr aplikimin e sensor\u00ebve virtual\u00eb ose Netflow Generation Appliance.<\/li>\n<li>Zbatoni kontrollin fillimisht n\u00eb nivelin e aksesit \u2013 kjo do t'ju mund\u00ebsoj\u00eb t\u00eb shihni 100% t\u00eb gjith\u00eb trafikut.<\/li>\n<li>N\u00ebse nuk keni ndonj\u00eb zgjedhje dhe p\u00ebrdorni pajisje rrjetore ruse, zgjidhni ato q\u00eb mb\u00ebshtesin protokollet flow ose kan\u00eb porte SPAN\/RSPAN.<\/li>\n<li>Kombinoni sistemet e zbulimit\/ parandalimit t\u00eb sulmeve n\u00eb kufijt\u00eb dhe sistemet e analiz\u00ebs s\u00eb flukseve brenda rrjetit (p\u00ebrfshir\u00eb edhe n\u00eb cloud).<\/li>\n<\/ol>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/c54e4b02a906f470bbfb617f48cdd216.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSa i p\u00ebrket k\u00ebshill\u00ebs s\u00eb fundit, do t\u00eb doja t\u00eb sillja nj\u00eb ilustrim q\u00eb e kam p\u00ebrmendur m\u00eb par\u00eb. Shihni, n\u00ebse m\u00eb par\u00eb sh\u00ebrbimi i Siguris\u00eb s\u00eb Informacionit Cisco pothuajse e nd\u00ebrtonte t\u00eb t\u00ebrin sistemin e tij t\u00eb monitorimit t\u00eb Siguris\u00eb s\u00eb Informacionit mbi sistemet e zbulimit t\u00eb sulmeve dhe metodat me n\u00ebnshkrim, tani ato p\u00ebrb\u00ebjn\u00eb vet\u00ebm 20% t\u00eb incidenteve. Nj\u00eb tjet\u00ebr 20% p\u00ebrputhet me sistemet e analiz\u00ebs s\u00eb flukseve, q\u00eb tregon se k\u00ebto zgjidhje nuk jan\u00eb nj\u00eb kapriciozitet, por nj\u00eb instrument real n\u00eb veprimtarin\u00eb e sh\u00ebrbimeve t\u00eb Siguris\u00eb s\u00eb Informacionit t\u00eb nj\u00eb nd\u00ebrmarrjeje moderne. Sidomos, pasi q\u00eb keni infrastruktur\u00ebn rrjetore p\u00ebr t'i zbatuar, investimet n\u00eb t\u00eb cilat mund t'i mbrohen n\u00eb m\u00ebnyr\u00eb shtes\u00eb duke ngarkuar edhe funksionet e monitorimit t\u00eb Siguris\u00eb s\u00eb Informacionit.<\/p>\n<p><img decoding=\"async\" alt=\"Protokollat e Flow si nj\u00eb instrument p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm\" src=\"\/wp-content\/uploads\/2019\/08\/2166f265222c43b0b2cbbcf4091c1f8c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKisha p\u00ebr q\u00ebllim t\u00eb mos merrem me tem\u00ebn e reagimit ndaj anomalive ose k\u00ebrc\u00ebnimeve t\u00eb identifikuara n\u00eb flukset rrjetore, por mendoj se \u00ebsht\u00eb e qart\u00eb q\u00eb monitorimi nuk duhet t\u00eb p\u00ebrfundoj\u00eb vet\u00ebm me identifikimin e k\u00ebrc\u00ebnimit. Pas k\u00ebsaj duhet t\u00eb ndiqet nj\u00eb reagim, dhe preferohet n\u00eb m\u00ebnyr\u00eb automatike ose t\u00eb automatizuar. Por kjo \u00ebsht\u00eb nj\u00eb tem\u00eb e materialeve t\u00eb ndara.<\/p>\n<p>Informacion shtes\u00eb:<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/products\/ios-nx-os-software\/ios-netflow\/index.html\">P\u00ebrshkrimi i Cisco IOS Netflow<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/community.cisco.com\/t5\/security-documents\/netflow-support-matrix\/ta-p\/3644638\">Matrica e mb\u00ebshtetjes s\u00eb Netflow n\u00eb zgjidhje t\u00eb ndryshme Cisco<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/dam\/en\/us\/td\/docs\/security\/stealthwatch\/netflow\/Cisco_NetFlow_Configuration.pdf\">Udh\u00ebzues p\u00ebr konfigurimin e Netflow n\u00eb platforma t\u00eb ndryshme Cisco<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/sflow.org\">Komuniteti sFlow<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.ciscolive.com\/c\/dam\/r\/ciscolive\/us\/docs\/2015\/pdf\/LTRSEC-3336.pdf\">Laboratori i p\u00ebrdorimit t\u00eb Stealthwatch, SiLK dhe ELK p\u00ebr analizimin e Netflow nga k\u00ebndv\u00ebshtrimi i siguris\u00eb<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tools.netsa.cert.org\/silk\/\">Faqja e SiLK<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tools.netsa.cert.org\/silk\/analysis-handbook.pdf\">Nj\u00eb udh\u00ebzues treqind faqesh p\u00ebr p\u00ebrdorimin e SiLK me shum\u00eb shembuj<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/logstash\/current\/netflow-module.html\">Moduli Netflow i Logstash<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/blogs.cisco.com\/security\/step-by-step-setup-of-elk-for-netflow-analytics\">Udh\u00ebzues hap pas hapi Cisco p\u00ebr analizimin e Netflow n\u00eb ELK<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/307528\/\">Analiza e NetFlow v.9 Cisco ASA me Logstash (ELK)<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/ru_ru\/products\/security\/stealthwatch\/index.html\">Zgjidhja Cisco Stealthwatch<\/a><\/noindex><\/li>\n<\/ul>\n<p>PS. N\u00ebse ju duket m\u00eb e leht\u00eb t\u00eb kuptoni fjal\u00ebt e shkruara n\u00eb m\u00ebnyr\u00eb t\u00eb d\u00ebgjueshme, mund t\u00eb shikoni nj\u00eb prezantim nj\u00ebor\u00ebsh q\u00eb sh\u00ebrbeu si baz\u00eb p\u00ebr k\u00ebt\u00eb sh\u00ebnim.<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"ncDRZsueETo\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/ncDRZsueETo\/hqdefault.jpg\" alt=\"Luaj videon\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/464601\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u0433\u0434\u0430 \u0440\u0435\u0447\u044c \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c DLP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u0410 \u0435\u0441\u043b\u0438 \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u0442\u044c \u0443\u0442\u043e\u0447\u043d\u0438\u0442\u044c \u0432\u043e\u043f\u0440\u043e\u0441 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c, \u043a\u0430\u043a \u0432\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u0431\u0443\u0434\u0435\u0442, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a (intrusion detection systems, IDS). \u0418 \u0442\u043e, \u0447\u0442\u043e \u0431\u044b\u043b\u043e \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28091,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37437","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u0433\u0434\u0430 \u0440\u0435\u0447\u044c \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c DLP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Flow-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u0433\u0434\u0430 \u0440\u0435\u0447\u044c \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c DLP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:17:38+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:17:38+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Protokollat Flow si nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb s\u00eb rrjetit t\u00eb brendsh\u00ebm | ProHoster","description":"Kur \u00ebsht\u00eb fjala p\u00ebr monitorimin e siguris\u00eb s\u00eb nj\u00eb rrjeti t\u00eb brendsh\u00ebm korporativ apo agjensie, shum\u00eb njer\u00ebz e lidhin at\u00eb me kontrollin e rrjedhjeve t\u00eb informacionit dhe implementimin e zgjidhjeve DLP.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Flow-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 | ProHoster","og:description":"\u041a\u043e\u0433\u0434\u0430 \u0440\u0435\u0447\u044c \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c DLP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:17:38+00:00","article:modified_time":"2019-10-31T19:17:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37437","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 17:49:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:26:28","updated":"2026-01-23 17:49:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/37437","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=37437"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/37437\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/28091"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=37437"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=37437"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=37437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}