{"id":78318,"date":"2020-04-18T13:42:43","date_gmt":"2020-04-18T11:42:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/analiz-zashifrovannogo-trafika-bez-ego-rasshifrovki"},"modified":"2020-04-18T13:42:43","modified_gmt":"2020-04-18T11:42:43","slug":"analiz-zashifrovannogo-trafika-bez-ego-rasshifrovki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/analiz-zashifrovannogo-trafika-bez-ego-rasshifrovki","title":{"rendered":"Analiza e trafikut t\u00eb enkriptuar pa shkrimin e tij","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Sistemi p\u00ebr analizimin e trafikut pa e dekriptuar at\u00eb. Ky metod quhet thjesht - \"m\u00ebsimi i makinerive\". Ka rezultuar se n\u00ebse n\u00eb hyrje t\u00eb nj\u00eb klasifikuesi t\u00eb ve\u00e7ant\u00eb i jepet nj\u00eb volum shum\u00eb t\u00eb madh trafiku t\u00eb ndrysh\u00ebm, sistemi me nj\u00eb probabilitet shum\u00eb t\u00eb lart\u00eb mund t\u00eb zbuloj\u00eb veprimet e kodit t\u00eb d\u00ebmsh\u00ebm brenda trafikut t\u00eb enkriptuar.<\/p>\n

<\/p>\n

\"Analiza<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00ebrc\u00ebnimet rrjet\u00ebsore kan\u00eb ndryshuar dhe jan\u00eb b\u00ebr\u00eb \"m\u00eb t\u00eb men\u00e7ura\". koh\u00ebt e fundit \u00ebsht\u00eb ndryshuar vet\u00eb koncepti i sulmit dhe mbrojtjes. Numri i ngjarjeve n\u00eb rrjet \u00ebsht\u00eb rritur shum\u00eb her\u00eb. Sulmet jan\u00eb b\u00ebr\u00eb m\u00eb t\u00eb sofistikuara, dhe hakerat kan\u00eb nj\u00eb mbulim m\u00eb t\u00eb gjer\u00eb t\u00eb sulmeve.<\/p>\n

<\/p>\n

Sipas statistikave nga Cisco, keqb\u00ebr\u00ebsit gjat\u00eb vitit t\u00eb fundit kan\u00eb trefishuar numrin e programeve t\u00eb d\u00ebmshme q\u00eb p\u00ebrdorin p\u00ebr aktivitete t\u00eb tyre, n\u00eb fakt p\u00ebr t\u00eb fshehur ato - enkriptimin. Sipas teoris\u00eb, algoritmi \"i duhur\" i enkriptimit nuk mund t\u00eb krijohet. P\u00ebr t\u00eb kuptuar se \u00e7far\u00eb fshihet brenda trafikut t\u00eb enkriptuar, \u00ebsht\u00eb e nevojshme ose ta dekriptojm\u00eb duke e ditur \u00e7el\u00ebsin, ose t\u00eb p\u00ebrpiqemi ta dekriptojm\u00eb at\u00eb me truqe t\u00eb ndryshme, ose duke sulmuar hapur, ose duke p\u00ebrdorur ndonj\u00eb \u00e7regullim n\u00eb protokollet kriptografike.<\/p>\n

<\/p>\n

\"Analiza
\nPamja e k\u00ebrc\u00ebnimeve rrjet\u00ebsore t\u00eb koh\u00ebs son\u00eb<\/em><\/p>\n

<\/p>\n

M\u00ebsimi i makineris\u00eb<\/h3>\n

<\/p>\n

Njihni teknologjin\u00eb nga af\u00ebr! Para se t\u00eb flasim se si funksionon vet\u00eb teknologjia e dekriptimit t\u00eb bazuar n\u00eb m\u00ebsimin e makinerive, \u00ebsht\u00eb e nevojshme t\u00eb shqyrtojm\u00eb se si funksionon teknologjia e rrjeteve nervore.<\/p>\n

<\/p>\n

M\u00ebsimi i makinerive (Machine Learning) \u00ebsht\u00eb nj\u00eb n\u00ebnkategori e gjer\u00eb e inteligjenc\u00ebs artificiale q\u00eb studion metodat p\u00ebr nd\u00ebrtimin e algoritmeve q\u00eb mund t\u00eb m\u00ebsojn\u00eb. Kjo shkenc\u00eb synon t\u00eb krijoj\u00eb modele matematike t\u00eb \"m\u00ebsimit\" t\u00eb kompjuterave. Q\u00ebllimi i m\u00ebsimit \u00ebsht\u00eb parashikimi i di\u00e7kaje. Ne q\u00eb e kuptojm\u00eb k\u00ebt\u00eb proces e quajm\u00eb me fjal\u00ebn \"men\u00e7uri\"<\/em>. Men\u00e7uria shfaqet te njer\u00ebzit q\u00eb kan\u00eb jetuar mjaft gjat\u00eb (nj\u00eb f\u00ebmij\u00eb 2-vje\u00e7ar nuk mund t\u00eb jet\u00eb i men\u00e7ur). Kur k\u00ebrkojm\u00eb k\u00ebshilla nga t\u00eb moshuarit, ne u japim atyre ndonj\u00eb informacion n\u00eb lidhje me nj\u00eb ngjarje (hyrjet) dhe k\u00ebrkojm\u00eb ndihm\u00eb. Ata, nga ana e tyre, kujtojn\u00eb t\u00eb gjitha situatat nga jeta q\u00eb lidhen ndonj\u00ebfar\u00eb m\u00ebnyre me problemin tuaj (baza e njohurive) dhe, duke u bazuar n\u00eb k\u00ebto njohuri (t\u00eb dh\u00ebna), na japin nj\u00eb lloj parashikimi (k\u00ebshill\u00eb). Ky lloj k\u00ebshille u quajt parashikim sepse personi q\u00eb jep k\u00ebshill\u00ebn nuk e di p\u00ebr siguri se \u00e7far\u00eb do t\u00eb ndodh\u00eb, por vet\u00ebm supozon. Eksperienca e jet\u00ebs tregon se nj\u00eb njeri mund t\u00eb jet\u00eb i sakt\u00eb, por gjithashtu mund t\u00eb gaboj\u00eb.<\/p>\n

<\/p>\n

Nuk ka kuptim t\u00eb krahasosh rrjetet nervore me algoritmin e deg\u00ebtimit (if-else). K\u00ebto jan\u00eb gj\u00ebra t\u00eb ndryshme dhe ato kan\u00eb dallime ky\u00e7e. Do ta demonstroj me shembuj.<\/p>\n

<\/p>\n

Detyra. P\u00ebrcaktoni distanc\u00ebn e frenimit t\u00eb nj\u00eb automobili sipas mark\u00ebs dhe vitit t\u00eb prodhimit.<\/p>\n

<\/p>\n

Shembulli i funksionimit t\u00eb algoritmit t\u00eb deg\u00ebtimit. N\u00ebse automobili \u00ebsht\u00eb nga marka 1 dhe prodhuar n\u00eb vitin 2012 - distanca e frenimit \u00ebsht\u00eb 10 metra, p\u00ebrndryshe, n\u00ebse automobili \u00ebsht\u00eb nga marka 2 dhe prodhuar n\u00eb vitin 2011 dhe k\u00ebshtu me radh\u00eb.<\/p>\n

<\/p>\n

Shembulli i funksionimit t\u00eb nj\u00eb rrjeti nervor. Mbledhim t\u00eb dh\u00ebna mbi distancat e frenimit t\u00eb automjeteve n\u00eb 20 vitet e fundit. Sipas mark\u00ebs dhe vitit p\u00ebrb\u00ebjm\u00eb nj\u00eb tabel\u00eb t\u00eb formatit \"mark\u00eb-viti i prodhimit-distanca e frenimit\". I japim k\u00ebsaj tabele rrjetit nervor dhe fillojm\u00eb ta m\u00ebsojm\u00eb. M\u00ebsimi zhvillohet si m\u00eb posht\u00eb: ne i japim t\u00eb dh\u00ebnat rrjetit nervor, por pa distanc\u00ebn e frenimit. Rrjeti nervor p\u00ebrpiqet t\u00eb parashikoj\u00eb se cila do t\u00eb jet\u00eb distanca e frenimit, bazuar n\u00eb tabel\u00ebn e ngarkuar n\u00eb t\u00eb. Ai parashikon di\u00e7ka dhe i b\u00ebn pyetje p\u00ebrdoruesit \"A kam t\u00eb drejt\u00eb?\". Para pyetjes, ai krijon nj\u00eb kolon\u00eb t\u00eb kat\u00ebrt - kolon\u00ebn e guessing. N\u00ebse \u00ebsht\u00eb i sakt\u00eb - ai shkruan 1 n\u00eb kolon\u00ebn e kat\u00ebrt, n\u00ebse gabon - 0. Rrjeti nervor kalon n\u00eb ngjarjen tjet\u00ebr (edhe n\u00ebse gabon). K\u00ebshtu rrjeti m\u00ebson dhe kur p\u00ebrfundon m\u00ebsimi (kriteri i konvergjenc\u00ebs \u00ebsht\u00eb arritur), ne i japim t\u00eb dh\u00ebnat p\u00ebr automjetin q\u00eb na intereson dhe p\u00ebrfitojm\u00eb p\u00ebrgjigjen.<\/p>\n

<\/p>\n

P\u00ebr t\u00eb sqaruar pyetjen n\u00eb lidhje me kriterin e konvergjenc\u00ebs, le t\u00eb shpjegohem se kjo \u00ebsht\u00eb nj\u00eb formul\u00eb e nxjerr\u00eb matematikisht p\u00ebr statistik\u00eb. Nj\u00eb shembull i duksh\u00ebm me 2 formula t\u00eb ndryshme konvergjence. E kuqja - konvergjenca binare, e blu - konvergjenca normale.<\/p>\n

<\/p>\n

\"Analiza
\nDistribucione binomiale dhe normale t\u00eb probabilitetit<\/em><\/p>\n

<\/p>\n

P\u00ebr ta b\u00ebr\u00eb m\u00eb t\u00eb qart\u00eb, b\u00ebni pyetjen \"Cila \u00ebsht\u00eb probabiliteti i takimit t\u00eb nj\u00eb dinosaurusi?\". K\u00ebtu ka 2 mund\u00ebsi p\u00ebrgjigjeje. Mund\u00ebsia 1 - shum\u00eb e vog\u00ebl (grafiku blu). Mund\u00ebsia 2 - ose takohem, ose jo (grafiku i kuq).<\/p>\n

<\/p>\n

Sigurisht, kompjuteri nuk \u00ebsht\u00eb njeri dhe ai m\u00ebson ndryshe. Identifikohen 2 lloje t\u00eb m\u00ebsimit t\u00eb \"kalit metalik\" - m\u00ebsimi nga precedentet<\/strong> dhe m\u00ebsimi deduktiv<\/strong>.<\/p>\n

<\/p>\n

M\u00ebsimi nga precedentet \u00ebsht\u00eb nj\u00eb m\u00ebnyr\u00eb m\u00ebsimi sipas ligjeve matematike. Matematikan\u00eb mbledhin tabela statistikash, b\u00ebjn\u00eb p\u00ebrfundime dhe ngarkojn\u00eb n\u00eb rrjetin nervor rezultatin - formul\u00ebn p\u00ebr llogaritjes.<\/p>\n

<\/p>\n

M\u00ebsimi deduktiv - m\u00ebsimi ndodh plot\u00ebsisht brenda rrjetit neuronal (nga grumbullimi i t\u00eb dh\u00ebnave deri te analiza e tyre). K\u00ebtu formohet nj\u00eb tabel\u00eb pa formul\u00eb, por me statistika.<\/p>\n

<\/p>\n

Nj\u00eb p\u00ebrmbledhje e gjer\u00eb t\u00eb teknologjis\u00eb do t\u00eb k\u00ebrkonte edhe disa dhjet\u00ebra artikuj. Deri tani, ky informacion \u00ebsht\u00eb i mjaftuesh\u00ebm p\u00ebr nj\u00eb kuptim t\u00eb p\u00ebrgjithsh\u00ebm.<\/p>\n

<\/p>\n

Neuroplasticiteti<\/h3>\n

<\/p>\n

N\u00eb biologji, ekziston nj\u00eb koncept i till\u00eb - neuroplasticiteti. Neuroplasticiteti \u00ebsht\u00eb aft\u00ebsia e neuroneve (qelizave t\u00eb trurit) p\u00ebr t\u00eb vepruar \"sipash situat\u00ebs\". P\u00ebr shembull, nj\u00eb person q\u00eb ka humbur shikimin d\u00ebgjon m\u00eb mir\u00eb tingujt, ndjen er\u00ebra dhe percepton objekte. Kjo ndodh sepse nj\u00eb pjes\u00eb e trurit (nj\u00eb pjes\u00eb e neuroneve) q\u00eb p\u00ebrgjigjet p\u00ebr shikimin, ribashkon funksionet e saj n\u00eb disa aktivitete t\u00eb tjera.<\/p>\n

<\/p>\n

Nj\u00eb shembull i qart\u00eb i neuroplasticitetit n\u00eb jet\u00eb - karamele BrainPort.<\/p>\n

<\/p>\n

N\u00eb vitin 2009, universiteti i Wisconsin n\u00eb Madison njoftoi lansimin e nj\u00eb pajisjeje t\u00eb re q\u00eb zhvillon idet\u00eb e \"ekranit gjuh\u00ebsor\", e cila mori emrin BrainPort. BrainPort punon sipas nj\u00eb algoritmi t\u00eb till\u00eb: sinjali video vjen nga kamera n\u00eb procesor, i cili menaxhon af\u00ebrsin\u00eb, ndri\u00e7imin dhe parametrat e tjer\u00eb t\u00eb imazhit. Ai gjithashtu kthen sinjalet dixhitale n\u00eb impulse elektrike, duke marr\u00eb faktikisht funksionet e retin\u00ebs.<\/p>\n

<\/p>\n

\"Analiza
\nKaramele BrainPort me syze dhe kamer\u00eb<\/em><\/p>\n

<\/p>\n

\"Analiza
\nBrainPort n\u00eb pun\u00eb<\/em><\/p>\n

\n

\r\n \"Luaj\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Edhe me kompjuterin \u00ebsht\u00eb e nj\u00ebjta gj\u00eb. N\u00ebse rrjeti neuronal ndjen nj\u00eb ndryshim n\u00eb proces, ai p\u00ebrshtatet me t\u00eb. Ky \u00ebsht\u00eb nj\u00eb nga avantazhet kryesore t\u00eb rrjeteve neurale krahasuar me algoritmet e tjera - autonomi. Nj\u00ebfar\u00eb m\u00ebnyre, njer\u00ebzill\u00ebku.<\/p>\n

<\/p>\n

Encrypted Traffic Analytics<\/h3>\n

<\/p>\n

Encrypted Traffic Analytics \u00ebsht\u00eb pjes\u00eb e sistemit Stealthwatch. Stealthwatch \u00ebsht\u00eb nj\u00eb zhvillim i kompanis\u00eb Cisco n\u00eb fush\u00ebn e zgjidhjeve p\u00ebr monitorimin dhe analitik\u00ebn e siguris\u00eb, e cila p\u00ebrdor t\u00eb dh\u00ebna telemetrie t\u00eb korporatave nga infrastrukturen ekzistuese t\u00eb rrjetit.<\/p>\n

<\/p>\n

Baza e Stealthwatch Enterprise p\u00ebrfshin mjete si Licenca e Shpejt\u00ebsis\u00eb s\u00eb Fluksit, Grumbulluesi i Fluksit, Konsola e Menaxhimit dhe Sensori i Fluksit.<\/p>\n

<\/p>\n

\"Analiza
\nInterfeisi Cisco Stealthwatch<\/em><\/p>\n

<\/p>\n

Problemi i kriptimit u b\u00eb mjaft i ndjesh\u00ebm p\u00ebr shkak t\u00eb rritjes s\u00eb madhe t\u00eb trafikut t\u00eb kriptuar. M\u00eb par\u00eb kriptohej vet\u00ebm kodi (n\u00eb shumic\u00eb), tani gjith\u00e7ka kriptohet dhe ndarja e t\u00eb dh\u00ebnave \"t\u00eb pastra\" nga viruset \u00ebsht\u00eb b\u00ebr\u00eb shum\u00eb m\u00eb e nd\u00ebrlikuar. Nj\u00eb shembull i qart\u00eb \u00ebsht\u00eb WannaCry, i cili p\u00ebrdori Tor p\u00ebr t\u00eb fshehur pranin\u00eb e tij n\u00eb rrjet.<\/p>\n

<\/p>\n

\"Analiza
\nVizualizimi i rritjes s\u00eb kriptimit t\u00eb trafikut n\u00eb rrjet<\/em><\/p>\n

<\/p>\n

\"Analiza
\nKriptimi n\u00eb makroekonomi<\/em><\/p>\n

<\/p>\n

Sistemi Encrypted Traffic Analytics (ETA) \u00ebsht\u00eb i nevojsh\u00ebm p\u00ebr t\u00eb punuar me trafikun e kriptuar pa e dekodiare. Kriminel\u00ebt jan\u00eb t\u00eb zgjuar dhe p\u00ebrdorin algoritme kriptografike t\u00eb forta, dhe thyerja e tyre jo vet\u00ebm q\u00eb paraqet probleme, por gjithashtu p\u00ebrb\u00ebn kosto jasht\u00ebzakonisht t\u00eb larta p\u00ebr organizatat.<\/p>\n

<\/p>\n

Sistemi funksionon si m\u00eb posht\u00eb. Trafiku hyn n\u00eb nj\u00eb kompani. Ai kalon p\u00ebrmes TLS (siguria e nivelit t\u00eb transportit). Le t\u00eb themi se trafiku \u00ebsht\u00eb i kriptuar. Ne p\u00ebrpiqemi t\u00eb p\u00ebrgjigjemi n\u00eb disa pyetje n\u00eb lidhje me se \u00e7far\u00eb lidhjeje \u00ebsht\u00eb vendosur.<\/p>\n

<\/p>\n

\"Analiza
\nParimi i funksionimit t\u00eb sistemit Encrypted Traffic Analytics (ETA)<\/em><\/p>\n

<\/p>\n

P\u00ebr t\u00eb p\u00ebrgjigjur n\u00eb k\u00ebto pyetje, ne p\u00ebrdorim m\u00ebsimin makinerik n\u00eb k\u00ebt\u00eb sistem. Merren studimet e kompanis\u00eb Cisco dhe mbi ato studime krijohet nj\u00eb tabel\u00eb me 2 rezultate - trafiku keqdash\u00ebs dhe \"i mir\u00eb\". Sigurisht, ne nuk e dim\u00eb me siguri se cilat t\u00eb dh\u00ebna kan\u00eb hyr\u00eb n\u00eb sistem n\u00eb momentin e tanish\u00ebm, por mund t\u00eb gjurmojm\u00eb historin\u00eb e trafikut si brenda ashtu edhe jasht\u00eb kompanis\u00eb, duke p\u00ebrdorur t\u00eb dh\u00ebna nga arena globale. N\u00eb fund t\u00eb k\u00ebtij procesi, ne marrim nj\u00eb tabel\u00eb t\u00eb madhe me t\u00eb dh\u00ebna.<\/p>\n

<\/p>\n

Me rezultatet e studimit, zbulojm\u00eb karakteristika karakteristike - disa rregulla q\u00eb mund t\u00eb shkruhen n\u00eb form\u00eb matematikore. K\u00ebto rregulla do t\u00eb ndryshojn\u00eb shum\u00eb sipas kritereve t\u00eb ndryshme - madh\u00ebsis\u00eb s\u00eb skedave t\u00eb transferuara, tipit t\u00eb lidhjes, vendit nga vjen ky trafik, etj. Si rezultat i pun\u00ebs, nj\u00eb tabel\u00eb e madhe u shnd\u00ebrrua n\u00eb nj\u00eb grup formulash. Numri i tyre u ul, por kjo nuk ishte e mjaftueshme p\u00ebr nj\u00eb pun\u00eb t\u00eb rehatshme.<\/p>\n

<\/p>\n

M\u00eb pas, aplikohet teknologjia e m\u00ebsimit makinerik - konvergjenca e formulave dhe p\u00ebr pasoj\u00eb, p\u00ebrmes konvergjenc\u00ebs, ne fitojm\u00eb nj\u00eb trigger - nj\u00eb nd\u00ebrrues, ku n\u00eb dalje t\u00eb t\u00eb dh\u00ebnave marrim nj\u00eb nd\u00ebrrues (flamur) n\u00eb pozit\u00ebn e ngritur ose t\u00eb ulur.<\/p>\n

<\/p>\n

Faza p\u00ebrfundimtare - marrja e nj\u00eb grupi triggers q\u00eb mbulojn\u00eb 99% t\u00eb trafikut.<\/p>\n

<\/p>\n

\"Analiza
\nHapat e kontrollit t\u00eb trafikut n\u00eb ETA<\/em><\/p>\n

<\/p>\n

Si rezultat i pun\u00ebs, zgjidhet edhe nj\u00eb problem tjet\u00ebr - sulmi nga brenda. Nuk jan\u00eb m\u00eb t\u00eb nevojshme njer\u00ebz n\u00eb mes q\u00eb filtrojn\u00eb trafikun manualisht (n\u00eb k\u00ebt\u00eb moment un\u00eb po vet\u00eb-ngacmohem). S\u00ebpari, nuk \u00ebsht\u00eb m\u00eb e nevojshme t\u00eb shpenzohet shum\u00eb para p\u00ebr nj\u00eb administrator sistemesh t\u00eb kualifikuar (po vazhdoj t\u00eb vet\u00eb-ngacmohem). S\u00eb dyti, nuk ka rrezik p\u00ebr thyerje nga brenda (t\u00eb pakt\u00ebn, pjes\u00ebrisht).<\/p>\n

<\/p>\n

\"Analiza
\nKoncepcioni i kaluar Man-in-the-Middle<\/em><\/p>\n

<\/p>\n

Tani, le t\u00eb shohim se nga \u00e7far\u00eb bazohet sistemi.<\/p>\n

<\/p>\n

Sistemi funksionon n\u00eb 4 protokolle komunikimi: TCP\/IP \u2013 protokolli i transferimit t\u00eb t\u00eb dh\u00ebnave n\u00eb internet, DNS \u2013 serveri i emrave t\u00eb domaineve, TLS \u2013 protokolli p\u00ebr mbrojtjen e nivelit t\u00eb transportit, SPLT (SpaceWire Physical Layer Tester) \u2013 tester i nivelit fizik t\u00eb lidhjes.<\/p>\n

<\/p>\n

\"Analiza
\nProtokollat q\u00eb punojn\u00eb me ETA<\/em><\/p>\n

<\/p>\n

Krahasimi b\u00ebhet p\u00ebrmes p\u00ebrputhjes s\u00eb t\u00eb dh\u00ebnave. N\u00ebp\u00ebrmjet protokolleve TCP\/IP kontrollohet reputacioni i faqeve t\u00eb internetit (historia e vizitave, q\u00ebllimi i krijimit t\u00eb faqes dhe k\u00ebshtu me radh\u00eb), fal\u00eb protokollit DNS, ne mund t'i heqim adresat \"e k\u00ebqija\" t\u00eb faqeve t\u00eb internetit. Protokolli TLS punon me \"gjakut\" e faqeve t\u00eb internetit (fingerprint) dhe kontrollon faqet n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave t\u00eb grupit kompjuterik t\u00eb reagimit ndaj situatave t\u00eb emergjenc\u00ebs (cert). Etapa e fundit e verifikimit t\u00eb lidhjes \u00ebsht\u00eb kontrolli n\u00eb nivelin fizik. Detajet e funksionimit t\u00eb k\u00ebsaj etape nuk p\u00ebrcaktohen, por kuptimi p\u00ebrmbledh\u00ebs \u00ebsht\u00eb si n\u00eb vijim: kontrolli i sinusoid\u00ebve dhe cosinusoid\u00ebve t\u00eb kurbave t\u00eb transferimit t\u00eb t\u00eb dh\u00ebnave n\u00eb instalimet oscilografike, pra, fal\u00eb struktur\u00ebs s\u00eb k\u00ebrkes\u00ebs n\u00eb nivelin fizik, ne p\u00ebrcaktojm\u00eb q\u00ebllimin e lidhjes.<\/p>\n

<\/p>\n

Si rezultat i pun\u00ebs s\u00eb sistemit, ne mund t\u00eb nxjerrim t\u00eb dh\u00ebna nga trafik i enkriptuar. Fal\u00eb analiz\u00ebs s\u00eb paketave, ne mund t\u00eb lexojm\u00eb maksimumin e informacionit nga fushat e pa enkriptuara brenda paket\u00ebs. Me inspektimin e paket\u00ebs n\u00eb nivelin fizik, ne m\u00ebsojm\u00eb karakteristikat e paket\u00ebs (pjes\u00ebrisht ose plot\u00ebsisht). Po ashtu, nuk duhet t\u00eb harrojm\u00eb reputacionin e faqeve t\u00eb internetit. N\u00ebse k\u00ebrkesa vjen nga ndonj\u00eb burim .onion, nuk duhet t'i besohet. P\u00ebr leht\u00ebsin\u00eb e pun\u00ebs me k\u00ebt\u00eb lloj t\u00eb dh\u00ebnash, \u00ebsht\u00eb krijuar nj\u00eb hart\u00eb e rreziqeve.<\/p>\n

<\/p>\n

\"Analiza
\nRezultati i pun\u00ebs s\u00eb ETA<\/em><\/p>\n

<\/p>\n

Dhe gjith\u00e7ka duket se \u00ebsht\u00eb mir\u00eb, por le t\u00eb flasim p\u00ebr shp\u00ebrndarjen e rrjetit.<\/p>\n

<\/p>\n

Realizimi fizik i ETA<\/h3>\n

<\/p>\n

K\u00ebtu lindin disa nuanca dhe holl\u00ebsi. S\u00eb pari, kur krijohet nj\u00eb rrjet i till\u00eb me nj\u00eb softuer t\u00eb nivelit t\u00eb lart\u00eb, k\u00ebrkohet mbledhja e t\u00eb dh\u00ebnave. T\u00eb mbledh\u00ebsh t\u00eb dh\u00ebnat manualisht \u00ebsht\u00eb krejt\u00ebsisht
\nn\u00eb m\u00ebnyr\u00eb t\u00eb dhunshme, dhe realizimi i nj\u00eb sistemi reagimi \u00ebsht\u00eb m\u00eb interesante. S\u00eb dyti, duhet t\u00eb ket\u00eb shum\u00eb t\u00eb dh\u00ebna, q\u00eb do t\u00eb thot\u00eb se sensor\u00ebt e instaluar t\u00eb rrjetit duhet t\u00eb punojn\u00eb
\njo vet\u00ebm n\u00eb m\u00ebnyr\u00eb autonome, por edhe n\u00eb nj\u00eb m\u00ebnyr\u00eb t\u00eb ndjeshme, e cila sjell nj\u00eb s\u00ebr\u00eb v\u00ebshtir\u00ebsish.
\nSensor\u00ebt dhe sistemi Stealthwatch
\nT\u00eb instalohet nj\u00eb sensor \u2013 \u00ebsht\u00eb nj\u00eb gj\u00eb, por ta konfiguroni at\u00eb \u2013 \u00ebsht\u00eb nj\u00eb detyr\u00eb krejt\u00ebsisht tjet\u00ebr. P\u00ebr konfigurimin e sensor\u00ebve, ekziston nj\u00eb kompleks q\u00eb punon sipas topologjis\u00eb s\u00eb m\u00ebposhtme \u2013 ISR = router me integrim sh\u00ebrbimesh Cisco (Cisco Integrated Services Router); ASR = router me agregim sh\u00ebrbimesh Cisco (Cisco Aggregation Services Router); CSR = router t\u00eb sh\u00ebrbimeve n\u00eb re Cisco (Cisco Cloud Services Router); WLC = kontrollor i rrjeteve lokale wireless Cisco (Cisco Wireless LAN Controller); IE = nd\u00ebrprer\u00ebs industrial Ethernet Cisco (Cisco Industrial Ethernet); ASA = pajisje mbrojt\u00ebse adaptuese Cisco (Cisco Adaptive Security Appliance); FTD = zgjidhje p\u00ebr mbrojtjen nga k\u00ebrc\u00ebnimet Cisco Firepower Threat Defense; WSA = pajisje e mbrojtjes s\u00eb trafikut n\u00eb internet (Web Security Appliance); ISE = modul sh\u00ebrbimesh identifikimi (Identity Services Engine)<\/p>\n

<\/p>\n

\"Analiza
\nMonitorimi kompleks duke marr\u00eb parasysh \u00e7do t\u00eb dh\u00ebn\u00eb telemetrike<\/em><\/p>\n

<\/p>\n

Administratoret e rrjetit fillojn\u00eb t\u00eb p\u00ebrjetojn\u00eb aritmi nga numri i fjal\u00ebve \"Cisco\" n\u00eb paragrafin e m\u00ebparsh\u00ebm. \u00c7mimi i k\u00ebtij mrekullie nuk \u00ebsht\u00eb i vog\u00ebl, por jo p\u00ebr k\u00ebt\u00eb sot...<\/p>\n

<\/p>\n

\"Analiza
\nMonitorimi kompleks me marrjen parasysh \u00e7do t\u00eb dh\u00ebn\u00eb telemetrik<\/em><\/p>\n

<\/p>\n

Tek administrator\u00ebt e rrjetit fillon aritmia nga numri i fjal\u00ebve 'Cisco' n\u00eb paragrafin e m\u00ebparsh\u00ebm. \u00c7mimi i k\u00ebtij mrekullie nuk \u00ebsht\u00eb i vog\u00ebl, por jo p\u00ebr k\u00ebt\u00eb sot...<\/p>\n

<\/p>\n

Modelimi i sjelljes s\u00eb haker\u00ebve do t\u00eb ndodh\u00eb n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb. Stealthwatch ndjek me kujdes aktivitetin e \u00e7do pajisjeje n\u00eb rrjet dhe \u00ebsht\u00eb n\u00eb gjendje t\u00eb krijoj\u00eb nj\u00eb model t\u00eb sjelljes normale. P\u00ebr m\u00eb tep\u00ebr, kjo zgjidhje ofron nj\u00eb kuptim t\u00eb thell\u00eb t\u00eb sjelljes s\u00eb njohur t\u00eb pahijshme. Brenda k\u00ebsaj zgjidhjeje p\u00ebrdoren rreth 100 algoritme analiza ose rregulla heuristike, t\u00eb cilat lidhen me lloje t\u00eb ndryshme sjellje t\u00eb trafikut, si skanimi, transmetimi i sinjalizimeve alarmuese nga nj\u00eb nyje, hyrja n\u00eb sistem p\u00ebrmes gjetjes s\u00eb fjal\u00ebkalimit, dyshimi i kapjes s\u00eb t\u00eb dh\u00ebnave, dyshimi i rrjedhjes s\u00eb t\u00eb dh\u00ebnave etj. Ngjarjet e lartp\u00ebrmendura t\u00eb siguris\u00eb bien n\u00ebn kategorin\u00eb e alarmit t\u00eb lart\u00eb logjik. Disa ngjarje t\u00eb siguris\u00eb gjithashtu mund t\u00eb shkaktojn\u00eb ngritjen e alarmit vet\u00eb. K\u00ebshtu, sistemi \u00ebsht\u00eb n\u00eb gjendje t\u00eb korrelacionoj\u00eb shum\u00eb incidente anomali t\u00eb izoluara dhe t'i bashkoj\u00eb ato p\u00ebr t\u00eb p\u00ebrcaktuar llojin e mundsh\u00ebm t\u00eb sulmit, si dhe p\u00ebr ta lidhur at\u00eb me nj\u00eb pajisje dhe p\u00ebrdorues t\u00eb caktuar (shkema 2). N\u00eb vazhdim, incidenti mund t\u00eb studiohet n\u00eb dinamik\u00eb dhe duke marr\u00eb parasysh t\u00eb dh\u00ebnat e lidhura t\u00eb telemetris\u00eb. Kjo p\u00ebrb\u00ebn informacion kontekstual n\u00eb manifestimin e tij m\u00eb t\u00eb mir\u00eb. Mjek\u00ebt q\u00eb kontrollojn\u00eb pacientin p\u00ebr t\u00eb kuptuar \u00e7far\u00eb ka ndodhur, nuk shqyrtojn\u00eb simptomat n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb. Ata studiojn\u00eb pamjen e p\u00ebrgjithshme p\u00ebr t\u00eb dh\u00ebn\u00eb nj\u00eb diagnoz\u00eb. Po ashtu, Stealthwatch regjistron \u00e7do aktivitet anomalik n\u00eb rrjet dhe e shqyrton at\u00eb n\u00eb kompleks, p\u00ebr t\u00eb d\u00ebrguar sinjale alarmi me konsiderat\u00eb p\u00ebr kontekstin, duke ndihmuar k\u00ebshtu specialist\u00ebt e siguris\u00eb t\u00eb vendosin prioritete p\u00ebr rreziqet.<\/p>\n

<\/p>\n

\"Analiza
\nZbulimi i anomali me ndihm\u00ebn e modelimit t\u00eb sjelljes<\/em><\/p>\n

<\/p>\n

Zhvillimi fizik i rrjetit duket k\u00ebshtu:<\/p>\n

<\/p>\n

\"Analiza
\nVariantet e zhvillimit t\u00eb rrjetit t\u00eb deg\u00ebve (t\u00eb thjeshtuar)<\/em><\/p>\n

<\/p>\n

\"Analiza
\nVariantet e zhvillimit t\u00eb rrjetit t\u00eb deg\u00ebve<\/em><\/p>\n

<\/p>\n

Rrjeti \u00ebsht\u00eb i zhvilluar, por mbetet nj\u00eb pyetje e hapur p\u00ebr neuronin. Organizuan nj\u00eb rrjet t\u00eb transferimit t\u00eb t\u00eb dh\u00ebnave, vendos\u00ebn sensor\u00ebt n\u00eb pragje dhe lan\u00eb t\u00eb funksionoj\u00eb sistemin e mbledhjes s\u00eb informacionit, por neuroni nuk ka marr\u00eb pjes\u00eb deri tani.<\/p>\n

<\/p>\n

Rrjeti neuronal me shum\u00eb nivele<\/h3>\n

<\/p>\n

Sistemi analizon sjelljen e p\u00ebrdoruesit dhe pajisjes p\u00ebr t\u00eb zbuluar infektimet malinj, komunikimet me server\u00ebt komandues, rrjedhjen e t\u00eb dh\u00ebnave, si dhe aplikacione potencialisht t\u00eb pad\u00ebshirueshme q\u00eb funksionojn\u00eb n\u00eb infrastruktur\u00ebn e organizat\u00ebs. Ekzistojn\u00eb disa nivele t\u00eb p\u00ebrpunimit t\u00eb t\u00eb dh\u00ebnave, n\u00eb t\u00eb cilat kombinimi i metodave t\u00eb inteligjenc\u00ebs artificiale, m\u00ebsimit t\u00eb makinerive dhe statistik\u00ebs matematikore ndihmon rrjetin t\u00eb m\u00ebsoj\u00eb vet\u00eb aktivitetin e tij normal, n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb mund t\u00eb identifikoj\u00eb aktivitetin malinj.<\/p>\n

<\/p>\n

Pipa e analiz\u00ebs s\u00eb siguris\u00eb n\u00eb rrjet, e cila mbledh t\u00eb dh\u00ebnat e telemetris\u00eb nga t\u00eb gjitha pjes\u00ebt e zgjeruara t\u00eb rrjetit, duke p\u00ebrfshir\u00eb trafikun e enkriptuar, \u00ebsht\u00eb nj\u00eb karakteristik\u00eb unike e Stealthwatch. Ajo formon gradualisht kuptimin e asaj q\u00eb \u00ebsht\u00eb 'anomale', pastaj klasifikon elementet e ve\u00e7anta t\u00eb 'aktivitetit k\u00ebrc\u00ebnues' dhe, n\u00eb fund, merr nj\u00eb vendim p\u00ebrfundimtar n\u00ebse pajisja ose p\u00ebrdoruesi ishin me t\u00eb v\u00ebrtet\u00eb t\u00eb komprometuar. Aft\u00ebsia p\u00ebr t\u00eb mbledhur s\u00eb bashku pjes\u00eb t\u00eb vogla, t\u00eb cilat s\u00eb bashku formojn\u00eb provat p\u00ebr marrjen e nj\u00eb vendimi p\u00ebrfundimtar mbi komprometimin e objektit, sigurohet p\u00ebrmes nj\u00eb analize dhe korrelacioni t\u00eb kujdessh\u00ebm.<\/p>\n

<\/p>\n

Kjo aft\u00ebsi ka shum\u00eb r\u00ebnd\u00ebsi, pasi nj\u00eb nd\u00ebrmarrje standarde mund t\u00eb marr\u00eb \u00e7do dit\u00eb nj\u00eb sasi t\u00eb madhe alarmeve dhe t\u00eb hetoj\u00eb secil\u00ebn prej tyre \u00ebsht\u00eb e pamundur \u2014 resurset e specialist\u00ebve t\u00eb siguris\u00eb jan\u00eb t\u00eb kufizuara. Moduli i m\u00ebsimit t\u00eb makinerive p\u00ebrpunon nj\u00eb sasi t\u00eb madhe informacioni pothuajse n\u00eb koh\u00eb reale p\u00ebr t\u00eb zbuluar incidente kritike me nj\u00eb nivel t\u00eb lart\u00eb besueshm\u00ebrie, si dhe \u00ebsht\u00eb n\u00eb gjendje t\u00eb propozoj\u00eb nj\u00eb rend t\u00eb qart\u00eb veprimi p\u00ebr diagnoz\u00ebn e shpejt\u00eb.<\/p>\n

<\/p>\n

Le t\u00eb shqyrtojm\u00eb m\u00eb holl\u00ebsisht shum\u00eb metodat e m\u00ebsimit t\u00eb makinerive q\u00eb p\u00ebrdoren nga Stealthwatch. Kur nj\u00eb incident i kalon modulit t\u00eb m\u00ebsimit t\u00eb makinerive t\u00eb Stealthwatch, ai kalon p\u00ebrmes nj\u00eb filtri t\u00eb analiz\u00ebs s\u00eb siguris\u00eb, n\u00eb t\u00eb cilin p\u00ebrdoret nj\u00eb kombinim metodash t\u00eb m\u00ebsimit t\u00eb makinerive q\u00eb m\u00ebsimi \u00ebsht\u00eb i mbik\u00ebqyrur dhe i pandihmuar.<\/p>\n

<\/p>\n

\"Analiza
\nAft\u00ebsit\u00eb e m\u00ebsimit t\u00eb makinerive me shum\u00eb nivele<\/em><\/p>\n

<\/p>\n

Niveli 1. Zbulimi i anomalis\u00eb dhe modelimi i besimit<\/h3>\n

<\/p>\n

N\u00eb k\u00ebt\u00eb nivel, 99% e trafikut p\u00ebrjashtohet p\u00ebrmes detektor\u00ebve statistik\u00eb t\u00eb anomalis\u00eb. K\u00ebta detektor\u00eb formojn\u00eb s\u00eb bashku modele komplekse t\u00eb asaj q\u00eb \u00ebsht\u00eb normale dhe asaj q\u00eb, p\u00ebrkundrazi, \u00ebsht\u00eb anormale. Megjithat\u00eb, anormalja nuk \u00ebsht\u00eb domosdoshm\u00ebrisht e d\u00ebmshme. Shum\u00eb nga ngjarjet q\u00eb ndodhin n\u00eb rrjetin tuaj nuk kan\u00eb lidhje me k\u00ebrc\u00ebnimin \u2014 ato jan\u00eb thjesht t\u00eb \u00e7uditshme. Megjithat\u00eb, \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb klasifikohen k\u00ebto procese pa marr\u00eb parasysh sjelljen k\u00ebrc\u00ebnuese. P\u00ebr k\u00ebt\u00eb arsye, rezultatet e pun\u00ebs s\u00eb k\u00ebtyre detektor\u00ebve kalojn\u00eb nj\u00eb analiz\u00eb t\u00eb m\u00ebtejshme p\u00ebr t\u00eb regjistruar sjelljen e \u00e7uditshme, e cila mund t\u00eb shpjegohet dhe besohet. N\u00eb fund, vet\u00ebm nj\u00eb pjes\u00eb e vog\u00ebl e fluksit dhe k\u00ebrkesave m\u00eb t\u00eb r\u00ebnd\u00ebsishme kalon n\u00eb nivelet 2 dhe 3. Pa p\u00ebrdorimin e metodave t\u00eb tilla t\u00eb m\u00ebsimit t\u00eb makinerive, shpenzimet operative p\u00ebr ndarjen e sinjalit nga zhurma do t\u00eb ishin tep\u00ebr t\u00eb m\u00ebdha.<\/p>\n

<\/p>\n

Zbulimi i anomalis\u00eb.<\/strong> N\u00eb faz\u00ebn e par\u00eb, p\u00ebr zbulimin e anomalis\u00eb p\u00ebrdoren metoda statistikore t\u00eb m\u00ebsimit t\u00eb makinave p\u00ebr t\u00eb ndar\u00eb trafikun statistikisht normal nga ai anormal. M\u00eb shum\u00eb se 70 detektor\u00eb t\u00eb ve\u00e7ant\u00eb procesoryn t\u00eb dh\u00ebnat e telemetris\u00eb, t\u00eb mbledhura nga Stealthwatch p\u00ebr trafikun q\u00eb kalon p\u00ebrmes perimetrin t\u00eb rrjetit tuaj, duke ndar\u00eb trafikun e brendsh\u00ebm t\u00eb sistemit t\u00eb emrave t\u00eb domainit (DNS) dhe t\u00eb dh\u00ebnat e serverit proxy n\u00eb rast se ka. \u00c7do k\u00ebrkes\u00eb p\u00ebrpunoset nga m\u00eb shum\u00eb se 70 detektor\u00eb, dhe \u00e7do detektor p\u00ebrdor algoritmin e vet statistikor p\u00ebr t\u00eb formuar nj\u00eb vler\u00ebsim t\u00eb anomalis\u00eb s\u00eb zbuluar. K\u00ebto vler\u00ebsime bashkohen dhe si rezultat i aplikimit t\u00eb disa metodave statistikore, krijohet nj\u00eb vler\u00ebsim i vet\u00ebm p\u00ebr \u00e7do k\u00ebrkes\u00eb t\u00eb ve\u00e7ant\u00eb. Pastaj ky vler\u00ebsim i p\u00ebrbashk\u00ebt p\u00ebrdoret p\u00ebr t\u00eb ndar\u00eb trafikun normal nga ai anormal.<\/p>\n

<\/p>\n

Modelimi i besueshm\u00ebris\u00eb.<\/strong> M\u00eb von\u00eb, k\u00ebrkesat e ngjashme grupohen dhe vler\u00ebsimi i anomalis\u00eb p\u00ebr k\u00ebto grupe p\u00ebrcaktohet si nj\u00eb mesatare afatgjat\u00eb. Me kalimin e koh\u00ebs, nj\u00eb num\u00ebr m\u00eb i madh k\u00ebrkesash i n\u00ebnshtrohen analiz\u00ebs dhe m\u00eb pas p\u00ebrcaktimit t\u00eb mesatares afatgjat\u00eb, duke lejuar q\u00eb t\u00eb pak\u00ebsohen false pozitive dhe false negative. Rezultatet e modelimit t\u00eb besueshm\u00ebris\u00eb p\u00ebrdoren p\u00ebr t\u00eb zgjedhur nj\u00eb n\u00ebn-grup t\u00eb trafikut, vler\u00ebsimi i anomalis\u00eb s\u00eb t\u00eb cilit kalon nj\u00eb prag t\u00eb p\u00ebrcaktuar dinamikisht, p\u00ebr ta transferuar at\u00eb n\u00eb nivelin e ardhsh\u00ebm t\u00eb p\u00ebrpunimit.<\/p>\n

<\/p>\n

Niveli 2. Klasifikimi i ngjarjeve dhe modelimi i objektit<\/h3>\n

<\/p>\n

N\u00eb k\u00ebt\u00eb nivel ndodh klasifikimi i rezultateve t\u00eb marra n\u00eb fazat e m\u00ebparshme, duke i lidhur ato me ngjarje t\u00eb ve\u00e7anta t\u00eb d\u00ebmshme. Klasifikimi i ngjarjeve realizohet sipas vler\u00ebs s\u00eb caktuar nga klasifikator\u00ebt e m\u00ebsimit t\u00eb makinave p\u00ebr t\u00eb siguruar nj\u00eb nivel t\u00eb vazhduesh\u00ebm sakt\u00ebsie mbi 90%. N\u00eb mesin e tyre jan\u00eb:<\/p>\n

<\/p>\n