Esikhathini samanje sedijithali, ukuphepha kwenethiwekhi sekuyinkinga ebalulekile okufanele amabhizinisi nabantu ngabanye babhekane nayo. Ngokuthuthuka okuqhubekayo kokuhlaselwa kwenethiwekhi, izindlela zokuphepha zendabuko ziye azanele. Kulo mongo, i-Intrusion Detection System (IDS) kanye ne-intrusion Prevention system (IPS) kuvela njengoba i-Times idinga, futhi iba ngabanakekeli ababili abakhulu emkhakheni wezokuphepha kwenethiwekhi. Zingase zibonakale zifana, kodwa zihluke kakhulu ekusebenzeni nasekusetshenzisweni. Lesi sihloko singena shí kumehluko phakathi kwe-IDS ne-IPS, futhi yehlisa ukungaqondakali kwalaba bagadi ababili bokuphepha kwenethiwekhi.
I-IDS: I-Scout of Network Security
1. Imiqondo Eyisisekelo Yohlelo Lokuthola Ukungena Kwe-IDS (IDS)iyidivayisi yezokuphepha yenethiwekhi noma uhlelo lwesofthiwe olwakhelwe ukuqapha ithrafikhi yenethiwekhi nokuthola imisebenzi eyingozi engenzeka noma ukwephulwa komthetho. Ngokuhlaziya amaphakethe enethiwekhi, amafayela okungena ngemvume nolunye ulwazi, i-IDS ihlonza ithrafikhi engavamile futhi yazisa abalawuli ukuthi bathathe izinyathelo zokuphikisa ezihambisanayo. Cabanga nge-IDS njengenhloli eqaphile ebuka konke ukunyakaza kunethiwekhi. Uma kunokuziphatha okusolisayo kunethiwekhi, i-IDS izoba ngokokuqala ngqa ukuthola nokukhipha isexwayiso, kodwa ngeke yenze isenzo esisebenzayo. Umsebenzi wayo "ukuthola izinkinga," hhayi "ukuzixazulula."
2. Isebenza kanjani i-IDS Indlela i-IDS esebenza ngayo incike kakhulu kumasu alandelayo:
Ukutholwa Kwesiginesha:I-IDS inesizindalwazi esikhulu samasiginesha aqukethe amasiginesha okuhlasela okwaziwayo. I-IDS iphakamisa isexwayiso lapho ithrafikhi yenethiwekhi ifana nesiginesha kusizindalwazi. Lokhu kufana nokuthi amaphoyisa asebenzisa inqolobane yolwazi lweminwe ukuhlonza abasolwa, esebenza kahle kodwa encike olwazini olwaziwayo.
Ukutholwa Okungavamile:I-IDS ifunda amaphethini okuziphatha avamile enethiwekhi, futhi uma isithole ithrafikhi ephambukayo kuphethini evamile, ikuthatha njengokusongela okungaba khona. Isibonelo, uma ikhompuyutha yesisebenzi ngokuzumayo ithumela inani elikhulu ledatha ebusuku, i-IDS ingase imake ukuziphatha okuxakile. Lokhu kufana nonogada ongumakad' ebona ojwayelene nemisebenzi yansuku zonke yasendaweni futhi ozobe eqaphile uma sekutholakele okudidayo.
Ukuhlaziywa Kwephrothokholi:I-IDS izokwenza ukuhlaziya okujulile kwamaphrothokholi enethiwekhi ukuze kutholwe ukuthi kukhona ukwephulwa noma ukusetshenziswa kwephrothokholi okungavamile. Isibonelo, uma ifomethi yephrothokholi yephakethe elithile ingahambisani nezinga, i-IDS ingase iyibheke njengokuhlasela okungenzeka.
3. Izinzuzo kanye Nokubi
Izinzuzo ze-IDS:
Ukuqapha kwesikhathi sangempela:I-IDS ingaqapha ithrafikhi yenethiwekhi ngesikhathi sangempela ukuze ithole izinsongo zokuphepha kusenesikhathi. Njengomlindi ongalali, hlala uqapha ukuphepha kwenethiwekhi.
Ukuvumelana nezimo:I-IDS ingafakwa ezindaweni ezihlukene zenethiwekhi, njengemingcele, amanethiwekhi angaphakathi, njll., ihlinzeka ngamaleveli amaningi okuvikela. Kungakhathaliseki ukuthi ukuhlasela kwangaphandle noma usongo lwangaphakathi, i-IDS ingakwazi ukukubona.
Ukungena komcimbi:I-IDS ingarekhoda amalogi anemininingwane emisebenzi yenethiwekhi ukuze ihlaziywe ngemuva kokuhlolwa kwesidumbu kanye nama-forensics. Kufana nombhali othembekile ogcina irekhodi layo yonke imininingwane ekunethiwekhi.
Ububi be-IDS:
Izinga eliphezulu lezinto ezingamanga:Njengoba i-IDS incike kumasiginesha nasekutholeni okudidayo, kungenzeka ukuthi ungahluleli ngokungeyikho ithrafikhi evamile njengomsebenzi ononya, okuholela ekutholeni amanga. Njengonogada othathekile ongase enze iphutha lokuletha umuntu njengesela.
Ayikwazi ukuvikela ngokuqhubekayo:I-IDS ingathola kuphela futhi iphakamise izexwayiso, kodwa ayikwazi ukuvimba ithrafikhi enonya. Ukungenelela okwenziwa ngabalawuli nakho kuyadingeka uma inkinga isitholakele, okungaholela ezikhathini ezinde zokuphendula.
Ukusetshenziswa kwensiza:I-IDS idinga ukuhlaziya inani elikhulu lethrafikhi yenethiwekhi, engase ithathe izinsiza eziningi zesistimu, ikakhulukazi endaweni ephakeme yethrafikhi.
IPS: "I-Defender" Yokuphepha Kwenethiwekhi
1. Umqondo oyisisekelo we-IPS Intrusion Prevention System (IPS)iyidivayisi yezokuphepha yenethiwekhi noma uhlelo lokusebenza lwesofthiwe olwakhiwe ngokusekelwe ku-IDS. Ayikwazi ukubona kuphela imisebenzi enonya, kodwa futhi ivimbele ngesikhathi sangempela futhi ivikele inethiwekhi ekuhlaselweni. Uma i-IDS iyi-scout, i-IPS ingunogada onesibindi. Ayikwazi ukubona isitha kuphela, kodwa futhi ithatha isinyathelo sokumisa ukuhlasela kwesitha. Umgomo we-IPS "ukuthola izinkinga futhi uzilungise" ukuze uvikele ukuphepha kwenethiwekhi ngokungenelela kwesikhathi sangempela.
2. Isebenza kanjani i-IPS
Ngokusekelwe emsebenzini wokuthola we-IDS, i-IPS yengeza indlela yokuzivikela elandelayo:
Ukuvinjwa kwethrafikhi:Uma i-IPS ithola ithrafikhi enonya, ingavimba ngokushesha le thrafikhi ukuyivimbela ukuthi ingangeni kunethiwekhi. Isibonelo, uma iphakethe litholwa lizama ukuxhaphaza ubungozi obaziwayo, i-IPS izovele iliyeke.
Ukunqanyulwa kweseshini:I-IPS inganqamula isikhathi phakathi komsingathi ononya futhi inqamule uxhumo lomhlaseli. Isibonelo, uma i-IPS ithola ukuthi ukuhlasela kwe-bruteforce kwenziwa ekhelini le-IP, izovele inqamule ukuxhumana naleyo IP.
Ukuhlunga okuqukethwe:I-IPS ingakwazi ukuhlunga okuqukethwe kuthrafikhi yenethiwekhi ukuvimba ukudluliswa kwekhodi eyingozi noma idatha. Isibonelo, uma okunamathiselwe kwe-imeyili kutholakala ukuthi kuqukethe uhlelo olungayilungele ikhompyutha, i-IPS izovimba ukuthunyelwa kwaleyo imeyili.
I-IPS isebenza njengonogada, hhayi nje ukubona abantu abasolisayo, kodwa futhi ibaxosha. Iyashesha ukuphendula futhi ikwazi ukuqeda izinsongo ngaphambi kokuba zisabalale.
3. Izinzuzo kanye nokubi kwe-IPS
Izinzuzo ze-IPS:
Ukuzivikela okusebenzayo:I-IPS ingavimbela ithrafikhi enonya ngesikhathi sangempela futhi ivikele ngempumelelo ukuphepha kwenethiwekhi. Kufana nonogada oqeqeshwe kahle, okwazi ukuxosha izitha ngaphambi kokuba zisondele.
Impendulo ezenzakalelayo:I-IPS ingasebenzisa ngokuzenzakalelayo izinqubomgomo zokuvikela ezichazwe ngaphambilini, zehlise umthwalo kubaphathi. Isibonelo, uma ukuhlaselwa kwe-DDoS kutholwa, i-IPS ingakhawulela ngokuzenzakalela ithrafikhi ehlobene.
Ukuvikela okujulile:I-IPS ingasebenza ngama-firewall, isango lokuvikeleka namanye amadivaysi ukuze inikeze izinga elijulile lokuvikela. Ayivikeli kuphela umngcele wenethiwekhi, kodwa futhi ivikela izimpahla ezibucayi zangaphakathi.
I-IPS Ububi:
Ingozi yokuvimbela amanga:I-IPS ingase ivimbe ithrafikhi evamile ngephutha, ithinte ukusebenza okuvamile kwenethiwekhi. Isibonelo, uma ithrafikhi esemthethweni ichazwa ngokungeyikho njengenonya, ingabangela ukuphela kwesevisi.
Umthelela wokusebenza:I-IPS idinga ukuhlaziywa kwesikhathi sangempela kanye nokucutshungulwa kwethrafikhi yenethiwekhi, okungase kube nomthelela othile ekusebenzeni kwenethiwekhi. Ikakhulukazi endaweni ephakeme yethrafikhi, kungase kuholele ekubambezelekeni okwandisiwe.
Ukucushwa okuyinkimbinkimbi:Ukucushwa nokunakekelwa kwe-IPS kuyinkimbinkimbi futhi kudinga abasebenzi abangochwepheshe ukuze bakuphathe. Uma ingalungiselelwanga kahle, ingase ibangele umphumela wokuzivikela ongemuhle noma ibhebhethekise inkinga yokuvinjwa okungamanga.
Umehluko phakathi kwe-IDS ne-IPS
Nakuba i-IDS ne-IPS inomehluko owodwa kuphela wegama egameni, inomehluko obalulekile ekusebenzeni nasekusetshenzisweni kwayo. Nawu umehluko omkhulu phakathi kwe-IDS ne-IPS:
1. Ukuma kokusebenza
I-IDS: Isetshenziselwa kakhulu ukuqapha kanye nokuthola izinsongo zokuphepha kunethiwekhi, okuyingxenye yokuzivikela. Isebenza njengenhloli, ikhalisa inhlabamkhosi lapho ibona isitha, kodwa ingathathi isinyathelo sokuhlasela.
I-IPS: Umsebenzi wokuvikela osebenzayo wengezwa ku-IDS, engavimba ithrafikhi enonya ngesikhathi sangempela. Kufana nomlindi, akagcini nje ngokubona isitha, kodwa futhi angasivimba.
2. Indlela yokuphendula
I-IDS: Izaziso zikhishwa ngemva kokutholwa kosongo, okudinga ukungenelela okwenziwa umlawuli. Kufana nomlindi obona isitha bese ebika kubaphathi bakhe, elinde iziyalezo.
I-IPS: Amasu okuvikela enziwa ngokuzenzakalelayo ngemva kokutholwa kosongo ngaphandle kokungenelela komuntu. Kufana nonogada obona isitha asiphindisele emuva.
3. Izindawo zokuthunyelwa
I-IDS: Ivamise ukuthunyelwa endaweni edlulayo yenethiwekhi futhi ayithinti ngokuqondile ithrafikhi yenethiwekhi. Indima yayo iwukubuka nokurekhoda, futhi ngeke iphazamise ukuxhumana okuvamile.
I-IPS: Ivamise ukuthunyelwa endaweni ye-inthanethi yenethiwekhi, iphatha ithrafikhi yenethiwekhi ngokuqondile. Idinga ukuhlaziywa kwesikhathi sangempela kanye nokungenelela kwethrafikhi, ngakho isebenza kakhulu.
4. Ingozi ye-alamu yamanga/umvimba wamanga
I-IDS: Okuhle okungamanga akuthinti ngokuqondile ukusebenza kwenethiwekhi, kodwa kungabangela abalawuli ukuthi bathwale kanzima. Njengomthumeli ozwela ngokweqile, ungase ukhale ama-alamu njalo futhi wandise umsebenzi wakho.
I-IPS: Ukuvinjwa okungamanga kungase kubangele ukuphazamiseka kwesevisi evamile futhi kuthinte ukutholakala kwenethiwekhi. Kufana nonogada onolaka futhi angalimaza amasosha anobungane.
5. Sebenzisa amacala
I-IDS: Ifanele izimo ezidinga ukuhlaziywa okujulile nokwengamela imisebenzi yenethiwekhi, njengokuhlola ukuphepha, impendulo yesigameko, njll. Isibonelo, inkampani ingase isebenzise i-IDS ukuze iqaphe ukuziphatha kwabasebenzi ku-inthanethi futhi ithole ukuphulwa kwedatha.
I-IPS: Ifanele izimo ezidinga ukuvikela inethiwekhi ekuhlaselweni ngesikhathi sangempela, njengokuvikelwa komngcele, ukuvikelwa kwesevisi ebalulekile, njll. Isibonelo, inkampani ingase isebenzise i-IPS ukuvimbela abahlaseli bangaphandle ekugqekezeni inethiwekhi yayo.
Ukusetshenziswa okungokoqobo kwe-IDS ne-IPS
Ukuze uqonde kangcono umehluko phakathi kwe-IDS ne-IPS, singabonisa lesi simo esisebenzayo esilandelayo:
1. Ukuvikelwa kokuphepha kwenethiwekhi yebhizinisi Kunethiwekhi yebhizinisi, i-IDS ingafakwa kunethiwekhi yangaphakathi ukuze kuqashwe ukuziphatha ku-inthanethi kwabasebenzi futhi kutholwe ukuthi ingabe kukhona ukufinyelela okungekho emthethweni noma ukuvuza kwedatha. Isibonelo, uma ikhompuyutha yesisebenzi itholakala ingena kuwebhusayithi enobungozi, i-IDS izokhipha isexwayiso futhi yazise umlawuli ukuthi aphenye.
I-IPS, ngakolunye uhlangothi, ingasatshalaliswa emngceleni wenethiwekhi ukuvimbela abahlaseli bangaphandle ekuhlaseleni inethiwekhi yebhizinisi. Isibonelo, uma ikheli le-IP litholwa lingaphansi kokuhlaselwa komjovo we-SQL, i-IPS izovimba ngokuqondile ithrafikhi ye-IP ukuvikela ukuphepha kwesizindalwazi sebhizinisi.
2. Ukuphepha Kwesikhungo Sedatha Ezikhungweni zedatha, i-IDS ingasetshenziswa ukuqapha ithrafikhi phakathi kwamaseva ukuze kutholwe ukuba khona kokuxhumana okungavamile noma uhlelo olungayilungele ikhompuyutha. Isibonelo, uma iseva ithumela inani elikhulu ledatha esolisayo emhlabeni ongaphandle, i-IDS izomaka ukuziphatha okungavamile futhi yazise umlawuli ukuthi ayihlole.
I-IPS, ngakolunye uhlangothi, ingasatshalaliswa ekungeneni kwezikhungo zedatha ukuze kuvinjwe ukuhlaselwa kwe-DDoS, umjovo we-SQL kanye nokunye ithrafikhi enonya. Isibonelo, uma sithola ukuthi ukuhlasela kwe-DDoS kuzama ukwehlisa isikhungo sedatha, i-IPS izokhawulela ngokuzenzakalela ithrafikhi ehlotshaniswayo ukuze kuqinisekiswe ukusebenza okuvamile kwesevisi.
3. Ukuphepha Kwamafu Endaweni yamafu, i-IDS ingasetshenziswa ukuqapha ukusetshenziswa kwezinsizakalo zamafu futhi kutholwe ukuthi kukhona ukufinyelela okungagunyaziwe noma ukusetshenziswa kabi kwezinsiza. Isibonelo, uma umsebenzisi ezama ukufinyelela izinsiza zamafu ezingagunyaziwe, i-IDS izophakamisa isexwayiso futhi yazise umlawuli ukuthi athathe isinyathelo.
I-IPS, ngakolunye uhlangothi, ingasatshalaliswa emaphethelweni enethiwekhi yamafu ukuze kuvikelwe izinsiza zamafu ekuhlaselweni kwangaphandle. Isibonelo, uma ikheli le-IP litholwa ukuqalisa ukuhlasela kwe-brute force kusevisi yefu, i-IPS izonqamula ngokuqondile ku-IP ukuze kuvikelwe ukuphepha kwesevisi yefu.
Ukusetshenziswa ngokubambisana kwe-IDS ne-IPS
Empeleni, i-IDS ne-IPS azitholakali zodwa, kodwa zingasebenza ndawonye ukuze zinikeze ukuvikelwa kokuphepha kwenethiwekhi okuphelele kakhulu. Ngokwesibonelo:
I-IDS njengomphelelisi we-IPS:I-IDS inganikeza ukuhlaziya okujulile kwethrafikhi nokuloga kwemicimbi ukuze isize i-IPS ibone kangcono futhi ivimbe izinsongo. Isibonelo, i-IDS ingathola amaphethini okuhlasela afihliwe ngokuqapha kwesikhathi eside, bese ibuyisela lolu lwazi ku-IPS ukuze ithuthukise isu layo lokuvikela.
I-IPS isebenza njengomabi we-IDS:Ngemuva kokuthi i-IDS ithole usongo, ingaqalisa i-IPS ukuthi isebenzise isu lokuvikela elihambisanayo ukuze kuzuzwe impendulo ezenzakalelayo. Isibonelo, uma i-IDS ithola ukuthi ikheli lasesizindeni se-inthanethi liskenwa ngonya, ingazisa i-IPS ukuthi ivimbe ithrafikhi ngokuqondile kuleyo IP.
Ngokuhlanganisa i-IDS ne-IPS, amabhizinisi nezinhlangano zingakha isistimu yokuvikela yenethiwekhi eqinile ukuze imelane ngempumelelo nezinsongo ezihlukahlukene zenethiwekhi. I-IDS inomthwalo wemfanelo wokuthola inkinga, i-IPS inesibopho sokuxazulula inkinga, kokubili kuyaphelelisana, futhi akukho okulahlwayo.
Thola okulungileI-Network Packet Brokerukusebenza nge-IDS yakho (Isistimu Yokuthola Ukungena)
Thola okulungileI-Inline Bypass Tap Switchukusebenza ne-IPS (Intrusion Prevention System) yakho
Isikhathi sokuthumela: Apr-23-2025
