Ukunciphisa ukuhlaselwa kwe-DDoS okwenziwe ngokwezifiso ngokuvikelwa kokugeleza okuhleliwe

Informatec Digital » Izinsiza » Ukunciphisa ukuhlaselwa kwe-DDoS okwenziwe ngokwezifiso ngokuvikelwa kokugeleza okuhleliwe

Siphila enkathini lapho inethiwekhi iyisicubu esixhumanisa cishe nakho konke esikwenzayo. Lapho inkampani ilahlekelwa yinsizakalo ngenxa yokuhlaselwa kokunqatshelwa kwensizakalo, akuyona nje iwebhusayithi ewohlokayo: ukuthengisa, izinqubo zangaphakathi, insizakalo yamakhasimende, futhi, ezimweni ezimbi kakhulu, izinsizakalo ezibalulekile ziyaphazamiseka. Yingakho ukunciphisa i-DDoS ngokwezifiso ngokuvikelwa kokugeleza okuhleliwe sekuyingxenye yesu yanoma yiluphi uhlaka lwesimanje.

Ukuvela kobuchwepheshe obufana ne -Cloudflare's Programmable Flow Protection for Magic Transit , ukusetshenziswa kwe-C logic eyenziwe ngokwezifiso esetshenziswa njenge-eBPF, ukuhlanganiswa namafu afana ne-AWS ne-Azure, kanye nokusekelwa okuvela ezinsizeni zokuzivikela ezikhethekile kushintshe kakhulu isimo. Manje kungenzeka ukwenza imodeli yalokho okwakha ithrafikhi "enhle" noma "enobungozi" ezingeni lephakethe, ukwenza ukulungiswa kube yizinqubo ezithile ze-UDP (njengalezo ezisetshenziswa emidlalweni eku-inthanethi noma kwi-VoIP), futhi kuhlanganiswe lokhu nezixazululo ze-business intelligence kanye ne-AI ezifunda ekuhlaselweni ngakunye.

Kuyini ukuhlaselwa kwe-DDoS futhi kungani sekuyinkinga enkulu kangaka?

Ukuhlasela kwe-distributed denial-of-service (DDoS) kuhlose ukuqeda izinsiza zesistimu (amaseva, izixhumanisi, izinhlelo zokusebenza, noma ingqalasizinda ephakathi) ngokuqala ithrafikhi eningi evela emithonjeni eminingi ngesikhathi esisodwa. Ngokungafani nokuhlasela kwe-DoS okuvamile, lapho umthombo owodwa ubangela ukuhlaselwa, ukuhlasela kwe-DDoS kuhilela izinkulungwane noma ngisho nezigidi zamadivayisi asengozini, ahlelwe kwi-botnet.

Izisusa zokuhlaselwa kwe-DDoS ziyahlukahluka: ukusongela kwezomnotho, ukucekelwa phansi phakathi kwabancintisana nabo, ubushoshovu, ukuziphindiselela ezintathelini noma eziteshini zabezindaba, noma nje ukuhlolwa kwamandla ngama-botnets amasha ngendlela "yokubonisa amakhono". Nokho, umphumela uhlala ufana: ukungabikho kwensizakalo , ukwehla kokusebenza okukhulu, kanye nomonakalo wezomnotho kanye nedumela.

Eminyakeni yamuva nje, kube nokwanda okuqhubekayo kokuvama kanye nokuqina kwalokhu kuhlasela. Imibiko evela kubathengisi abakhulu bezokuphepha ikhombisa ukukhula okuqhubekayo kokuhlaselwa okukhulu (ngaphezu kwe-1 Tbps noma amaphakethe ayizigidigidi ngomzuzwana), okuvame ukubhekiswa engqalasizinda ebalulekile njengezinsizakalo zezezimali, izinsizakusebenza, kanye nezokuxhumana.

Izinhlobo zokuhlaselwa kwe-DDoS: kusukela kunethiwekhi kuya kuhlelo lokusebenza

Ukuze uqonde ukuthi ukunciphisa i-DDoS ngokwezifiso kusebenza kanjani, kuyasiza ukubuyekeza izigaba eziyinhloko zokuhlaselwa. Ngokuvamile, singazihlanganisa zibe imindeni emine eyinhloko, exhunywe ezingqimbeni ezahlukene zemodeli ye-OSI kanye nezinsiza ezahlukene ezihlose ukuziqeda.

Ukuhlaselwa kwesendlalelo senethiwekhi (L3/L4) kugxile ekusebenziseni izinqubo zenethiwekhi nezokuthutha (i-IP, i-TCP, i-UDP, i-ICMP) ukuze kukhishwe izinsiza ezilinganiselwe kuseva noma ingqalasizinda ephakathi: i-CPU, imemori, amatafula omlilo, ukuxhumana okulindile, noma ama-buffer enethiwekhi. Izibonelo zakudala zifaka phakathi izikhukhula ze-SYN (ukugcwala iseva ngezicelo zokuxhumeka kwe-TCP ezingaqedi ukuxhawulana), izikhukhula ze-UDP eziya emachwebeni angahleliwe, kanye nokuhlaselwa kwe-ICMP.

Ukuhlasela kwesendlalelo sohlelo lokusebenza (L7) kuhlose i-bandwidth encane kunezinsizakusebenza zesicelo sewebhu noma i-API uqobo. Kudala inani elikhulu lezicelo ze-HTTP (GET/POST), imibuzo eyinkimbinkimbi ezinjinini zokusesha zangaphakathi, izingcingo kuma-API asindayo, noma ukusebenzisana, yize kubonakala kusemthethweni, kuphoqa izinhlelo ze-backend, database, noma zokukhiqiza okuqukethwe ukuthi zisebenze ngemikhawulo yazo.

Ukuhlaselwa kwevolumu: Lapha, umgomo uwukugcwalisa isixhumanisi kuze kube yilapho singasakwazi ukusetshenziswa. Kuthunyelwa inani elikhulu lethrafikhi, ngokuvamile kusetshenziswa amasu okukhulisa nokuzindla kumasevisi e-UDP angalungiselelwe kahle, njengamaseva e -DNS omphakathi (i-DNS, i-NTP, i-Memcached, i-CLDAP, i-SNMP, i-SSDP, i-Chargen, i-SLP, njll.), ukuze iphakethe lesicelo elincane likhiqize impendulo enkulu kakhulu eqondiswe kumuntu ozenzile.

Ukuhlasela kwama-vector amaningi okwamanje kuyinkimbinkimbi kakhulu. Kuhlanganisa izindlela eziningana (i-volumetric, i-protocol, kanye ne-application) futhi kushintsha isu ngesikhathi sangempela njengoba zibona ukuthi ukuzivikela kuyaphumelela. Ukuhlasela okukodwa kungaqala njengesikhukhula se-UDP, bese kushintshela esikhukhuleni se-SYN, bese kuthi kamuva kuguqukele ekuhlaselweni kwe-Layer 7 HTTP, okuphoqa isisulu ukuthi sisebenzise ukuzivikela okuphelele nokuhlelekile.

Ukuvela kwangempela kokuhlaselwa kwe-DDoS: kusukela ku-Mirai kuya ku-Tbps hyper-attacks

Le mbono ilungile, kodwa ubukhulu beqiniso benkinga bubonakala ezimweni zangempela. Eminyakeni eyishumi edlule, sisuke ekuhlaselweni kwamakhulu e-Gbps saya ezenzakalweni ezidlula kalula ama-terabits amaningana ngomzuzwana (Tbps) , kanti amazinga ephakethe afinyelela ezigidigidini ngomzuzwana.

Ngo-2016, ukuhlaselwa kwe-Dyn—umhlinzeki omkhulu we-DNS—kwafinyelela cishe ku-1,2 Tbps futhi kwasusa okwesikhashana amasayithi afana ne-Twitter, i-GitHub, i-PayPal, ne-Netflix. I-Mirai botnet, eyaqasha amadivayisi e-IoT angaphezu kuka-600.000 (ama-router, amakhamera, nama-DVR aneziqinisekiso ezizenzakalelayo), yasetshenziswa ukukhiqiza ithrafikhi enkulu kumaseva e-DNS kaDyn, cishe kusetshenziswa inhlanganisela yamasu okukhukhula kwe-UDP kanye nokukhulisa.

Ngawo lowo nyaka, ibhulogi yezokuphepha iKrebsOnSecurity yahlaselwa cishe yi- 623 Gbps , nayo eqhutshwa yiMirai. Cishe izinsuku ezine, amaphakethe amakhulu e-UDP athunyelwa kakhulu kuma-port angahleliwe, agcwalisa izixhumanisi futhi aphoqa umzila omusha wethrafikhi ukuya ezinsizakalweni ezikhethekile zokunciphisa ezifana ne-Akamai Prolexic, eyayisebenzisa isiginesha kanye nokuhlunga ukuziphatha.

Ngo-2018, i-GitHub yayiwumgomo wokuhlaselwa kwe-1,35 Tbps okusekelwe ekukhulisweni kwe-Memcached. Abahlaseli bathumele izicelo ezincane ze-UDP kumaseva e-Memcached adalulwe ku-port 11211, besebenzisa ikheli le-IP le-GitHub eliyinkohliso. Isicelo ngasinye esincane sabangela izimpendulo ezinkulu ngokuphindwe ka-50-100 eziqondiswe ezinhlelweni ze-GitHub, ezaphoqeleka ukuqondisa kabusha ithrafikhi ezikhungweni zokuhlanza lapho izimpendulo ze-Memcached zazihlungwa khona ngamaphethini azo athile.

Ngo-2020, i-Amazon ibike ukuthi i-AWS Shield yayinciphise ukuhlaselwa kwe-2,3 Tbps kuncike ekubonisweni kwe-CLDAP (UDP 389). I-vector yokuhlasela yayihilela ukuqhumisa amaseva e-LDAP angenabo umbuso ngemibuzo eyadala izimpendulo eziningi kakhulu kumuntu ohlukunyeziwe. I-AWS yasakaza ithrafikhi kunethiwekhi yayo yomhlaba wonke futhi yasebenzisa imithetho yokuhlunga yaleyo phethini ethile ye-CLDAP.

Muva nje, ama-botnet afana ne -Mēris avele , esebenzisa ubuthakathaka kuma-router e-MikroTik. Ngo-2021, kwaqoshwa iziqongo zezicelo eziyizigidi ezingu-21,8 ngomzuzwana (RPS), kwathi ngo-2022, lezi zafinyelela ku-RPS eyizigidi ezingu-46 ngokumelene nengqalasizinda ye-Google, ngamanani alinganiselwa ku-1,3 Tbps. Imizamo yokunciphisa ihilela ukuhlanganisa amadivayisi ngobuningi, ukuvala ama-port afana ne-5678 , nokusebenzisa imithetho ethile yokuhlunga yesiginesha ye-Mēris kumanethiwekhi afana ne-Cloudflare ne-Akamai.

Ngo-Ephreli 2025, i-Cloudflare ibike ukuhlaselwa okukhulu okungama-Tbps angu-6,5 kanye namaphakethe ayizigidigidi eziningana ngomzuzwana. Ngokusho kokuhlaziywa kwabo, kwakuyi-botnet engabandakanyiwe enezici ezifana ne-Mēris ne-Aisuru, ezazisebenzisa kakhulu izikhukhula ze-UDP eziqondile ezivela kumadivayisi e-IoT kanye namaseva angalungiselelwe kahle, ngaphandle kokudinga ukukhuliswa kwendabuko. Ukuzivikela kuthembele kunethiwekhi yomhlaba wonke ye-Cloudflare ye-Anycast, ukunciphisa i-XDP/eBPF emaphethelweni, ukuklwebha okunamandla, kanye nokunciphisa izinga nge-IP kanye nesifunda ngasinye.

Futhi ngoMeyi 2025, iKrebsOnSecurity yaphinda yaba yizindaba ngokumelana nokuhlaselwa okungama -Tbps angu-6,3 aqalwe yi-botnet ye-Aisuru. Kulesi simo, amaphakethe e-UDP angaba yizigidi ezingu-585 akhiqizwa ngomzuzwana cishe imizuzwana engu-40-45. I-Google Project Shield, eyayivikela isayithi, yasebenzisa ngokushesha izinqubomgomo zokuhlunga ezinolaka ze-UDP engacelwanga futhi yaphambukisela ithrafikhi ezikhungweni zokuhlanza ezisatshalaliswa kunethiwekhi yayo yomhlaba wonke, ngakho umthelela enkonzweni wawungabonakali.

Izinsizakusebenza namasu abahlaseli: ama-botnet, ukukhulisa, kanye nokugwema

Ukuze kufezwe lezi zibalo ezimangalisayo, abahlaseli basebenzisa izinsiza ezahlukahlukene, bezihlanganisa ngokwenhloso yabo. Ama-botnet amakhulu ayisisekelo: amanethiwekhi amadivayisi asengozini emhlabeni wonke, aqashwa ngokusebenzisa ubuthakathaka obaziwayo, amaphasiwedi azenzakalelayo, noma izinsizakalo zokuphatha eziveziwe. UMirai, uMēris, no-Aisuru amagama emindeni, kodwa kukhona ukuhlukahluka okuningi, okuqondiswe kubakhiqizi noma izinsizakalo ezahlukene.

Ubungozi besibili obukhulu amaseva angalungiselelwanga kahle asebenza njengezibonisi. Noma iyiphi isevisi ye-UDP engaqinisekisiwe ephendula ngedatha eningi kunaleyo eyitholayo iyi-candidate: i-DNS (i-port 53), i-NTP (123), i-Memcached (11211), i-CLDAP (389), i-SNMP (161), i-SSDP, i-Chargen, i-SLP, i-TFTP, i-Portmap, izinsizakalo ze-P2P, noma ngisho nezinhlelo zemidlalo yevidiyo. Umhlaseli uthumela izicelo ezincane ekhohlisa ikheli le-IP lesisulu, futhi amaseva akhulisa futhi abuyisele impendulo kulokho okuqondiwe.

Ku-DNS, isibonelo, umbuzo othi ANY ku-open resolver ungaphindaphinda usayizi wesicelo cishe izikhathi ezingu-28. Ku-NTP, umyalo omdala we-MONLIST ufinyelele izilinganiso zokukhulisa ezingu-50-500x. I-Memcached iyisimo esibi kakhulu: isicelo esincane singabuyisa amakhulu ama-kilobytes, sifinyelele izilinganiso zokukhulisa ezingamashumi ezinkulungwane. I-CLDAP isebenza ngama-factor angu-56-70x, kuyilapho i-SLP isetshenziswe ngamanani adlula u-2000x.

Ngaphezu kwalokho, abahlaseli bathuthukisa amasu abo okubalekela. Ukukhwabanisa nge-IP kusalokhu kuyindlela ejwayelekile yokufihla umsuka wangempela kanye nokusebenzisa ukubonakaliswa. Ezinye izindlela zifaka phakathi ama-vector okuhlasela ajikelezayo njalo, ukuxuba ithrafikhi ebethelwe ukuze kuphoqelelwe imithwalo ephezulu yokucubungula kumvikeli, kusetshenziswa amasu "aphansi nahamba kancane" (ukusetshenziswa kancane kancane kwezinsiza ngaphandle kokukhuphuka okusobala), noma ukuletha ithrafikhi eduze kwesendlalelo sohlelo lokusebenza, lapho ifana kakhulu nethrafikhi esemthethweni.

Esigabeni sangaphambi kokuhlasela, amathuluzi okuskena ngobuningi afana ne-masscan noma i-zmap asetshenziswa ukuthola izinsizakalo ezisengozini, kanye nama-exploit kits aklanyelwe ngqo i-IoT noma amaseva. Ngesikhathi sokuhlasela, kusetshenziswa ama-generator ethrafikhi afana ne-hping3, i-LOIC/HOIC, noma izikripthi ze-C/Python ezilungiselelwe, kanti ekuhlaziyweni kwangemva kokuhlasela, abahlaseli ngokwabo bangasebenzisa amapulatifomu e-Wireshark, i-tcpdump, kanye nokuqapha.

Izigaba zokuhlasela kwe-DDoS kanye nesidingo sokuzivikela okuguquguqukayo

Nakuba kuvame ukubonwa njengokuqhuma kwethrafikhi okuphithizelayo, ukuhlaselwa kwe-DDoS okuyinkimbinkimbi kuhamba ngezigaba eziningana ezihlukene . Okokuqala, isigaba sokuhlola, lapho umhlaseli ehlola khona indawo eveziwe, ekhomba izizinda, amakheli e-IP, izinsizakalo ezivulekile, ama-CDN noma abahlinzeki bokunciphisa abakhona, futhi abheke ubuthakathaka.

Okulandelayo kuza ukuyekethisa kwamadivayisi, okuhilela ukuthelela amakhompyutha azophakela i-botnet. Lokhu kungasho ukusebenzisa ubuthakathaka kuma-router, amakhamera, izinhlelo zokuphatha ezikude, noma amaseva, ngokuvamile ngokusebenzisa isofthiwe esiphelelwe yisikhathi noma iziqinisekiso ezizenzakalelayo. Uma sebeqashiwe, baxhuma engqalasizinda ye-C2, ehlanganisa imiyalo nezibuyekezo.

Isigaba sokuhlasela sivame ukubekwa isikhathi ukuze sihambisane nezikhathi ezibucayi zesisulu: imikhankaso yokumaketha, ukwethulwa komkhiqizo, izimpelasonto lapho abasebenzi abambalwa besemsebenzini, noma izinsuku ezibucayi kwezepolitiki noma kwabezindaba. Umgomo uwukukhulisa umthelela kanye nengcindezi . Ekuhlaselweni kwesizukulwane esilandelayo, kukhona nengxenye yokuzivumelanisa nezimo eguquguqukayo: i-botnet iqapha impendulo yesisulu futhi ishintsha i-vector yayo yokuhlasela uma ithola ukunciphisa okusebenzayo.

Ngasohlangothini lokuzivikela, lokhu kudinga ukwakhiwa kwamasu aguquguqukayo ngokulinganayo. Umkhawulo we-firewall noma we-bandwidth awusanele: izinhlelo ezikwazi ukubona ukungalingani kwethrafikhi ngesikhathi sangempela , ukuhlanganisa imicimbi, ukusebenzisa imithetho emisha ngokushesha, kanye nokwandisa izinsiza (ikhompyutha, isitoreji, kanye nomthamo wenethiwekhi) uma kudingeka.

Ucwaningo lwamuva nje lubonise ukuthi ukuhlaselwa kwe-DDoS ngokumelene nengqalasizinda ebalulekile kukhule ngaphezu kuka-50% eminyakeni emine, nokuthi kuvame ukusetshenziswa njengesivikelo sokubhema kwezinye izigameko zokungena, njengokusetshenziswa kwe-ransomware kuyilapho ithimba lezokuphepha ligxile "ekucimeni umlilo" wokunqatshelwa kwenkonzo.

Ukunciphisa okwendabuko: izikhungo zokuhlanza, ama-CDN, ama-firewall kanye nama-WAF

Ukuzivikela kochwepheshe be-DDoS kuncike ekuhlanganisweni kobuchwepheshe nabahlinzeki. Ingxenye evelele kakhulu yizikhungo zokuhlanza ithrafikhi , ingqalasizinda enkulu esakazekile engakwazi ukumunca amashumi e-Tbps futhi ihlunge ithrafikhi enonya ngaphambi kokubuyisela ukuxhumana okusebenzayo kuphela kuklayenti.

Izinkampani ezifana ne-Netscout/Arbor, i-Akamai/Prolexic, i-Cloudflare, i-Radware, i-Imperva, kanye ne-AWS Shield zilawula amanethiwekhi omhlaba wonke anezindawo eziningi zokuba khona. Uma kutholwa ukuhlaselwa, ithrafikhi eqondiswe enhlanganweni yesisulu iqondiswa kabusha (ngokushintsha kwe-BGP noma izibuyekezo ze-DNS) kulezi zikhungo, lapho kusetshenziswa khona izihlungi ngokusekelwe kumasignesha, ukuziphatha, uhlu lwabantu abamnyama, ukuhlaziywa kwezibalo, kanye nemithetho yangokwezifiso.

Ngesikhathi esifanayo, izinhlangano eziningi zisebenzisa imishini yokulwa ne-DDoS ezindaweni zazo zedatha noma ze-ISP yazo. Amadivayisi afana ne-Arbor TMS, i-Radware DefensePro, i-FortiDDoS, noma izixazululo ezithile ze-F5 anesibopho sokuthola nokunciphisa ukuhlaselwa kuze kufike emkhawulweni othile womthamo. Kungumkhuba ovamile ukuhlanganisa lezi mishini zasendaweni nesisombululo sokuhlikihla esisekelwe efwini sokuhlasela okungaphezu kwamandla azo.

Ama-CDN kanye nezakhiwo ze-Anycast — njengalezo ezivela ku-Cloudflare, Akamai, Fastly, noma i-Google Cloud CDN — zengeza olunye ungqimba lokuzivikela ngokusabalalisa umthwalo ngokwendawo. Ngokushicilela isevisi ngemuva kwe-CDN, ithrafikhi isatshalaliswa kuma-node amaningi, futhi ukuhlaselwa kwe-volumetric kuyancishiswa ngokungagxili endaweni eyodwa. Ngaphezu kwalokho, ngokuvamile zihlanganisa ama-Web Application Firewalls (ama-WAF) kanye nezinqubomgomo zokunciphisa izinga le-HTTP.

Okokugcina, ama-firewall enethiwekhi (i-Cisco, i-Palo Alto, ama-iptables ku-Linux, njll.) kanye nama-WAF akhethekile (i-ModSecurity, i-Cloudflare WAF, i-AWS WAF) akuvumela ukuthi uhlunge ithrafikhi ngekheli le-IP, i-port, amafulegi, kanye namaphethini ohlelo lokusebenza . Nakuba wona wodwa engeke amise ukuhlaselwa kwe-Tbps ezingeni lomgogodla, abalulekile ekuvimbeleni ama-vector okuhlasela aziwayo, ekukhawuleleni ukuxhumana okusolisayo, kanye nasekuvikeleni izendlalelo 6 no-7 zesitaki.

Ukuvikelwa Kokugeleza Okuhleliwe kanye nokunciphisa okwenziwe ngokwezifiso nge-Magic Transit

Kulo mongo wokuhlaselwa okuyinkimbinkimbi kakhulu kanye nezinqubo ezithile eziya ngokuya ziphakama, izixazululo ezifana ne- Cloudflare's Programmable Flow Protection for Magic Transit ziyavela , ziphawula ukwenyuka kwekhwalithi: zivumela izinkampani ukuthi zibhale indlela yazo yokunciphisa futhi ziyithumele ngqo kunethiwekhi yomhlinzeki womhlaba wonke.

Umqondo ulula kodwa unamandla: Amakhasimende e-Magic Transit angalayisha izinhlelo zokucubungula amaphakethe ezibhalwe ku-C. I-Cloudflare iqinisekisa, ihlanganise, futhi iguqule lezi zinhlelo zibe yi-eBPF, izisebenzise endaweni yomsebenzisi ngaphakathi kwengqalasizinda yayo yomhlaba wonke. Lokhu kubavumela ukuthi bahlole ithrafikhi yesicelo se-UDP ngendlela eqaphela iphrothokholi: ukuqonda izihloko ezithile kumdlalo oku-inthanethi, uhlelo lokuhweba oluvame kakhulu, izinsizakalo ze-VoIP, noma amapulatifomu okusakaza, kanye nokunquma, iphakethe ngephakethe, ukuthi yini okufanele ivunyelwe nokuthi yini okufanele ivinjwe.

Le logic yangokwezifiso ihlangana ne-Flowtrackd, ipulatifomu yokunciphisa ehlelekile ye-Cloudflare. Lesi sici sisekela kokubili ama-topology alinganayo kanye nalawo angalingani, yize kulesi sigaba se-beta esivaliwe, sigxile ekuhlaziyeni ithrafikhi engenayo. Konke ukuphathwa kuphathwa nge-Cloudflare API, ngama-endpoints okulayisha izinhlelo, ukudala imithetho ehlobene, ukucushwa kohlu, noma ukuzisusa njengoba izidingo zishintsha.

Okubalulekile lapha ukuthi asisathembeli kuphela kumasignesha abathengisi abajwayelekile kanye nama-heuristics. Inkampani yemidlalo yevidiyo, isibonelo, ingachaza ngokucacile ukugeleza okusemthethweni kwephrothokholi yayo ye-UDP (ukuxhawulana, imiyalezo yokuma, ukugcina impilo, njll.) nokuthi yimaphi amaphethini ayisihluthulelo sokuhlasela. Le logic ihlanganiswa futhi isetshenziswe kuwo wonke amaphuzu okukhona kwe-Cloudflare, okuletha isinqumo eduze komphetho wenethiwekhi.

Ezindaweni ezinezinqubo ezenziwe ngokwezifiso noma izinhlelo zokusebenza ezinezidingo zokubambezeleka okuphezulu kakhulu, lokhu kunciphisa ukuhlaselwa kwe-DDoS ngokuvikelwa kokugeleza okuhleliwe kuyishintsho lomdlalo: kunezela ungqimba lobuhlakani obuqondene nebhizinisi ngaphezu kokuzivikela okujwayelekile. Futhi uma kuhlanganiswa nezinsizakalo zamafu njenge-AWS noma i-Azure, kanye nezixazululo zesofthiwe ezenziwe ngokwezifiso (njengalezo ezakhiwe yizinkampani ezingochwepheshe ku-AI kanye nokuhlaziya, njenge-Q2BSTUDIO), kuvumela ukuzenzekela okukhulu kokutholwa kwemithetho kanye nezibuyekezo ngokusekelwe ezinsongweni ezivelayo.

Kungani ama-ISP nezinhlangano zidinga ukunciphisa i-DDoS okuthuthukisiwe

Abahlinzeki bezinsizakalo ze-inthanethi (ama-ISP) kanye nezinhlangano ezinkulu basemaphethelweni angaphambili. Ukuhlasela okukhulu ngokwanele kunganqoba hhayi ikhasimende elilodwa kuphela, kodwa ingxenye yonke yenethiwekhi yomqhubi, okubangela ukungasebenzi kahle okuthinta izinkulungwane zabasebenzisi. Ngakho-ke, ukunciphisa i-DDoS sekuyinto ebalulekile, hhayi into eyengeziwe ongayikhetha.

Ngokombono webhizinisi, imiphumela yokwehluleka ukuzivikela isobala: ukuphazamiseka kwensizakalo, ukwephulwa kwezivumelwano zezinga lensizakalo (ama-SLA), izinhlawulo zenkontileka, ukulahlekelwa ngqo kwemali engenayo, kanye nokulahlekelwa kwamakhasimende kwabancintisana nabo okubonwa njengokwethenjelwa kakhulu. Uma isicelo esibucayi singatholakali lapho umsebenzisi esidinga, ngokwemvelo uzofuna ezinye izindlela.

Emikhakheni efana nebhange, umshwalense, izinsizakusebenza, kanye nokunakekelwa kwempilo, umthelela ungadlulela ngale kwezomnotho: ukuphazamiseka kwezinqubo zomzimba , izingozi zokusebenza, kanye nokuphazamiseka kwezinsizakalo ezibalulekile. Ngaphezu kwalokho, kunezindleko zodumo okunzima ukuzibuyisa lapho uhlobo luhlotshaniswa "nohlelo olungasebenzi" amahora amaningi ezinkundleni zokuxhumana kanye nasemaphephandabeni.

Okwenza izinto zibe zimbi kakhulu, ukuhlaselwa kwe-DDoS kuvame ukusetshenziswa njengesivikelo sokuhlaselwa okulimazayo. Ngenkathi ithimba lezokuphepha ligxile ekuphatheni ukwanda kwethrafikhi, abahlaseli bangazama ukuhamba ngaphakathi kwenethiwekhi, basebenzise i-ransomware, noma bakhiphe idatha. Ngamanye amazwi, ukuhlaselwa kwe-DDoS kusebenza njengezinto zokukhohlisa nokuphazamisa ekuhlaselweni kwezigaba eziningi.

Izixazululo zesimanje zokunciphisa, kokubili endaweni kanye nasefwini, zinciphisa kakhulu isikhathi sokungasebenzi, zigcina ukuqhubeka kwebhizinisi, futhi zivikela kokubili izimpahla zasendaweni kanye nezinsizakusebenza zamafu zomphakathi. Isihluthulelo yikhono lazo lokukhulisa ngokuzenzakalelayo ukuze zibhekane nokwanda okukhulu kwethrafikhi futhi zinikeze iziqinisekiso ezicacile zamandla nesikhathi sokuphendula.

Amasu athile okunciphisa: kusukela ekukhawuleni kwamanani kuya ekuvaleni imigodi

Ngale kwamabhulokhi amakhulu obuchwepheshe, kunezindlela eziningi ezithile ezisetshenziswa nsuku zonke ukulwa nezinhlobo ezahlukene zokuhlaselwa. Enye yezinto eziyisisekelo kakhulu ukuhlunga kwe-perimeter kusetshenziswa ama-firewall kanye nohlu lokulawula ukufinyelela (ama-ACL) kuma-router nama-switch, ukuvimba amaphakethe ngokusekelwe ekhelini le-IP lomthombo, ikheli le-IP yendawo, amachweba, amafulegi e-TCP, noma usayizi.

Esinye isakhi esivamile yi -rate limiting , kokubili ezingqimbeni ezingu-3/4 kanye naku-HTTP. Kuzinhlelo ze-Linux, i-iptables inikeza amamojula afana ne-hashlimit noma i-SYNPROXY ukulawula ukuthi zingaki izixhumanisi noma amaphakethe ngomzuzwana amukelwayo kusuka ekhelini elilodwa le-IP. Ezingeni lesicelo, ama-proxies afana ne -Nginx noma i-HAProxy angabeka imikhawulo ezicelweni ngeklayenti ngalinye noma ngomzila ngamunye.

Kuhlaselo lwe-Layer 7, ukusebenzisa izinselelo noma ukuqinisekiswa okwengeziwe kuyasiza kakhulu . Ama-CAPTCHA, izinselelo ze-JavaScript, kanye nezindlela ezifanayo zivumela ukuhlukaniswa okungcono phakathi kweziphequluli zangempela nama-bots azenzakalelayo, okunciphisa umthwalo kuhlelo lokusebenza lwangempela. Ku-TCP, amasu afana namakhukhi e-SYN asiza iseva ukugwema ukugcina isimo somzamo ngamunye wokuxhumana kuze kube yilapho ukuxhawulana sekuqediwe.

Uma ivolumu yokuhlasela ingalawuleki ngisho nengqalasizinda yokunciphisa, i-BGP blackholing ingasetshenziswa : i-ISP ikhangisa indlela eya kunethiwekhi ehlaselwe "njengomgodi omnyama," ilahla yonke ithrafikhi eqondiswe kuleyo siqalo ngaphambi kokuba ingene emgogodleni. Kuyindlela yokugcina, ngoba yenza isevisi ingatholakali, kodwa ivimbela ukuhlaselwa ukuthi kungathinti ezinye izingxenye zenethiwekhi.

Izinsizakalo zokuhlanza amafu—njengalezo ezinikezwa yi-Cloudflare, i-Akamai, i-AWS Shield, i-Google Project Shield, i-Radware, nabanye—zikuvumela ukuthi uqondise yonke ithrafikhi ezikhungweni zayo zedatha bese uyihlanza lapho, usebenzisa imithetho ethile yama-vectors njenge-Memcached amplification, i-CLDAP, i-DNS, i-NTP, izikhukhula ze-UDP ezingakhuliswanga, njalo njalo. Ukuhlasela ngakunye okuvinjiwe kondla amamodeli okufunda komshini kanye nezizindalwazi zesiginesha ezisetshenziswa emizamweni yokunciphisa esikhathini esizayo.

Imikhuba emihle kanye nezifundo ezifundwe lapho kubhekene nokuhlaselwa kwe-DDoS kwamanje

Kunezifundo eziningana ezicacile ezingafundwa ezigamekweni ezinkulu zeminyaka yamuva. Okokuqala ukuthi ukuvikela amadivayisi e-IoT kubalulekile: amandla amaningi ama-botnet afana ne-Mirai, i-Mēris, noma i-Aisuru avela kuma-router asekhaya, amakhamera, namanye amadivayisi ane-firmware yakudala namaphasiwedi azenzakalelayo asefektri.

Okwesibili ukuthi kumele sisuse amavekhtha okukhulisa ngaphakathi kwamanethiwekhi ethu: sikhubaze izinsizakalo ze-UDP ezingadingekile, sihlunge i-NTP, i-DNS, noma ithrafikhi ephumayo e-Memcached, sisebenzise imithetho yomlilo evumela kuphela imibuzo evela kumabanga agunyaziwe, futhi sibuyekeze njalo amachweba adaluliwe. Noma iyiphi iseva engalungiselelwe kahle ingaba yi-amplifier yomhlaseli.

Ukutholwa kusenesikhathi kwezinto ezingavamile nakho kubalulekile . Amathuluzi anjenge-NetFlow, i-sFlow, i-IDS/IPS (i-Snort, i-Suricata), amapulatifomu okuhlaziya amalogi, noma ama-SIEM kufanele alungiselelwe ukuxwayisa ngokushesha lapho kuvela ukwanda kwethrafikhi okungavamile, izinguquko ezisheshayo kumaphethini okuxhumana, noma amasignesha okuhlasela aziwayo. Uma impendulo ivuselelwa ngokushesha, isikhathi esincane sokuhlasela siyanda.

Ezindaweni zewebhu, cishe kuyimpoqo ukusebenzisa ama-WAF abuyekeziwe, ama-CAPTCHA uma efanelana nolwazi lomsebenzisi, kanye nama-cache noma ama-CDN ukuze amunce omunye umthwalo. Ezingeni lesistimu, ukunika amandla amakhukhi e-SYN, ukulungisa imingcele yokuxhumeka ngasikhathi sinye, kanye nokuvala noma yiziphi izinsizakalo ezingabalulekile kunciphisa indawo yokuhlasela.

Okokugcina, yonke inhlangano kufanele ibe nohlelo olubhaliwe lwe-DDoS olunezinyathelo ezicacile, amaqembu anomthwalo wemfanelo aqokiwe, oxhumana nabo bezobuchwepheshe kubahlinzeki bokunciphisa kanye nama-ISP, kanye nezindlela ezichazwe kusengaphambili zokuthi kufanele kusebenze nini ukuhlanza, ukuthi kufanele kucelwe nini ukuvalwa, noma ukuthi kufanele kuncishiswe nini imisebenzi engabalulekile ukuvikela ibhizinisi eliyinhloko.

Lo mkhuba ukhomba ekuhlaselweni okusheshayo, okunamandla kakhulu, nokuguquguqukayo, kodwa futhi nasekuvikeleni okuhlakaniphile nokungenziwa ngezifiso kakhudlwana. Ukusebenzisa amakhono ezixazululo ezifana nokuvikelwa kokugeleza okuhleliwe, kuhlanganiswe nokuqapha njalo ithrafikhi, imikhuba emihle yokucushwa, kanye nokwakhiwa kwamafu okungafuneki, kuvumela izinkampani ukuthi ziqhubeke nokusebenza ngokujwayelekile ngisho naphakathi kwesiphepho esikhulu, ukuvikela hhayi idatha yazo kuphela kodwa nedumela lazo kanye nokwethenjwa kwamakhasimende.