Esikhathini sanamuhla sedijithali, ukuphepha kwenethiwekhi sekuyinkinga ebalulekile okumele amabhizinisi nabantu ngabanye babhekane nayo. Ngokuqhubeka kokuhlaselwa kwenethiwekhi, izindlela zokuphepha zendabuko azisenele. Kulesi simo, i-Intrusion Detection System (IDS) kanye ne-Intrusion Prevention System (IPS) ziyavela njengoba i-Times idinga, futhi ziba abaqaphi ababili abakhulu emkhakheni wokuphepha kwenethiwekhi. Bangase babonakale befana, kodwa bahluke kakhulu ngokusebenza kanye nokusetshenziswa. Lesi sihloko sihlola ngokujulile umehluko phakathi kwe-IDS ne-IPS, futhi sichaza laba baqaphi ababili bokuphepha kwenethiwekhi.
I-IDS: I-Scout of Network Security
1. Imiqondo Eyisisekelo Yohlelo Lokuthola Ukungena Kwe-IDS (IDS)iyidivayisi yokuphepha kwenethiwekhi noma uhlelo lokusebenza lwesofthiwe olwenzelwe ukuqapha ithrafikhi yenethiwekhi nokuthola imisebenzi enobungozi noma ukwephulwa okungenzeka. Ngokuhlaziya amaphakethe enethiwekhi, amafayela elogi kanye nolunye ulwazi, i-IDS ikhomba ithrafikhi engavamile futhi ixwayise abaphathi ukuthi bathathe izinyathelo zokumelana ezifanele. Cabanga nge-IDS njengomhloli oqaphile obuka yonke intshukumo kunethiwekhi. Uma kukhona ukuziphatha okusolisayo kunethiwekhi, i-IDS izoba okokuqala ukuthola nokukhipha isexwayiso, kodwa ngeke ithathe isinyathelo esisebenzayo. Umsebenzi wayo "ukuthola izinkinga," hhayi "ukuzixazulula."
2. Indlela i-IDS esebenza ngayo Indlela i-IDS esebenza ngayo incike kakhulu kumasu alandelayo:
Ukutholwa Kwesiginesha:I-IDS inesizindalwazi esikhulu samasignesha aqukethe amasignesha okuhlaselwa okwaziwayo. I-IDS iphakamisa isexwayiso lapho ithrafikhi yenethiwekhi ifanisa isignesha kusizindalwazi. Lokhu kufana namaphoyisa asebenzisa isizindalwazi sama-fingerprint ukuze athole abasolwa, abaphumelelayo kodwa abancike olwazini olwaziwayo.
Ukutholwa Kwe-Anomaly:I-IDS ifunda amaphethini okuziphatha ajwayelekile enethiwekhi, futhi uma isithole ithrafikhi ephambuka kuphethini evamile, iyiphatha njengosongo olungaba khona. Isibonelo, uma ikhompyutha yesisebenzi ithumela idatha eningi ebusuku kakhulu, i-IDS ingase ibonise ukuziphatha okungajwayelekile. Lokhu kufana nonogada onolwazi ojwayelene nemisebenzi yansuku zonke yendawo futhi uzoqaphela uma sekutholakale ukungahambi kahle.
Ukuhlaziywa Kwephrothokholi:I-IDS izokwenza ukuhlaziywa okujulile kwezinqubo zenethiwekhi ukuthola ukuthi kukhona yini ukwephulwa noma ukusetshenziswa kwenqubo okungavamile. Isibonelo, uma ifomethi yenqubo yephakethe elithile ingahambisani nezindinganiso, i-IDS ingase ikubheke njengokuhlasela okungenzeka.
3. Izinzuzo kanye nokungalungi
Izinzuzo ze-IDS:
Ukuqapha kwesikhathi sangempela:I-IDS ingaqapha ithrafikhi yenethiwekhi ngesikhathi sangempela ukuthola izinsongo zokuphepha ngesikhathi. Njengomlindi ongalali, qapha njalo ukuphepha kwenethiwekhi.
Ukuzivumelanisa nezimo:I-IDS ingafakwa ezindaweni ezahlukene zenethiwekhi, njengemingcele, amanethiwekhi angaphakathi, njll., okuhlinzeka ngamazinga amaningi okuvikela. Kungakhathaliseki ukuthi ukuhlasela kwangaphandle noma usongo lwangaphakathi, i-IDS ingakuthola.
Ukufakwa kwemicimbi:I-IDS ingarekhoda izingodo zomsebenzi wenethiwekhi ezinemininingwane ukuze kuhlaziywe ukuhlolwa kwesidumbu kanye nokuhlolwa kwe-forensics. Kufana nombhali othembekile ogcina irekhodi layo yonke imininingwane kunethiwekhi.
Izinkinga ze-IDS:
Izinga eliphezulu lemiphumela engamanga:Njengoba i-IDS ithembele ekusayinweni nasekutholakaleni kwezinkinga, kungenzeka ukuthi ithrafikhi evamile ithathwe kabi njengesenzo esinonya, okuholela ezinzuzweni ezingamanga. Njengonogada ozwela kakhulu ongase acabange ukuthi umuntu olethayo uyisela.
Ayikwazi ukuvikela ngendlela ephumelelayo:I-IDS ingathola futhi iphakamise izexwayiso kuphela, kodwa ayikwazi ukuvimba ithrafikhi enonya ngendlela ephumelelayo. Ukungenelela ngesandla kwabaphathi kuyadingeka futhi uma inkinga isitholakele, okungaholela ezikhathini ezinde zokuphendula.
Ukusetshenziswa kwezinsiza:I-IDS idinga ukuhlaziya inani elikhulu lethrafikhi yenethiwekhi, engase ithathe izinsiza eziningi zesistimu, ikakhulukazi endaweni lapho kunethrafikhi ephezulu khona.
I-IPS: "Umvikeli" Wokuphepha Kwenethiwekhi
1. Umqondo oyisisekelo woHlelo Lokuvimbela Ukungena Kwe-IPS (IPS)iyithuluzi lokuphepha kwenethiwekhi noma uhlelo lokusebenza lwesofthiwe oluthuthukiswe ngokusekelwe ku-IDS. Ayikwazi ukubona imisebenzi enonya kuphela, kodwa futhi iyivimbele ngesikhathi sangempela futhi ivikele inethiwekhi ekuhlaselweni. Uma i-IDS iyi-scout, i-IPS ingumlindi onesibindi. Ayikwazi ukubona isitha kuphela, kodwa futhi ithatha isinyathelo sokumisa ukuhlasela kwesitha. Umgomo we-IPS "ukuthola izinkinga nokuzilungisa" ukuze ivikele ukuphepha kwenethiwekhi ngokungenelela kwesikhathi sangempela.
2. Indlela i-IPS esebenza ngayo
Ngokusekelwe kumsebenzi wokuthola we-IDS, i-IPS inezela indlela yokuzivikela elandelayo:
Ukuvinjelwa kwethrafikhi:Uma i-IPS ithola ithrafikhi enonya, ingavimba ngokushesha le thrafikhi ukuze iyivimbele ukuthi ingangeni kunethiwekhi. Isibonelo, uma kutholakala iphakethe lizama ukusizakala ngobuthaka obaziwayo, i-IPS izovele iyilahle.
Ukuphela kweseshini:I-IPS ingaqeda iseshini phakathi kwe-host enonya futhi inqamule uxhumano lomhlaseli. Isibonelo, uma i-IPS ithola ukuthi ukuhlaselwa kwe-bruteforce kwenziwa ekhelini le-IP, izomane inqamule ukuxhumana naleyo IP.
Ukuhlunga okuqukethwe:I-IPS ingenza ukuhlunga okuqukethwe kuthrafikhi yenethiwekhi ukuvimba ukudluliswa kwekhodi noma idatha enonya. Isibonelo, uma okunamathiselwe kwe-imeyili kutholakala ukuthi kuqukethe i-malware, i-IPS izovimba ukudluliswa kwaleyo imeyili.
I-IPS isebenza njengomlindi womnyango, hhayi nje kuphela ukubona abantu abasolisayo, kodwa futhi nokubaxosha. Isabela ngokushesha futhi ingaqeda izinsongo ngaphambi kokuba zisakazeke.
3. Izinzuzo kanye nokungalungi kwe-IPS
Izinzuzo ze-IPS:
Ukuzivikela okusebenzayo:I-IPS ingavimbela ithrafikhi enonya ngesikhathi sangempela futhi ivikele ngempumelelo ukuphepha kwenethiwekhi. Kufana nomlindi oqeqeshwe kahle, okwaziyo ukuxosha izitha ngaphambi kokuba zisondele.
Impendulo ezenzakalelayo:I-IPS ingasebenzisa ngokuzenzakalelayo izinqubomgomo zokuvikela ezichazwe ngaphambilini, inciphise umthwalo kubaphathi. Isibonelo, lapho kutholwa ukuhlaselwa kwe-DDoS, i-IPS ingakhawulela ngokuzenzakalelayo ithrafikhi ehlobene.
Ukuvikelwa okujulile:I-IPS ingasebenza nezivikelo zomlilo, amasango okuphepha kanye namanye amadivayisi ukuze inikeze izinga elijulile lokuvikelwa. Ayivikeli nje kuphela umngcele wenethiwekhi, kodwa futhi ivikela izimpahla ezibalulekile zangaphakathi.
Izinkinga ze-IPS:
Ukuvimba okungamanga Ingozi:I-IPS ingavimba ithrafikhi evamile ngephutha, okuthinta ukusebenza okuvamile kwenethiwekhi. Isibonelo, uma ithrafikhi esemthethweni ichazwa kabi njengenonya, ingabangela ukuphazamiseka kwesevisi.
Umthelela wokusebenza:I-IPS idinga ukuhlaziywa kanye nokucutshungulwa kwethrafikhi yenethiwekhi ngesikhathi sangempela, okungaba nomthelela ekusebenzeni kwenethiwekhi. Ikakhulukazi endaweni lapho kunethrafikhi ephezulu khona, kungaholela ekubambezelekeni okukhulu.
Ukucushwa okuyinkimbinkimbi:Ukucushwa nokugcinwa kwe-IPS kuyinkimbinkimbi kakhulu futhi kudinga abasebenzi abangochwepheshe ukuthi bayiphathe. Uma ingalungiswanga kahle, ingabangela umthelela omubi wokuzivikela noma ibhebhethekise inkinga yokuvinjelwa okungamanga.
Umehluko phakathi kwe-IDS ne-IPS
Nakuba i-IDS ne-IPS zinomehluko wamagama owodwa kuphela egameni, zinomehluko obalulekile ekusebenzeni nasekusetshenzisweni kwazo. Nansi umehluko omkhulu phakathi kwe-IDS ne-IPS:
1. Indawo yokusebenza
I-IDS: Isetshenziswa kakhulu ukuqapha nokuthola izinsongo zokuphepha kunethiwekhi, okuwukuvikela okungasebenzi. Isebenza njengomhloli, ikhala i-alamu uma ibona isitha, kodwa ayithathi isinyathelo sokuhlasela.
I-IPS: Umsebenzi wokuzivikela osebenzayo wengezwa ku-IDS, engavimba ithrafikhi enonya ngesikhathi sangempela. Kufana nomlindi, hhayi nje kuphela ongakwazi ukubona isitha, kodwa futhi ongakwazi ukusivimbela ukuba singangeni.
2. Isitayela sokuphendula
I-IDS: Izexwayiso zikhishwa ngemva kokuba kutholakale usongo, okudinga ukungenelela ngesandla ngumlawuli. Kufana nomlindi obona isitha futhi ebika kubaphathi bakhe, elinde imiyalelo.
I-IPS: Amasu okuzivikela asetshenziswa ngokuzenzakalelayo ngemva kokuba usongo lutholakale ngaphandle kokungenelela komuntu. Kufana nonogada obona isitha bese esibuyisela emuva.
3. Izindawo zokuthunyelwa
I-IDS: Ivame ukufakwa endaweni edlulayo yenethiwekhi futhi ayithinti ngqo ithrafikhi yenethiwekhi. Umsebenzi wayo ukubuka nokurekhoda, futhi ngeke iphazamise ukuxhumana okuvamile.
I-IPS: Ngokuvamile isetshenziswa endaweni yenethiwekhi eku-inthanethi, iphatha ithrafikhi yenethiwekhi ngqo. Idinga ukuhlaziywa kwesikhathi sangempela kanye nokungenelela kwethrafikhi, ngakho-ke isebenza kahle kakhulu.
4. Ingozi ye-alamu yamanga/ukuvimba kwamanga
Ama-IDS: Amaphutha amahle awathinti ngqo ukusebenza kwenethiwekhi, kodwa angabangela abaphathi ukuthi babhekane nobunzima. Njengomlindi ozwela ngokweqile, ungase uzwakale ama-alamu njalo futhi wandise umthwalo wakho womsebenzi.
I-IPS: Ukuvimba okungamanga kungabangela ukuphazamiseka kwesevisi okuvamile futhi kuthinte ukutholakala kwenethiwekhi. Kufana nonogada onolaka kakhulu futhi ongalimaza amabutho anobungane.
5. Izimo zokusetshenziswa
I-IDS: Ifanele izimo ezidinga ukuhlaziywa okujulile nokuqapha imisebenzi yenethiwekhi, njengokuhlolwa kwezokuphepha, impendulo yezehlakalo, njll. Isibonelo, ibhizinisi lingasebenzisa i-IDS ukuqapha ukuziphatha kwabasebenzi ku-inthanethi nokuthola ukwephulwa kwedatha.
I-IPS: Ifanele izimo ezidinga ukuvikela inethiwekhi ekuhlaselweni ngesikhathi sangempela, njengokuvikelwa kwemingcele, ukuvikelwa kwezinsizakalo ezibalulekile, njll. Isibonelo, ibhizinisi lingasebenzisa i-IPS ukuvimbela abahlaseli bangaphandle ukuthi bangangeni kunethiwekhi yalo.
Ukusetshenziswa okusebenzayo kwe-IDS ne-IPS
Ukuze siqonde kangcono umehluko phakathi kwe-IDS ne-IPS, singabonisa lesi simo esilandelayo sokusebenza:
1. Ukuvikelwa kokuphepha kwenethiwekhi yebhizinisi Kunethiwekhi yebhizinisi, i-IDS ingafakwa kunethiwekhi yangaphakathi ukuqapha ukuziphatha kwabasebenzi ku-inthanethi nokuthola ukuthi kukhona yini ukufinyelela okungekho emthethweni noma ukuvuza kwedatha. Isibonelo, uma ikhompyutha yesisebenzi itholakala ifinyelela iwebhusayithi enonya, i-IDS izokhipha isaziso futhi yazise umphathi ukuthi aphenye.
Ngakolunye uhlangothi, i-IPS ingafakwa emngceleni wenethiwekhi ukuvimbela abahlaseli bangaphandle ukuthi bangangeni kunethiwekhi yebhizinisi. Isibonelo, uma ikheli le-IP litholakala ukuthi lihlaselwa yi-SQL, i-IPS izovimba ngqo ithrafikhi ye-IP ukuvikela ukuphepha kwesizindalwazi sebhizinisi.
2. Ukuphepha Kwesikhungo Sedatha Ezikhungweni zedatha, i-IDS ingasetshenziswa ukuqapha ithrafikhi phakathi kwamaseva ukuthola ukuthi kukhona ukuxhumana okungajwayelekile noma i-malware. Isibonelo, uma iseva ithumela inani elikhulu ledatha esolisayo ezweni langaphandle, i-IDS izomaka ukuziphatha okungajwayelekile futhi yazise umphathi ukuthi akuhlole.
Ngakolunye uhlangothi, i-IPS ingafakwa emnyango wezikhungo zedatha ukuvimba ukuhlaselwa kwe-DDoS, ukujova kwe-SQL kanye nokunye ukuminyana kwethrafikhi. Isibonelo, uma sithola ukuthi ukuhlaselwa kwe-DDoS kuzama ukudiliza isikhungo sedatha, i-IPS izokhawulela ngokuzenzakalelayo ithrafikhi ehlobene ukuqinisekisa ukusebenza okuvamile kwensizakalo.
3. Ukuphepha Kwamafu Endaweni yamafu, i-IDS ingasetshenziswa ukuqapha ukusetshenziswa kwezinsizakalo zamafu nokuthola ukuthi kukhona ukufinyelela okungagunyaziwe noma ukusetshenziswa kabi kwezinsiza. Isibonelo, uma umsebenzisi ezama ukufinyelela izinsiza zamafu ezingagunyaziwe, i-IDS izophakamisa isexwayiso futhi yazise umphathi ukuthi athathe isinyathelo.
Ngakolunye uhlangothi, i-IPS ingafakwa emaphethelweni enethiwekhi yamafu ukuvikela izinsizakalo zamafu ekuhlaselweni kwangaphandle. Isibonelo, uma kutholakala ikheli le-IP ukuze kuqalwe ukuhlaselwa kwe-brute force kusevisi yamafu, i-IPS izonqamula ngqo ku-IP ukuze ivikele ukuphepha kwesevisi yamafu.
Ukusetshenziswa ngokubambisana kwe-IDS ne-IPS
Empeleni, i-IDS ne-IPS azikho zodwa, kodwa zingasebenzisana ukuhlinzeka ngokuvikelwa kokuphepha kwenethiwekhi okuphelele. Isibonelo:
I-IDS njengesengezo se-IPS:I-IDS ingahlinzeka ngokuhlaziywa okujulile kwethrafikhi kanye nokubhalwa kwemicimbi ukusiza i-IPS ukuthi ibone futhi ivimbele kangcono izinsongo. Isibonelo, i-IDS ingathola amaphethini okuhlasela afihliwe ngokuqapha isikhathi eside, bese idlulisela lolu lwazi ku-IPS ukuze ithuthukise isu layo lokuzivikela.
I-IPS isebenza njengomphathi we-IDS:Ngemva kokuthi i-IDS ithole usongo, ingenza i-IPS isebenzise isu lokuzivikela elihambisanayo ukuze ithole impendulo ezenzakalelayo. Isibonelo, uma i-IDS ithola ukuthi ikheli le-IP liyaskenwa ngendlela enonya, ingazisa i-IPS ukuthi ivimbele ithrafikhi ngqo kuleyo IP.
Ngokuhlanganisa i-IDS ne-IPS, amabhizinisi nezinhlangano zingakha uhlelo lokuvikela ukuphepha kwenethiwekhi oluqinile ukuze lumelane ngempumelelo nezinsongo ezahlukahlukene zenethiwekhi. I-IDS inesibopho sokuthola inkinga, i-IPS inesibopho sokuxazulula inkinga, kokubili kuyahambisana, akukho noyedwa ongakudingi.
Thola kwesokudlaUmthengisi Wephakethe Lenethiwekhiukusebenzisana ne-IDS yakho (Uhlelo Lokuthola Ukungena)
Thola kwesokudlaIswishi Sokuthepha Esihamba Ngomugqaukusebenzisana ne-IPS yakho (Uhlelo Lokuvimbela Ukungena)
Isikhathi sokuthunyelwe: Ephreli-23-2025
