{"id":78318,"date":"2020-04-18T13:42:43","date_gmt":"2020-04-18T11:42:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/analiz-zashifrovannogo-trafika-bez-ego-rasshifrovki"},"modified":"2020-04-18T13:42:43","modified_gmt":"2020-04-18T11:42:43","slug":"analiz-zashifrovannogo-trafika-bez-ego-rasshifrovki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/analiz-zashifrovannogo-trafika-bez-ego-rasshifrovki","title":{"rendered":"Analiza e trafikut t\u00eb enkriptuar pa e dekriptuar at\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nj\u00eb sistem p\u00ebr analiz\u00ebn e trafik q\u00eb nuk e dekripton at\u00eb. Ky metod quhet thjesht - \"m\u00ebsim makinerik\". Ka rezultuar se, n\u00ebse n\u00eb inputin e nj\u00eb klasifikuesi t\u00eb ve\u00e7ant\u00eb i jepet nj\u00eb sasi shum\u00eb e madhe e trafikut t\u00eb ndrysh\u00ebm, sistemi me nj\u00eb shkall\u00eb shum\u00eb t\u00eb lart\u00eb besueshm\u00ebrie mund t\u00eb detektoj\u00eb veprimet e kodit t\u00eb d\u00ebmsh\u00ebm brenda trafik t\u00eb enkriptuar.<\/p>\n

<\/p>\n

\"Analiza<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00ebrc\u00ebnimet n\u00eb rrjet kan\u00eb ndryshuar dhe jan\u00eb b\u00ebr\u00eb 'm\u00eb t\u00eb men\u00e7ura'. N\u00eb koh\u00ebt e fundit, koncepti i sulmit dhe mbrojtjes ka ndryshuar. Numri i ngjarjeve n\u00eb rrjet ka rritur disa her\u00eb. Sulmet jan\u00eb b\u00ebr\u00eb m\u00eb t\u00eb sofistikuara, dhe hakerat kan\u00eb marr\u00eb nj\u00eb gam\u00eb m\u00eb t\u00eb gjer\u00eb sulmesh.<\/p>\n

<\/p>\n

Sipas statistikave t\u00eb Cisco, kriminel\u00ebt gjat\u00eb vitit t\u00eb kaluar rrit\u00ebn n\u00eb 3 her\u00eb numrin e programeve t\u00eb d\u00ebmshme q\u00eb p\u00ebrdorin p\u00ebr aktivitetet e tyre, sakt\u00ebsisht p\u00ebr fshehjen e saj - enkriptimin. Nga teoria e njohur, algoritmi i 'duhur' i enkriptimit nuk mund t\u00eb thyhet. P\u00ebr t\u00eb kuptuar se \u00e7far\u00eb fshihet brenda trafik t\u00eb enkriptuar, \u00ebsht\u00eb e nevojshme ose ta dekriptojm\u00eb duke e ditur \u00e7el\u00ebsin, ose t\u00eb p\u00ebrpiqemi ta dekriptojm\u00eb at\u00eb me metoda t\u00eb ndryshme, ose me nj\u00eb sulm t\u00eb drejtp\u00ebrdrejt\u00eb, ose duke p\u00ebrdorur disa dob\u00ebsi n\u00eb protokollet kriptografike.<\/p>\n

<\/p>\n

\"Analiza
\nPamja e k\u00ebrc\u00ebnimeve n\u00eb rrjet p\u00ebr koh\u00ebn ton\u00eb<\/em><\/p>\n

<\/p>\n

M\u00ebsimi makinerik<\/h3>\n

<\/p>\n

Njihni teknologjin\u00eb n\u00eb fytyr\u00eb! Para se t\u00eb flasim p\u00ebr m\u00ebnyr\u00ebn se si funksionon teknologjia e dekriptimeve mbi baz\u00ebn e m\u00ebsimit makinerik, \u00ebsht\u00eb e nevojshme t\u00eb shqyrtojm\u00eb se si funksionon teknologjia e rrjet\u00ebve nervore.<\/p>\n

<\/p>\n

M\u00ebsimi makinerik (Machine Learning) \u00ebsht\u00eb nj\u00eb n\u00ebnndarje e gjer\u00eb e inteligjenc\u00ebs artificiale, q\u00eb studion metodat e nd\u00ebrtimit t\u00eb algoritmeve, t\u00eb cilat jan\u00eb n\u00eb gjendje t\u00eb m\u00ebsojn\u00eb. Ky disiplin\u00eb \u00ebsht\u00eb e drejtuar drejt krijimit t\u00eb modeleve matematikore t\u00eb 'm\u00ebsimit' t\u00eb kompjuter\u00ebve. Q\u00ebllimi i m\u00ebsimit \u00ebsht\u00eb parashikimi i di\u00e7kaje. N\u00eb kuptimin human, ne e quajm\u00eb k\u00ebt\u00eb proces me fjal\u00ebn \"men\u00e7uri\"<\/em>. Men\u00e7uria shfaqet te njer\u00ebzit q\u00eb kan\u00eb jetuar mjaft vite (nj\u00eb f\u00ebmij\u00eb dy vje\u00e7ar nuk mund t\u00eb jet\u00eb i men\u00e7ur). Duke k\u00ebrkuar k\u00ebshilla nga t\u00eb rriturit, ne u japim atyre nj\u00eb informacion rreth ngjarjes (t\u00eb dh\u00ebnat) dhe k\u00ebrkojm\u00eb ndihm\u00ebn e tyre. Ata nga ana e tyre p\u00ebrkujtojn\u00eb t\u00eb gjitha situatat nga jeta q\u00eb kan\u00eb lidhje me problemin tuaj (baza e njohurive) dhe mbi baz\u00ebn e k\u00ebtyre njohurive (t\u00eb dh\u00ebnave) na japin, n\u00eb nj\u00eb far\u00eb m\u00ebnyre, nj\u00eb parashikim (k\u00ebshill\u00eb). Ky lloj k\u00ebshille quhet parashikim sepse personi q\u00eb jep k\u00ebshilla nuk e di me siguri se \u00e7far\u00eb do t\u00eb ndodh\u00eb, por thjesht supozon. P\u00ebrvoja e jet\u00ebs tregon se nj\u00eb njeri mund t\u00eb ket\u00eb t\u00eb drejt\u00eb, por gjithashtu mund t\u00eb gaboj\u00eb.<\/p>\n

<\/p>\n

Nuk ka sens t\u00eb krahasosh rrjetet nervore me algoritmin e deges\u00ebs (if-else). K\u00ebto jan\u00eb gj\u00ebra t\u00eb ndryshme dhe ka dallime ky\u00e7e mes tyre. Algoritmi i deges\u00ebs ka nj\u00eb 'kuptim' t\u00eb qart\u00eb p\u00ebr at\u00eb q\u00eb duhet b\u00ebr\u00eb. Do ta demonstroj me shembuj.<\/p>\n

<\/p>\n

Detyra. T\u00eb p\u00ebrcaktoj\u00eb distanc\u00ebn e frenimit t\u00eb nj\u00eb automobili sipas mark\u00ebs dhe vitit t\u00eb prodhimit.<\/p>\n

<\/p>\n

Shembulli i funksionimit t\u00eb algoritmit t\u00eb deges\u00ebs. N\u00ebse automobili \u00ebsht\u00eb nga marka 1 dhe \u00ebsht\u00eb prodhuar n\u00eb vitin 2012 \u2013 distanca e frenimit \u00ebsht\u00eb 10 metra, p\u00ebrndryshe, n\u00ebse automobili \u00ebsht\u00eb nga marka 2 dhe \u00ebsht\u00eb prodhuar n\u00eb vitin 2011 dhe k\u00ebshtu me radh\u00eb.<\/p>\n

<\/p>\n

Shembulli i pun\u00ebs s\u00eb nj\u00eb rrjeti nervor. Mblidhni t\u00eb dh\u00ebna rreth distancave t\u00eb frenimit t\u00eb automjeteve p\u00ebr 20 vitet e fundit. Sipas mark\u00ebs dhe vitit, p\u00ebrgatisni nj\u00eb tabel\u00eb t\u00eb formatit 'mark\u00eb-viti i prodhimit-distanca e frenimit'. I japim k\u00ebsaj tabele rrjetit nervor dhe fillojm\u00eb ta m\u00ebsojm\u00eb. M\u00ebsimi kryhet n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb: i japim t\u00eb dh\u00ebnat rrjetit nervor, por pa distanc\u00ebn e frenimit. Rrjeti nervor p\u00ebrpiqet t\u00eb parashikoj\u00eb se cila do t\u00eb jet\u00eb distanca e frenimit, bazuar n\u00eb tabel\u00ebn q\u00eb ka marr\u00eb. Ai parashikon di\u00e7ka dhe i b\u00ebn nj\u00eb pyetje p\u00ebrdoruesit 'Kam t\u00eb drejt\u00eb?'. Para pyetjes, ai krijon nj\u00eb kolon\u00eb t\u00eb kat\u00ebrt \u2013 kolona e parashikimit. N\u00ebse ai ka t\u00eb drejt\u00eb \u2013 at\u00ebher\u00eb shkruan 1 n\u00eb kolonen e kat\u00ebrt, n\u00ebse gabon \u2013 0. Rrjeti nervor kalon n\u00eb ngjarjen e ardhshme (edhe n\u00ebse ka gabuar). K\u00ebshtu rrjeti m\u00ebson dhe kur m\u00ebsimi p\u00ebrfundon (kur arrihet nj\u00eb kritere e caktuar konvergjence), ne i japim t\u00eb dh\u00ebnat p\u00ebr automobilin q\u00eb na intereson dhe m\u00eb n\u00eb fund merrni p\u00ebrgjigjen.<\/p>\n

<\/p>\n

P\u00ebr t\u00eb sqaruar pyetjen rreth kritereve t\u00eb konvergjenc\u00ebs, le t\u00eb sqaroj se kjo \u00ebsht\u00eb nj\u00eb formul\u00eb e nxjerr\u00eb matematikisht p\u00ebr statistik\u00ebn. Nj\u00eb shembull i spikatur i dy formulave t\u00eb ndryshme t\u00eb konvergjenc\u00ebs. E kuqe \u2013 konvergjenc\u00eb binar\u00eb, e kalt\u00ebr \u2013 konvergjenc\u00eb normale.<\/p>\n

<\/p>\n

\"Analiza
\nDistribucioni binomiale dhe normale e mund\u00ebsive<\/em><\/p>\n

<\/p>\n

P\u00ebr ta b\u00ebr\u00eb m\u00eb t\u00eb qart\u00eb, shtoni pyetjen \"Cila \u00ebsht\u00eb mund\u00ebsia e takimit me nj\u00eb dinosaur?\". K\u00ebtu ka 2 opsione p\u00ebrgjigjeje. Opsioni 1 \u2013 shum\u00eb i vog\u00ebl (grafiku blu). Opsioni 2 \u2013 ose do ta takoj, ose jo (grafiku i kuq).<\/p>\n

<\/p>\n

Sigurisht, kompjuteri nuk \u00ebsht\u00eb njeri dhe m\u00ebson ndryshe. Dallohet 2 lloje m\u00ebsimi t\u00eb 'kalit t\u00eb hekurt' \u2013 m\u00ebsimi nga precedencat<\/strong> dhe m\u00ebsimi deduktiv<\/strong>.<\/p>\n

<\/p>\n

M\u00ebsimi nga precedencat \u00ebsht\u00eb nj\u00eb m\u00ebnyr\u00eb m\u00ebsimi sipas ligjeve matematikore. Matematikant\u00ebt mbledhin tabela statistikash, nxjerrin p\u00ebrfundime dhe ngarkojn\u00eb n\u00eb rrjetin nervor rezultatin \u2013 formul\u00ebn p\u00ebr llogaritje.<\/p>\n

<\/p>\n

M\u00ebsimi deduktiv \u2013 m\u00ebsimi ndodh krejt\u00ebsisht n\u00eb rrjetin nervor (nga mbledhja e t\u00eb dh\u00ebnave, deri tek analiza e tyre). K\u00ebtu formohet tabela pa formul\u00eb, por me statistik\u00eb.<\/p>\n

<\/p>\n

Nj\u00eb shqyrtim i gjer\u00eb i teknologjis\u00eb do t\u00eb k\u00ebrkonte edhe disa dhjet\u00ebra artikuj. Deri tani, kjo mjafton p\u00ebr nj\u00eb kuptim t\u00eb p\u00ebrgjithsh\u00ebm.<\/p>\n

<\/p>\n

Neuroplasticiteti<\/h3>\n

<\/p>\n

N\u00eb biologji ka nj\u00eb koncept t\u00eb till\u00eb \u2013 neuroplasticiteti. Neuroplasticiteti \u00ebsht\u00eb aft\u00ebsia e neuroneve (qelizave t\u00eb trurit) p\u00ebr t\u00eb vepruar \"sip\u00ebr situat\u00ebs\". P\u00ebr shembull, nj\u00eb person q\u00eb ka humbur shikimin d\u00ebgjon m\u00eb mir\u00eb tingujt, ndjen aromat dhe ndjen objekte. Kjo ndodh sepse nj\u00eb pjes\u00eb e trurit (nj\u00eb pjes\u00eb e neuroneve) q\u00eb p\u00ebrgjigjet p\u00ebr shikimin e shp\u00ebrndan pun\u00ebn e saj n\u00eb funksionalitete t\u00eb tjera.<\/p>\n

<\/p>\n

Nj\u00eb shembull i duksh\u00ebm i neuroplasticitetit n\u00eb jet\u00eb \u00ebsht\u00eb karamele BrainPort.<\/p>\n

<\/p>\n

N\u00eb vitin 2009, Universiteti i Wisconsin n\u00eb Madison njoftoi daljen n\u00eb drit\u00eb t\u00eb nj\u00eb pajisjeje t\u00eb re, e cila zhvillonte idet\u00eb e \"ekraneve gjuh\u00ebsore\" \u2013 ajo mori emrin BrainPort. BrainPort funksionon sipas k\u00ebtij algoritmi: sinjali vizual vjen nga kamera n\u00eb procesor, i cili menaxhon zoom-in, ndri\u00e7imin dhe parametrat e tjer\u00eb t\u00eb imazhit. Ai gjithashtu transformon sinjalet digjitale n\u00eb impulse elektrike, duke marr\u00eb n\u00eb fakt funksionet e retin\u00ebs.<\/p>\n

<\/p>\n

\"Analiza
\nKaramele BrainPort me syze dhe kamer\u00eb<\/em><\/p>\n

<\/p>\n

\"Analiza
\nBrainPort n\u00eb pun\u00eb<\/em><\/p>\n

\n

\r\n \"Luaj\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Po ashtu edhe me kompjuterin. N\u00ebse rrjeti nervor ndien nj\u00eb ndryshim n\u00eb proces, ai p\u00ebrshtatet me t\u00eb. K\u00ebtu q\u00ebndron dhe avantazhi ky\u00e7 i rrjetave nervore n\u00eb krahasim me algoritmet e tjera \u2013 autonomi. Nj\u00eb lloj njer\u00ebzish.<\/p>\n

<\/p>\n

Analiza e Trafikut t\u00eb Kriptuar<\/h3>\n

<\/p>\n

Analitika Traffikut t\u00eb Kriptuar \u00ebsht\u00eb pjes\u00eb e sistemit Stealthwatch. Stealthwatch \u00ebsht\u00eb nj\u00eb zhvillim i kompanis\u00eb Cisco n\u00eb sektorin e zgjidhjeve p\u00ebr monitorimin dhe analitik\u00ebn e siguris\u00eb, i cili p\u00ebrdor t\u00eb dh\u00ebna korporative telemetrije nga infrastruktura ekzistuese e rrjetit.<\/p>\n

<\/p>\n

Themelin e Stealthwatch Enterprise e p\u00ebrb\u00ebjn\u00eb mjetet Flow Rate License, Flow Collector, Management Console dhe Flow Sensor.<\/p>\n

<\/p>\n

\"Analiza
\nNd\u00ebrfaqja Cisco Stealthwatch<\/em><\/p>\n

<\/p>\n

Problemi i kriptimit \u00ebsht\u00eb b\u00ebr\u00eb shum\u00eb m\u00eb i r\u00ebnd\u00ebsish\u00ebm pasi q\u00eb \u00ebsht\u00eb rritur n\u00eb m\u00ebnyr\u00eb t\u00eb konsiderueshme trafiku i kriptuar. Disa vite m\u00eb par\u00eb kriptoheshin vet\u00ebm kodet (n\u00eb t\u00eb shumt\u00ebn), nd\u00ebrsa tani kriptohet i gjith\u00eb trafiku dhe ndarja e t\u00eb dh\u00ebnave \"t\u00eb pastra\" nga viruset \u00ebsht\u00eb b\u00ebr\u00eb shum\u00eb m\u00eb e v\u00ebshtir\u00eb. Nj\u00eb shembull i qart\u00eb \u00ebsht\u00eb WannaCry, i cili p\u00ebrdori Tor p\u00ebr t\u00eb fshehur pranin\u00eb e tij n\u00eb rrjet.<\/p>\n

<\/p>\n

\"Analiza
\nVizualizimi i rritjes s\u00eb numrit t\u00eb kriptimit t\u00eb trafikut n\u00eb rrjet<\/em><\/p>\n

<\/p>\n

\"Analiza
\nKriptimi n\u00eb makroekonomi<\/em><\/p>\n

<\/p>\n

Sistemi i Analitik\u00ebs s\u00eb Traffikut t\u00eb Kriptuar (ETA) \u00ebsht\u00eb i domosdosh\u00ebm pik\u00ebrisht p\u00ebr t\u00eb punuar me trafikun e kriptuar pa e dekriptuar at\u00eb. Sulmuesit jan\u00eb t\u00eb zgjuar dhe p\u00ebrdorin algoritme t\u00eb kriptimit t\u00eb fort\u00eb, dhe thyerja e tyre \u00ebsht\u00eb jo vet\u00ebm nj\u00eb problem, por edhe nj\u00eb kosto shum\u00eb e madhe p\u00ebr organizatat.<\/p>\n

<\/p>\n

Sistemi funksionon si m\u00eb posht\u00eb. Nj\u00ebfar\u00eb trafiku vjen n\u00eb kompani. Ai hyn n\u00eb TLS (siguria e shtres\u00ebs s\u00eb transportit). Le t\u00eb themi se trafiku \u00ebsht\u00eb i kriptuar. Ne p\u00ebrpiqemi t\u00eb p\u00ebrgjigjemi n\u00eb disa pyetje rreth lidhjes q\u00eb \u00ebsht\u00eb vendosur.<\/p>\n

<\/p>\n

\"Analiza
\nPrinci i funksionimit t\u00eb sistemit t\u00eb Analitik\u00ebs s\u00eb Traffikut t\u00eb Kriptuar (ETA)<\/em><\/p>\n

<\/p>\n

P\u00ebr t\u00eb p\u00ebrgjigjur n\u00eb k\u00ebto pyetje, ne p\u00ebrdorim m\u00ebsimin makineror n\u00eb k\u00ebt\u00eb sistem. Merren studime nga kompania Cisco dhe nga k\u00ebto studime krijohet nj\u00eb tabel\u00eb me 2 rezultate \u2013 trafiku keqdash\u00ebs dhe ai \"i mir\u00eb\". Sigurisht, ne nuk e dim\u00eb me siguri se \u00e7far\u00eb lloji trafiku ka hyr\u00eb n\u00eb sistem n\u00eb at\u00eb moment t\u00eb caktuar, por mund t\u00eb ndjekim historin\u00eb e trafikut si brenda kompanis\u00eb ashtu edhe jasht\u00eb saj duke u mb\u00ebshtetur n\u00eb t\u00eb dh\u00ebnat nga arena globale. N\u00eb fund t\u00eb k\u00ebtij hapi, ne marrim nj\u00eb tabel\u00eb t\u00eb madhe me t\u00eb dh\u00ebna.<\/p>\n

<\/p>\n

Si pasqyra e hulumtimit identifikon karakteristikat e ve\u00e7anta \u2013 rregullat e caktuara, t\u00eb cilat mund t\u00eb sh\u00ebnohen n\u00eb form\u00eb matematikore. K\u00ebto rregulla do t\u00eb ndryshojn\u00eb ndjesh\u00ebm sipas kritereve t\u00eb ndryshme \u2013 madh\u00ebsis\u00eb s\u00eb skedar\u00ebve t\u00eb d\u00ebrguar, llojit t\u00eb lidhjes, vendit nga i cili vjen ky trafik, etj. Si rezultat, nj\u00eb tabel\u00eb e madhe u transformua n\u00eb nj\u00eb grup formulash. Numri i tyre ra, por kjo \u00ebsht\u00eb e pamjaftueshme p\u00ebr nj\u00eb pun\u00eb komode.<\/p>\n

<\/p>\n

M\u00eb pas, aplikohet teknologjia e m\u00ebsimit t\u00eb makinave \u2013 konvergjenca e formul\u00ebs dhe nga rezultati i konvergjenc\u00ebs ne marrim nj\u00eb shkak \u2013 nj\u00eb ndenj\u00eb q\u00eb, kur t\u00eb dalin t\u00eb dh\u00ebnat, ne marrim nj\u00eb ndal\u00ebs (flak\u00eb) n\u00eb pozita t\u00eb ngritura ose t\u00eb ulura.<\/p>\n

<\/p>\n

Faza p\u00ebrfundimtare \u2013 marrja e nj\u00eb grupi shkaksh, t\u00eb cilat mbulojn\u00eb 99% t\u00eb trafik\u00ebt.<\/p>\n

<\/p>\n

\"Analiza
\nFazat e verifikimit t\u00eb trafik\u00ebt n\u00eb ETA<\/em><\/p>\n

<\/p>\n

Si rezultat i pun\u00ebs, zgjidhet nj\u00eb problem tjet\u00ebr \u2013 sulmi nga brenda. Nuk nevojiten m\u00eb njer\u00ebz n\u00eb mes, t\u00eb cil\u00ebt filtrojn\u00eb trafik\u00ebt manualisht (n\u00eb k\u00ebt\u00eb moment po e renditim veten). N\u00eb radh\u00eb t\u00eb par\u00eb, nuk ka nevoj\u00eb t\u00eb shpenzoni shum\u00eb para p\u00ebr nj\u00eb administrator sistemi t\u00eb aft\u00eb (po vazhdoj t\u00eb renditim veten). N\u00eb t\u00eb dyt\u00ebn, nuk ka rrezik p\u00ebr thyerje nga brenda (t\u00eb pakt\u00ebn, pjes\u00ebrisht).<\/p>\n

<\/p>\n

\"Analiza
\nKoncepti i vjet\u00ebr Man-in-the-Middle<\/em><\/p>\n

<\/p>\n

Tani, le t\u00eb kuptojm\u00eb mbi \u00e7far\u00eb bazohet sistemi.<\/p>\n

<\/p>\n

Sistemi funksionon mbi 4 protokolle komunikimi: TCP\/IP \u2013 protokolli i transmetimit t\u00eb t\u00eb dh\u00ebnave n\u00eb internet, DNS \u2013 serveri i emrave t\u00eb domain-it, TLS \u2013 protokolli i mbrojtjes s\u00eb nivelit p\u00ebr transport, SPLT (SpaceWire Physical Layer Tester) \u2013 tester i nivelit fizik t\u00eb komunikimit.<\/p>\n

<\/p>\n

\"Analiza
\nProtokollet q\u00eb punojn\u00eb me ETA<\/em><\/p>\n

<\/p>\n

Krahasimi b\u00ebhet p\u00ebrmes p\u00ebrputhjes s\u00eb t\u00eb dh\u00ebnave. N\u00ebp\u00ebrmjet protokolleve TCP\/IP kontrollohet reputacioni i faqeve (historiku i vizitave, q\u00ebllimi i krijimit t\u00eb faqes etj.), fal\u00eb protokollit DNS, ne mund t\u00eb eliminojm\u00eb adresat e 'keqe'. Protokolli TLS punon me 'gllofet' e faqes (fingerprint) dhe kontrollon faqen sipas nj\u00eb baze t\u00eb grupit kompjuterik t\u00eb reagimit ndaj situatave emergjente (cert). Faza e fundit e kontrollit t\u00eb lidhjes \u2013 kontrolli n\u00eb nivel fizik. Detajet e pun\u00ebs s\u00eb k\u00ebsaj faze nuk spesifikohen, por kuptimi q\u00ebndron n\u00eb k\u00ebt\u00eb: kontrolli i sinusoidave dhe kosinusoidave t\u00eb kurbave t\u00eb transmetimit t\u00eb t\u00eb dh\u00ebnave n\u00eb instalacione oscilografi, dmth. fal\u00eb struktur\u00ebs s\u00eb k\u00ebrkes\u00ebs n\u00eb nivel fizik, ne p\u00ebrcaktojm\u00eb q\u00ebllimin e lidhjes.<\/p>\n

<\/p>\n

Si pasoj\u00eb e funksionit t\u00eb sistemit, ne mund t\u00eb nxjerrim t\u00eb dh\u00ebna nga trafiku t\u00eb enkriptuar. Fal\u00eb studimit t\u00eb paketimeve, mund t\u00eb lexojm\u00eb maksimumin e informacionit nga fushat e paenkriptuara n\u00eb vet\u00eb paket\u00ebn. P\u00ebrmes inspektimit t\u00eb paketave n\u00eb nivel fizik, do t\u00eb zbulojm\u00eb karakteristikat e paket\u00ebs (pjes\u00ebrisht ose plot\u00ebsisht). Gjithashtu, nuk duhet t\u00eb harrojm\u00eb reputacionin e faqeve. N\u00ebse k\u00ebrkesa ka ardhur nga ndonj\u00eb burim .onion, nuk duhet t'i besoni atij. P\u00ebr leht\u00ebsimin e pun\u00ebs me k\u00ebt\u00eb lloj t\u00eb dh\u00ebnash, \u00ebsht\u00eb krijuar nj\u00eb hart\u00eb rreziku.<\/p>\n

<\/p>\n

\"Analiza
\nRezultati i pun\u00ebs s\u00eb ETA<\/em><\/p>\n

<\/p>\n

Dhe gjith\u00e7ka, dukej e mir\u00eb, por le t\u00eb flasim p\u00ebr vendosjen e rrjetit.<\/p>\n

<\/p>\n

Realizimi fizik i ETA<\/h3>\n

<\/p>\n

K\u00ebtu lindin disa nuanca dhe holl\u00ebsi. S\u00eb pari, gjat\u00eb krijimit t\u00eb k\u00ebtij lloji t\u00eb
\nrrjeti me software me nivel t\u00eb lart\u00eb, \u00ebsht\u00eb e nevojshme mbledhja e t\u00eb dh\u00ebnave. T\u00eb mbledh\u00ebsh t\u00eb dh\u00ebna manualisht \u00ebsht\u00eb krejt\u00ebsisht
\ne v\u00ebshtir\u00eb, nd\u00ebrsa implementimi i nj\u00eb sistemi reagimi \u2013 \u00ebsht\u00eb m\u00eb i interesant. S\u00eb dyti, t\u00eb dh\u00ebnat
\nduhet t\u00eb jen\u00eb t\u00eb shumta, q\u00eb do t\u00eb thot\u00eb se sensor\u00ebt e instaluar n\u00eb rrjet duhet t\u00eb punojn\u00eb
\njo vet\u00ebm autonomisht, por gjithashtu n\u00eb nj\u00eb modalitet t\u00eb hollesish\u00ebm, q\u00eb sjell nj\u00eb s\u00ebr\u00eb v\u00ebshtir\u00ebsish.<\/p>\n

<\/p>\n

\"Analiza
\nSensor\u00ebt dhe sistemi Stealthwatch<\/em><\/p>\n

<\/p>\n

Vendosja e nj\u00eb sensori \u00ebsht\u00eb nj\u00eb gj\u00eb, nd\u00ebrsa konfigurimi i tij \u00ebsht\u00eb nj\u00eb detyr\u00eb krejt\u00ebsisht tjet\u00ebr. P\u00ebr konfigurimin e sensor\u00ebve, ekziston nj\u00eb kompleks q\u00eb funksionon sipas topologjis\u00eb s\u00eb m\u00ebposhtme \u2013 ISR = router me integrim sh\u00ebrbimesh Cisco (Cisco Integrated Services Router); ASR = router me agregimin e sh\u00ebrbimeve Cisco (Cisco Aggregation Services Router); CSR = router p\u00ebr sh\u00ebrbime n\u00eb re Cisco (Cisco Cloud Services Router); WLC = kontrollues i rrjeteve lokale pa telekomand\u00eb Cisco (Cisco Wireless LAN Controller); IE = switche industriale Ethernet Cisco (Cisco Industrial Ethernet); ASA = pajisje mbrojt\u00ebse adaptuese Cisco (Cisco Adaptive Security Appliance); FTD = zgjidhje p\u00ebr mbrojtjen nga k\u00ebrc\u00ebnime Cisco Firepower Threat Defense; WSA = pajisje p\u00ebr mbrojtjen e trafikut web (Web Security Appliance); ISE = modul sh\u00ebrbimesh identifikimi (Identity Services Engine)<\/p>\n

<\/p>\n

\"Analiza
\nMonitorimi i kompleksit duke marr\u00eb parasysh \u00e7do t\u00eb dh\u00ebn\u00eb telemetrike<\/em><\/p>\n

<\/p>\n

Administratoret e rrjetit fillojn\u00eb t\u00eb ken\u00eb aritmi nga numri i fjal\u00ebve \"Cisco\" n\u00eb paragrafin e m\u00ebparsh\u00ebm. \u00c7mimi i k\u00ebtij mrekullie nuk \u00ebsht\u00eb i vog\u00ebl, por sot nuk \u00ebsht\u00eb kjo tema ...<\/p>\n

<\/p>\n

Modelimi i sjelljes s\u00eb haker\u00ebve do t\u00eb ndodh\u00eb si m\u00eb posht\u00eb. Stealthwatch ndjek me kujdes aktivitetin e secilit pajisje n\u00eb rrjet dhe \u00ebsht\u00eb n\u00eb gjendje t\u00eb krijoj\u00eb nj\u00eb model t\u00eb sjelljes normale. P\u00ebrve\u00e7 k\u00ebsaj, kjo zgjidhje ofron nj\u00eb kuptim t\u00eb thell\u00eb t\u00eb sjelljes s\u00eb njohur t\u00eb pap\u00ebrshtatshme. N\u00eb kuad\u00ebr t\u00eb k\u00ebsaj zgjidhjeje p\u00ebrdoren rreth 100 algoritme analize t\u00eb ndryshme ose rregulla heuristike, t\u00eb cilat lidhen me lloje t\u00eb ndryshme t\u00eb sjelljes s\u00eb trafik\u00ebve, si skanimi, transmetimi i kornizave t\u00eb alarmit nga nj\u00eb nyje, hyrja n\u00eb sistem p\u00ebrmes p\u00ebrputhjes s\u00eb fjal\u00ebkalimeve, kapja e dyshuar e t\u00eb dh\u00ebnave, p\u00ebrcjellja e dyshuar e t\u00eb dh\u00ebnave etj. Ngjarjet e siguris\u00eb t\u00eb p\u00ebrmendura bien n\u00ebn kategorin\u00eb e alarmit t\u00eb lart\u00eb logjik. Disa ngjarje t\u00eb siguris\u00eb gjithashtu mund t\u00eb shkaktojn\u00eb alarm vet\u00ebm nga vet\u00eb. k\u00ebshtu, sistemi \u00ebsht\u00eb n\u00eb gjendje t\u00eb korreloj\u00eb shum\u00eb incidente anomale t\u00eb izoluara dhe t'i bashkoj\u00eb ato p\u00ebr t\u00eb p\u00ebrcaktuar llojin e mundsh\u00ebm t\u00eb sulmit, si dhe p\u00ebr ta lidhur at\u00eb me nj\u00eb pajisje dhe p\u00ebrdorues t\u00eb caktuar (shih figur\u00ebn 2). M\u00eb pas, incidenti mund t\u00eb studiohet n\u00eb dinamik\u00eb dhe duke marr\u00eb parasysh t\u00eb dh\u00ebnat e lidhura me telemetrin\u00eb. Kjo p\u00ebrb\u00ebn informacion kontekstual n\u00eb shprehjen e saj m\u00eb t\u00eb mir\u00eb. Mjek\u00ebt, q\u00eb kontrollojn\u00eb pacientin p\u00ebr t\u00eb kuptuar se \u00e7far\u00eb ndodhi, nuk i shqyrtojn\u00eb simtomet n\u00eb izolim. Ata shqyrtojn\u00eb pamjen e p\u00ebrgjithshme p\u00ebr t\u00eb vendosur diagnoz\u00ebn. N\u00eb t\u00eb nj\u00ebjt\u00ebn m\u00ebnyr\u00eb, Stealthwatch regjistron \u00e7do aktivitet anomale n\u00eb rrjet dhe e studion at\u00eb n\u00eb kompleks, duke d\u00ebrguar alarme duke marr\u00eb parasysh kontekstin, duke ndihmuar k\u00ebshtu specialist\u00ebt e siguris\u00eb t\u00eb vendosin prioritetet p\u00ebr rreziqet.<\/p>\n

<\/p>\n

\"Analiza
\nIdentifikimi i anomalis\u00eb p\u00ebrmes modelimit t\u00eb sjelljes<\/em><\/p>\n

<\/p>\n

Ndishtja fizike e rrjetit duket si n\u00eb vijim:<\/p>\n

<\/p>\n

\"Analiza
\nVarianti i implementimit t\u00eb rrjetit t\u00eb deg\u00ebve (i thjesht\u00ebsuar)<\/em><\/p>\n

<\/p>\n

\"Analiza
\nVarianti i implementimit t\u00eb rrjetit t\u00eb deg\u00ebve<\/em><\/p>\n

<\/p>\n

Rrjeti \u00ebsht\u00eb implementuar, por mbetet nj\u00eb pyetje e hapur p\u00ebr nevrone. Organizuan nj\u00eb rrjet t\u00eb transfert\u00ebs s\u00eb t\u00eb dh\u00ebnave, vendos\u00ebn sensor\u00eb n\u00eb prag dhe aktivizuan sistemin e mbledhjes s\u00eb informacionit, por neuronet nuk mor\u00ebn pjes\u00eb. Deri tani.<\/p>\n

<\/p>\n

Rrjet neuronesh me shum\u00eb nivele<\/h3>\n

<\/p>\n

Sistemi analizon sjelljen e p\u00ebrdoruesit dhe pajisjes p\u00ebr t\u00eb identifikuar infeksione malicioze, komunikimet me server\u00ebt komandues, rrjedhjet e t\u00eb dh\u00ebnave, si dhe aplikacionet potencialisht t\u00eb pad\u00ebshiruara q\u00eb operojn\u00eb n\u00eb infrastruktur\u00ebn e organizat\u00ebs. Ka disa nivele t\u00eb p\u00ebrpunimit t\u00eb t\u00eb dh\u00ebnave, ku nj\u00eb kombinim i metodave t\u00eb inteligjenc\u00ebs artificiale, m\u00ebsimit t\u00eb makinave dhe statistik\u00ebs matematikore ndihmon rrjetin t\u00eb m\u00ebsoj\u00eb n\u00eb m\u00ebnyr\u00eb autonome aktivitetin e tij normal, n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb mund t\u00eb identifikoj\u00eb aktivitetin malicioz.<\/p>\n

<\/p>\n

Pipa e analiz\u00ebs s\u00eb siguris\u00eb n\u00eb rrjet, e cila mbledh t\u00eb dh\u00ebna telemetrie nga t\u00eb gjitha pjes\u00ebt e zgjeruara t\u00eb rrjetit, p\u00ebrfshir\u00eb trafik\u00ebn e enkriptuar, \u00ebsht\u00eb nj\u00eb ve\u00e7ori unike e Stealthwatch. Ajo formon gradualisht kuptimin e asaj q\u00eb \u00ebsht\u00eb 'anomale', m\u00eb pas klasifikon elementet specifike t\u00eb 'aktivitetit t\u00eb k\u00ebrc\u00ebnimit' dhe, n\u00eb fund, jep nj\u00eb vendim p\u00ebrfundimtar n\u00eb lidhje me n\u00ebse pajisja ose p\u00ebrdoruesi ishin realisht t\u00eb komprometuar. Aft\u00ebsia p\u00ebr t\u00eb mbledhur bashk\u00eb pjes\u00eb t\u00eb vogla, q\u00eb formojn\u00eb s\u00eb bashku provat p\u00ebr t\u00eb marr\u00eb nj\u00eb vendim p\u00ebrfundimtar rreth komprometimit t\u00eb objektit, sigurohet p\u00ebrmes nj\u00eb analize dhe korelacioni shum\u00eb t\u00eb kujdessh\u00ebm.<\/p>\n

<\/p>\n

Kjo aft\u00ebsi \u00ebsht\u00eb shum\u00eb e r\u00ebnd\u00ebsishme, pasi nj\u00eb nd\u00ebrmarrje standarde mund t\u00eb marr\u00eb \u00e7do dit\u00eb nj\u00eb sasi t\u00eb madhe sinjalesh alarmi dhe t\u00eb kryej\u00eb nj\u00eb hetim p\u00ebr secil\u00ebn prej tyre \u00ebsht\u00eb e pamundur \u2014 burimet e specialist\u00ebve t\u00eb siguris\u00eb jan\u00eb t\u00eb kufizuara. Moduli i m\u00ebsimit t\u00eb makinave p\u00ebrpunon nj\u00eb sasi t\u00eb madhe informacioni pothuajse n\u00eb koh\u00eb reale p\u00ebr t\u00eb identifikuar incidente kritike me nj\u00eb nivel t\u00eb lart\u00eb besimi, si dhe \u00ebsht\u00eb n\u00eb gjendje t\u00eb ofroj\u00eb nj\u00eb renditje t\u00eb qart\u00eb veprimesh p\u00ebr menaxhimin e shpejt\u00eb.<\/p>\n

<\/p>\n

Le t\u00eb shqyrtojm\u00eb m\u00eb n\u00eb detaje metodat e shumta t\u00eb m\u00ebsimit t\u00eb makinave q\u00eb p\u00ebrdoren nga Stealthwatch. Kur nj\u00eb incident d\u00ebrgohet n\u00eb modul t\u00eb m\u00ebsimit t\u00eb makinave Stealthwatch, ai kalon p\u00ebrmes nj\u00eb gypi analize t\u00eb siguris\u00eb, ku p\u00ebrdoret nj\u00eb kombinim i metodave t\u00eb m\u00ebsimit t\u00eb makinave t\u00eb mbik\u00ebqyrura dhe atyre t\u00eb pambik\u00ebqyrura.<\/p>\n

<\/p>\n

\"Analiza
\nAft\u00ebsit\u00eb e m\u00ebsimit t\u00eb shum\u00ebfisht\u00eb t\u00eb makinave<\/em><\/p>\n

<\/p>\n

Niveli 1. Zbulimi i anomalis\u00eb dhe modelimi i besimit<\/h3>\n

<\/p>\n

N\u00eb k\u00ebt\u00eb nivel, 99% e trafikut filtrohet p\u00ebrmes detektor\u00ebve statistik\u00eb t\u00eb anomalive. Detektor\u00ebt p\u00ebrbashk\u00eb shfrytzohen p\u00ebr t\u00eb formuar modele komplekse t\u00eb asaj q\u00eb \u00ebsht\u00eb normale dhe asaj q\u00eb, p\u00ebrkundrazi, \u00ebsht\u00eb anormale. Megjithat\u00eb, anomalit\u00eb nuk jan\u00eb domosdoshm\u00ebrisht t\u00eb d\u00ebmshme. Shum\u00eb nga ndodhit\u00eb n\u00eb rrjetin tuaj nuk jan\u00eb n\u00eb asnj\u00eb m\u00ebnyr\u00eb t\u00eb lidhura me k\u00ebrc\u00ebnimet \u2014 ato jan\u00eb thjesht t\u00eb \u00e7uditshme. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb klasifikoni k\u00ebto procese pa marr\u00eb parasysh sjelljen k\u00ebrc\u00ebnuese. P\u00ebr k\u00ebt\u00eb arsye, rezultatet e funksionimit t\u00eb k\u00ebtyre detektor\u00ebve kalojn\u00eb n\u00eb nj\u00eb analiz\u00eb t\u00eb m\u00ebtejshme p\u00ebr t\u00eb regjistruar sjelljen e \u00e7uditshme, e cila mund t\u00eb shpjegohet dhe q\u00eb mund t\u00eb besohet. N\u00eb fund t\u00eb fundit, vet\u00ebm nj\u00eb pjes\u00eb e vog\u00ebl e rrjedhave dhe k\u00ebrkesave m\u00eb t\u00eb r\u00ebnd\u00ebsishme kalon n\u00eb nivelet 2 dhe 3. Pa p\u00ebrdorimin e k\u00ebtyre metodave t\u00eb m\u00ebsimit t\u00eb makineris\u00eb, shpenzimet operative p\u00ebr ndarjen e sinjalit nga zhurma do ishin shum\u00eb t\u00eb m\u00ebdha.<\/p>\n

<\/p>\n

Zbulimi i anomalive.<\/strong> N\u00eb faz\u00ebn fillestare t\u00eb zbulimit t\u00eb anomalive, p\u00ebrdoren metoda statistikore t\u00eb m\u00ebsimit t\u00eb makineris\u00eb p\u00ebr t\u00eb ndar\u00eb trafikun statistikisht normal nga ai anormal. M\u00eb shum\u00eb se 70 detektor\u00eb t\u00eb ve\u00e7ant\u00eb p\u00ebrpunojn\u00eb t\u00eb dh\u00ebnat e telemetris\u00eb q\u00eb Stealthwatch mbledh rreth trafikut q\u00eb kalon p\u00ebrmes perimetrave t\u00eb rrjetit tuaj, duke ndar\u00eb trafikun e brendsh\u00ebm t\u00eb sistemit t\u00eb emrave t\u00eb domen\u00ebve (DNS) dhe t\u00eb dh\u00ebnat e server\u00ebve proxy n\u00ebse ka. \u00c7do k\u00ebrkes\u00eb p\u00ebrpunoh\u00ebn nga m\u00eb shum\u00eb se 70 detektor\u00eb, ku secili detektor p\u00ebrdor algoritmin e vet statistikor, duke formuar nj\u00eb vler\u00ebsim t\u00eb zbulimeve t\u00eb anomalis\u00eb. K\u00ebto vler\u00ebsime bashkohen, dhe si rezultat i aplikimit t\u00eb disa metodave statistikore, merret nj\u00eb vler\u00ebsim i vet\u00ebm p\u00ebr \u00e7do k\u00ebrkes\u00eb t\u00eb ve\u00e7ant\u00eb. Pastaj ky vler\u00ebsim i p\u00ebrbashk\u00ebt p\u00ebrdoret p\u00ebr t\u00eb ndar\u00eb trafikun normal nga ai anormal.<\/p>\n

<\/p>\n

Modelimi i besimit.<\/strong> Pastaj k\u00ebrkesat e ngjashme grumbullohen dhe vler\u00ebsimi i p\u00ebrbashk\u00ebt i anomalis\u00eb p\u00ebr k\u00ebto grupe p\u00ebrcaktohet si mesatarja e gjat\u00eb. Me kalimin e koh\u00ebs, analiza dhe p\u00ebrcaktimi i mesatares afatgjat\u00eb ekspozojn\u00eb m\u00eb shum\u00eb k\u00ebrkesa, \u00e7ka leht\u00ebson reduktimin e reagimeve false pozitive dhe false negative. Rezultatet e modelimit t\u00eb besueshm\u00ebris\u00eb p\u00ebrdoren p\u00ebr t\u00eb zgjedhur nj\u00eb n\u00ebn-grup t\u00eb trafikut, vler\u00ebsimi i anomalis\u00eb s\u00eb t\u00eb cilit tejkalon nj\u00eb prag t\u00eb p\u00ebrcaktuar dinamikisht, p\u00ebr ta \u00e7uar n\u00eb nivelin e ardhsh\u00ebm t\u00eb p\u00ebrpunimit.<\/p>\n

<\/p>\n

Niveli 2. Klasifikimi i ngjarjeve dhe modelimi i objektit<\/h3>\n

<\/p>\n

N\u00eb k\u00ebt\u00eb nivel zhvillohet klasifikimi i rezultateve q\u00eb u mor\u00ebn n\u00eb fazat e m\u00ebparshme, nd\u00ebrlidhur me ngjarje t\u00eb caktuara t\u00eb d\u00ebmshme. Klasifikimi i ngjarjeve b\u00ebhet n\u00eb baz\u00eb t\u00eb vler\u00ebs q\u00eb i jan\u00eb caktuar nga klasifikator\u00ebt e m\u00ebsimit t\u00eb makineris\u00eb me q\u00ebllim t\u00eb sigurohet nj\u00eb tregues konstant i sakt\u00ebsis\u00eb mbi 90%. K\u00ebtu p\u00ebrfshihen:<\/p>\n

<\/p>\n