有问题，就会有答案 - 知乎

Crime of Illegally Obtaining Computer System Data - Intrusion Detection Technology in Computer Network Security and Maintenance

Source: Chang Hao Commercial Secrets Lawyer (Crime of Illegally Obtaining Computer Information System Data, Crime of Illegally Obtaining Computer Information System Data)

1. Ways of network intrusion

Network intrusion refers to the use of skills in writing and debugging computer programs to gain illegal or unauthorized access to networks or files, and to intrude into an internal network.

Currently, network intrusion methods mainly include the following aspects:

Viruses are computer programs that can self-replicate, designed to damage specific system resources, using denial of service or compromising data integrity. They possess characteristics such as contagiousness, stealth, parasitism, reproductive ability, and latency. Currently, the main targets of virus attacks are BBS, email, WWW browsing, and FTP file downloads, among other point-to-point communication systems.

Network services typically require the determination of user identity to provide corresponding access permissions. Impersonating legitimate users to enter a network through deception or theft is a common network attack. This includes information gathering attacks, password attacks, and vulnerability attacks. Identity attacks involve attackers using a large number of probing methods to scan vulnerabilities in existing network systems, scan available system permissions, and scan the services provided by the system, and capture system vulnerabilities. They then steal user account and password information, and use public protocols and tools to illegally collect, tamper with, and modify useful information on various host systems.

1.3 Denial of Service (DoS) Attacks

Denial of Service (DoS) attacks, a type of attack, involve sending a certain sequence and quantity of packets to a network system, causing a large number of requests for replies to flood the network server, thus consuming a large amount of network system resources or network bandwidth. This can lead to the network system or system being overloaded and unable to handle the load, resulting in the system being paralyzed, stopping normal network services, and causing systems to crash or become unresponsive.

1.4 Attacks on Firewalls

Generally, firewalls are very resistant to attacks and are not easily breached. However, there are always unavoidable defects in the design and implementation of firewalls, which can lead to attacks on the firewall.

With the rise of the internet and the rapid development of network technology, direct attacks and illegal bypassing of firewalls have brought severe threats to computer network security. Such as address spoofing and TCP sequence collaboration attacks, as well as attacks that bypass firewall authentication by using FTP-pasv. For example, the direct attack on the Denial of Service vulnerability of the Cisco PIX firewall.

2. Introduction to Intrusion Detection Technology

Intrusion detection is the process of collecting important files and critical data from computer networks or systems, analyzing them, and then detecting whether there are violations of security policies and signs of attacks present in the network or system. This process involves alerting and blocking behaviors that may threaten the confidentiality, integrity, and availability of the system.

Common analysis techniques for intrusion detection include pattern matching, anomaly detection, and integrity analysis: Pattern matching involves examining every data packet on the network to find network attack characteristics, extracting a set of bytes of the same length from the header of suspicious data packets, and comparing the two sets of bytes. If the two sets of bytes are the same, the attack characteristic is detected; the process is repeated until all data bytes are compared with the attack characteristic. Anomaly detection involves collecting historical data on network operations and establishing a "normal activity profile" for network normal activities. By comparing the current network activity with the "normal activity profile," it detects whether the network deviates from the normal behavior pattern, thereby determining whether an intrusion has occurred. Integrity analysis involves checking whether the content, directory, and attributes of files in the network are in the correct state and whether they have been altered. This detection technology can detect any change in the file, and it is particularly effective in detecting Trojanized applications that have been tampered with.

Intrusion detection methods can be divided into host-based and network-based detection: the data analyzed by a host-based system includes events from the computer operating system, application events, system calls, port calls, and security audit logs, and it compares these logs with an internal database of known attacks and collects them in its own special log for administrators to analyze. Network-based intrusion detection scans network packets at the router or host level, reviews packet information, and records suspicious packets in a special file. Based on these suspicious packets, network-based intrusion detection scans its own known network attack feature database and assigns severity levels to each packet, allowing members of the security group to further investigate these anomalous characteristics.

3. Application of Intrusion Detection Technology in Computer Network Security Maintenance

Intrusion Detection primarily achieves the maintenance of computer network security by performing the following tasks: monitoring and analyzing user and system activities; auditing system construction and vulnerabilities; identifying activity patterns indicative of known attacks and alerting relevant individuals; statistical analysis of abnormal behavior patterns; assessing the integrity of critical systems and data files; auditing and managing operating system audit trails, and identifying user behavior that violates security policies. A network-based Intrusion Detection System (IDS) typically has a multi-layered architecture consisting of three components: Agent, Console, and Manager. Its basic working principle is that the Console collects information from the agents, displays information the attacks, and allows you to configure and manage the agents under a manager. The Agent monitors network data packets in its segment and sends any detected attacks and all related data to the manager. The Manager centrally manages logs and alarms, displays detected security information and detailed intrusion alerts (such as the IP address and destination IP address of the attacker, the destination port, attack characteristics, current user, and process), responds to configuration and attack warnings, executes commands issued from the console, and passes attack alerts from the agents to the console to complete the entire intrusion detection process.

Specific application analysis follows:

3.1 Information Collection

The first element of intrusion detection is data. Data sources can be categorized into four types: system and network log files; unexpected changes in directories and files; unexpected behavior in program execution; and intrusion information in physical form. During application, information collection requires deploying one or more IDS agents in each subnet. Depending on the network structure, the data collection part is divided into different connection forms. If the subnet is connected via a switch, the core chip of the switch usually has a debugging port. Users can connect the IDS system to this port. The intrusion detection system can then be placed at the critical entry or exit points of the data flow, where it can obtain almost all critical data.

At the same time, the collection of information from several different critical points in a computer network system, in addition to setting up network packet capture according to the object to be detected, and expanding the detection range as much as possible.

Additionally, there is another weak point: it is likely that no suspicion can be raised from information originating from a single object. This requires that intrusion detection information collection should be from the perspective of information originating from several.

An in-depth analysis of inconsistencies in the information of the object is the best identifier for judging intrusions or suspicious behavior. Compared to the entire network, intrusions are, by nature, a minority behavior.

Therefore, for a few anomalous data points, they can be isolated to form a data group for centralized processing, enhancing the targetedness of intrusion analysis. Thus, based on outlier mining is an important means of information collection in intrusion detection technology, and its basic operation is to extract from a large amount of complex data the representative data with significant differences from the normal data patterns in a small portion of anomalous data for separate processing. This overcomes the problem of high false alarm rates in anomaly detection caused by incomplete normal mode training samples.

3.2 Information Analysis

For the above collected information, the data is analyzed using pattern matching and anomaly detection analysis modes to discover behaviors that violate security policies, and then send them to the manager.

Designers need to have a very deep and clear understanding of various network protocols, system vulnerabilities, and other behaviors, and then develop corresponding security rule sets and security strategies. They then establish misuse detection models and anomaly detection models, allowing machines to simulate their analysis process to identify known attack characteristics and abnormal behaviors. Finally, they form alarm messages based on the analysis results and send them to the control center. Additionally, for TCP/IP networks, network probing engines are also important means of intrusion detection. The network probing engine acts like a sensor, dynamically monitoring all data packets flowing on the network using a pass-through listening method, and detecting various events according to user-defined strategies, reporting them to the control center, and allowing the control center to issue alarms and locate them.

3.3 Information Response

The primary task of IDS is to make appropriate responses to intrusion behaviors. Its process involves detecting the local network segment based on data analysis, identifying hidden malicious intrusions within each data packet, and promptly responding to detected intrusions. This includes alerting/notifications such as alerting the console, sending an email to the security administrator, sending an SNMP trap, viewing real-time sessions, and notifying other consoles; recording the scene such as recording event logs and the entire session; and taking security response actions such as terminating intrusion connections, adjusting network device configurations, and executing specific user response programs.

3.4 Integration of Intrusion Detection Technologies and Firewalls

A firewall is a perimeter security mechanism that can only control access at the application layer or network layer, and cannot effectively monitor the internal network to a great extent.

Therefore, network intrusion behaviors can easily bypass firewalls through protocol tunnels, posing a threat to network security. Thus, firewalls cannot completely ensure information security. Therefore, in practical applications, we can design a collaborative application model for intrusion detection and firewalls to achieve a relatively effective security protection system.

First, a firewall or intrusion detection system opens an interface for the other party to use. Both parties communicate according to a fixed protocol, and they can agree in advance and set the communication port.

Secondly, the firewall filters the data packets that pass through by parsing them and comparing them with the predefined rules, thereby filtering out a portion of the data packets from non-approved users.

Finally, for the data packets bypassing the firewall by unauthorized users, the intrusion detection system customizes rule sets based on known intrusion characteristics to detect and respond to network attacks that match the defined rules, while the user takes measures to handle the intrusion attack.