保护网络

A network connects devices so they can share data - and every connection is a possible way in. You must know the classic network attacks and the tricks behind them.

• ARP poisoning 地址解析投毒 - the address resolution protocol (ARP) 地址解析协议 pairs IP addresses with hardware MAC addresses 物理地址. An adversary sends fake ARP messages so traffic meant for the target flows to the adversary instead. This is an on-path attack 中间人攻击 (also called man-in-the-middle): the adversary secretly sits between two parties, reading and even altering their messages.
• MAC flooding 物理地址泛洪 - many fake source addresses may exhaust a switch 交换机 forwarding table. Some switches then flood unknown-destination frames to other ports, which may enable eavesdropping 窃听. Known-destination traffic and configured protections can behave differently; capturing all traffic is not guaranteed.
• DNS poisoning 域名投毒 - planting a fake record on a domain name system (DNS) 域名系统 server redirects users to a malicious site to steal credentials (credential harvesting 凭据收集).
• Smurf attack - sending ICMP echo requests to a network's broadcast address with the victim's address forged (spoofed) as the source, so every device on that network replies to the victim. It is a denial of service (DoS) 拒绝服务 attack; when many machines attack at once it becomes a distributed denial of service (DDoS) 分布式拒绝服务.

Adversaries exploit weak networks to flood, map, or spoof devices. A physical data port with no port security lets an attacker plug in; an open port lets them install a rogue access point 非法接入点 that bypasses the firewall entirely. We rate network risk by impact and by how much skill the exploit needs.

To find weaknesses before an adversary does, organisations run an automated vulnerability scanner 自动漏洞扫描器: a tool that checks networks, devices, and applications against a database of known vulnerabilities, then produces a report listing each one found, how severe it is, and a recommended mitigation 缓解措施. Fixing the highest-severity items first is a core part of managing network risk.

Good network security starts with written policies that set a minimum standard: a router security policy and switch security policy ban local accounts and require port security; a VPN policy sets authentication rules and forbids split tunneling 分离隧道; and a wireless security policy requires strong encryption and authenticated access.

For wireless networks, use authenticated access and suitable encryption, such as WPA3 Wi-Fi 保护接入第三代 where supported; avoid obsolete WEP and original WPA. Hiding the network name does not stop beacon transmissions or reliably conceal the network. Signal-strength limits and MAC filtering are supplementary measures: radio reception can extend beyond a building, and an observed device address can be spoofed.

Network segmentation 网络分段 divides a network into controlled sections, often using subnets 子网. Enforced filtering between sections can limit access and incident spread; an address boundary alone does not guarantee isolation.

A key pattern is the screened subnet 屏蔽子网 (also called a DMZ 隔离区). It sits between the public internet and the private internal network, holding an organisation's public-facing servers in a lower-security zone - separated from the sensitive internal systems.

Segments can also be built with subnetting (by IP address) or VLANs 虚拟局域网 (logically separating devices on the same switch). Each segment can then get its own security policy - higher-security and lower-security zones.

A firewall 防火墙 allows or denies traffic entering or leaving a network. There are several kinds:

• Stateless 无状态 - filters on packet headers alone (IP, port, protocol).
• Stateful 有状态 - also tracks the state of each connection for finer control.
• Next-generation (NGFW) - adds advanced features like intrusion prevention and deep packet inspection.

A firewall follows an access control list (ACL) 访问控制列表 - an ordered set of rules. Rules are checked in order, and the first match wins, so the order of rules changes which traffic gets through. Each rule specifies a direction, a thing to filter by (IP, port, service), and an action (permit or deny).

Worked example. A firewall has Rule 3: DENY TCP 443 from 192.168.*, and lower down Rule 7: ALLOW TCP 443 from ALL. A user at 192.168.45.37 cannot reach port 443 - even though Rule 7 would allow them - because Rule 3 matches first, and the first match wins. If this specific host should have HTTPS access, add an ALLOW for 192.168.45.37 above Rule 3 while retaining the broader DENY. Moving ALLOW-from-ALL above that DENY would allow the whole range. Choose rule order and scope to match the intended policy.

Firewalls belong at every point where data crosses between zones - at each network segment and at every gateway to the public internet.

When prevention fails, detection takes over. Automated tools read the log files 日志文件 that record network activity:

• a network intrusion detection system (NIDS) 网络入侵检测系统 analyses traffic and raises an alert, but does not block;
• a network intrusion prevention system (NIPS) 网络入侵防御系统 can also stop an attack by closing ports or blocking addresses;
• a security information and event management (SIEM) 安全信息与事件管理 system gathers data from many sources to spot patterns.

There are two detection methods. Signature-based 基于特征 detection compares traffic to a database of known attack signatures - often efficient, but may miss activity without a recognised pattern. Anomaly-based 基于异常 detection compares traffic to a normal baseline 基线 and flags anything unusual - it can catch novel attacks but needs more resources and raises more false alarms. A hybrid approach combines both.

Examining captured traffic (packet-capture files), analysts hunt for network-based indicators of compromise 网络入侵指标 in the source and destination IP addresses, ports, and protocols. Four common ones: connections to known-malicious IP addresses, unauthorized network scans (an outsider probing your ports), unusual spikes or slowdowns in traffic, and mismatched port-application traffic (for example, non-web traffic flowing over port 80). These complete the host-, file-, and behaviour-based indicators a single device logs.

AI, thresholds, and alert fatigue

A medium network logs millions of events a day - far more than any team can read - so organisations train AI models to sort likely-malicious patterns from normal ones. These models are probabilistic 概率的: a detector can report a percentage score for how suspicious an event appears. The course describes this as a likelihood; a reported percentage should not automatically be treated as a perfectly calibrated probability.

The organisation then sets a threshold 阈值 - the likelihood at which an alert fires - and that choice is a genuine trade-off:

• set the threshold too high and real attacks slip through undetected;
• set it too low and the team is overwhelmed with false alerts.

Try it — apply an explicit threshold. In this invented teaching dataset, higher scores mean more suspicious. Alert when score is greater than or equal to the threshold. Investigation has established the outcomes.

At thresholds of 70% and 30%, list the alerted events, count normal events alerted, and count attacks missed. Include scores equal to the threshold.

Worked reasoning. At 70%, A and B alert: B is one normal event alerted, while attacks C and E are missed. At 30%, A, B, C, D and E alert: B and D are two normal events alerted, and no attack in this sample is missed. Lowering the threshold catches C and E, but adds normal D to the review queue. Even a high threshold can produce a false alert. These invented scores and investigated outcomes are not measured detector accuracy or a guarantee about future events.

Capacity transfer. Suppose the team can review only two alerts in the period. The 70% setting fits that capacity but misses two known attacks; the 30% setting produces five alerts and exceeds capacity, although it catches all three attacks in this sample. Neither is automatically best. Weigh the harm of misses, the cost of false alerts and investigation capacity. Priorities and other controls matter too; a threshold alone is not a complete defence.

Too many false alerts cause alert fatigue 警报疲劳: responders get so used to false positives that they start assuming an alert is false before investigating it - so a real attack, when it finally comes, is waved away. This is exactly why a low false-positive rate matters: signature-based detection often has fewer false alarms, while anomaly-based detection can flag unfamiliar activity but may add false alarms. Actual results depend on the signatures, baseline, thresholds and traffic; neither method guarantees detection.

• For firewall-ACL questions, read the rules top-to-bottom and stop at the first match - a Deny rule above an Allow blocks the traffic even though the Allow exists lower down.
• Pair each attack with its tell-tale sign: ARP poisoning = one IP with two MAC addresses; MAC flooding = a surge of new MAC addresses; DNS poisoning = an unexplained drop in web traffic.
• Read packet captures for network-based IoCs: known-malicious IPs, unauthorized scans, traffic spikes/slowdowns, and mismatched port-application traffic.
• Run vulnerability scanners to find known weaknesses proactively, and fix the highest-severity findings first.
• Signature-based matches known indicators; anomaly-based compares a baseline. Discuss coverage, false alerts and resource costs in the scenario; neither guarantees detection.
• A screened subnet / DMZ holds public-facing servers between the internet and the private network - name it whenever a question separates public services from internal data.
• WPA3 is the strong wireless encryption; WEP and original WPA are insecure.