Network attacks, security breaches, hacks and things similar tend to wreck the system with varied intensities. If you are a system administrator, despite every possible security measure in place, you’d surely be aware of the damage that an attack can cause on your server or an entire network.
网络攻击，安全漏洞，黑客和类似的事情往往会以不同的强度破坏系统。 如果您是系统管理员，则尽管已采取了所有可能的安全措施，但您一定会意识到攻击可能会对服务器或整个网络造成的损害。
Lets take a look closer into what DDoS, Network attacks and Security breaches actually are and what are the possible ways to avoid, detect and recover from an attack.
让我们仔细研究一下真正的DDoS，网络攻击和安全漏洞，以及避免，检测攻击并从攻击中恢复的可能方法是什么。
网络攻击实际上意味着什么？ (What does a Network Attack actually imply to ?)
One thing is for sure that a network attack is initiated with sole criminal intentions. It usually occurs when an attacker or a hacker tries to compromise the network using various means and technologies. Such an attack isn’t usually an accident but a planned, executed attempt to get access to corporate networks for stealing the data, then damaging the data on the system and corrupting it to an extent that nothing can be retrieved by the authorized users.
可以肯定的是，网络攻击是出于唯一的犯罪意图而发起的。 当攻击者或黑客试图使用各种手段和技术来破坏网络时，通常会发生这种情况。 这种攻击通常不是偶然的，而是有计划的，有计划的执行的尝试，目的是访问公司网络以窃取数据，然后损坏系统上的数据并将其破坏到一定程度，以使授权用户无法检索到任何内容。
One form of such an attack is External attacks, carried out by fraudsters who are external to the targeted corporate network. A fair amount of knowledge, planning and procedures are required before the actual attack to be initiated. Such fraudsters spend days or even months scanning and gathering information about the systems.
这种攻击的一种形式是外部攻击 ，由目标公司网络外部的欺诈者进行。 在发起实际攻击之前，需要大量的知识，计划和程序。 这样的欺诈者花费数天甚至数月来扫描和收集有关系统的信息。
Structured external threats are usually posed by criminal hackers who are well aware about their intentions and the damage that can be caused. To a large extent, these fraudsters are perfectly skilled on network design, know various ways to by-pass security measures, Intrusion Detection Systems (IDSs), access procedures, and other tools.
结构化的外部威胁通常是由犯罪黑客构成的，他们非常了解其意图和可能造成的破坏。 这些欺诈者在很大程度上在网络设计方面非常熟练，知道各种绕过安全措施，入侵检测系统(IDS)，访问过程和其他工具的方法。
Unstructured external threats are usually posed by inexperienced fraudsters, but are aware that it can surely cause some damage to the system. These inexperienced attackers usually make use of various cracking or scripting tools that are easily found over the Internet, and use it for an attack over the network.
缺乏经验的欺诈者通常会带来非结构化的外部威胁 ，但请注意，这肯定会对系统造成一定的损害。 这些经验不足的攻击者通常利用各种易于在Internet上找到的破解或脚本工具，并将其用于网络攻击。
Remote external attacks, this is something that targets systems and services that a particular service provider offers to the public. Such an attack can even target services that are offered to internal users, or even at the brute force password authenticated systems.
远程外部攻击是针对特定服务提供商向公众提供的系统和服务的。 这样的攻击甚至可以针对提供给内部用户的服务，甚至针对经过暴力密码验证的系统。
Local external attacks are initiated from shared computing facilities to gain an access to the system.
本地外部攻击是从共享计算设施发起的，以获取对系统的访问权限。
Attacks initiated from within the system, this is a threat posed to every organization, service provider company etc. It is at-times initiated by an unhappy customers using the system or even an internal employee. These attackers have certain level of access to the system and try to shield the attack showing themselves as a usual computing process. Hence it is usually difficult to identify such an attack from within way before any damage is caused to the system.
从系统内部发起的攻击，这是对每个组织，服务提供商公司等构成的威胁。它有时是由不满意的客户使用系统甚至是内部员工发起的。 这些攻击者具有一定级别的系统访问权限，并试图屏蔽攻击，将其显示为通常的计算过程。 因此，通常很难在对系统造成任何损害之前从内部识别这种攻击。
Various forms of attacks can be found in the industry, sometimes attackers may use multiple ways to compromise pre-existing network securities with an intention of gaining access. Footprinting is usually the initial stage for hacking into a corporate network. At this stage attacker’s build a network map comprising of various details such as OS’s, applications and address ranges used, and to trace a possible access from an open port. Port scanning is done to gather information about network services running over the targeted network with an attempt to identify any open ports on the system. They may even user Enumeration for gathering information on applications and hosts on the network, and on the user accounts utilized on the network. This is usually successful in networks that contain unprotected network resources and services. Then an Access attack is initiated with an intention to exploit a security weakness and try to gain an access to a system or the network. In this attempt Trojan horses and password hacking programs are usually to serve the purpose. Once the target network is compromised and the hacker(s) gain an access to the system data modification or deletion of data can be carried out and network resources can be added, modified or removed.
在行业中可以发现各种形式的攻击，有时攻击者可能会使用多种方式来危害已有的网络安全，以获取访问权限。 足迹通常是入侵企业网络的初始阶段。 在此阶段，攻击者构建了一个网络地图，其中包括各种详细信息，例如操作系统，应用程序和所使用的地址范围，并跟踪从开放端口的可能访问。 进行端口扫描是为了收集有关在目标网络上运行的网络服务的信息，以尝试识别系统上任何打开的端口。 他们甚至可以使用用户枚举来收集有关网络上的应用程序和主机以及网络上使用的用户帐户的信息。 这在包含不受保护的网络资源和服务的网络中通常是成功的。 然后发起访问攻击，目的是利用安全漏洞并尝试获得对系统或网络的访问权限。 在这种尝试中，特洛伊木马和密码黑客程序通常可以达到目的。 一旦目标网络受到攻击，黑客就可以访问系统数据，则可以执行数据修改或删除操作，还可以添加，修改或删除网络资源。
One of the other common typed os attacks is the Unauthorized privilege escalation. In this type of threat, Privilege escalation occurs when an intruder attempts to gain a higher level of access such as administrative privileges to gain control of the network system. Hackers can also implement mechanisms that allows them grant access at sometime in future.Then, Backdoors are installed to gain an easy access to the system at sometime later. If you realise the fact that your system to be compromised, it is usually advisable to restore the system from a backup which you know to be secure and free from backdoors.
其他常见的OS攻击之一是 未经授权的特权升级 。 在这种类型的威胁中，当入侵者试图获取更高级别的访问权限(例如，管理权限以获取对网络系统的控制权)时，就会发生特权升级。 黑客还可以实施允许他们在将来的某个时间授予访问权限的机制。然后，安装后门程序以在以后的某个时间轻松访问该系统。 如果您意识到您的系统将受到威胁，通常建议从已知安全且无后门程序的备份中还原系统。
网络攻击的常见类型是什么？ (What are the Common Types of Network Attacks ?)
– Eavesdropping : In such an attack, fraudsters keeping monitoring or listening to the network traffic in transit. After a close analysis every possible unprotected data is traced and documented. Then, using a sniffing technology to eavesdrop on an Internet Protocol (IP) based network to capture traffic in transit. IP address spoofing : This is a common technique used by attackers, in this type the source IP address is assumed by the attacker and shielded as if the IP packets were from a legitimate IP address. The sole purpose of IP spoofing attack is to identify computers on a network. Fraudsters usually monitor and analyze traffic before initiating an attack, this is known as Sniffing. Many sniffing tools are readily available over the web, popularly known as sniffers or protocol analyzers and used for gathering the intended data before the attack. These tools helps the attackers gather specific network information, such as passwords and other user credentials. – Password attacks have a sole purpose of finding out the access passwords of a system. Its algorithm runs through through different permutations and combinations until the right password is matched. Once the login credentials are known, they can easily force an attack on the corporate networks. Few may even raise an attack using a combination of dictionary or brute force attacks for forcefully getting an access to resources that too at a similar access level as that of a legitimate user. – Brute force attack : Many webmasters or even users would be aware of this type of threat posed to any system that is connected to the Internet. Learn more about What is brute force attack and how to prevent this attack? In this a simple script is used to crack passwords of a targeted system. It may even compromise networks that utilize Simple Mail Transfer Protocol. – Denial of Service (DoS) or DDoS (Distributed Denial of Service) : In this type of an attack, invalid data is set to the target system causing to flood it with multiple requests to an extent which it isn’t capable to handle, hence causing to get into a hang state. Learn more about (D)DoS Attack (Denial-of-service) . TCP attack is one of the very common methods of DoS. When DoS is targeted over an entire network it is known as the DDoS. Here the intensity of the attack is wide spread and targeted over a single network from multiple locations. It is one of the most difficult attacks to handle as the administrators find a tough time segregating an attacker system from legitimate users system. – A man-in-the-middle (MITM) attack : In this type of threat an attacker is able to barge into the system and place itself between the communication channel. In this the hacker is aware about the data that is exchanged and at-times even have control over it. Need not mention the data that can be leaked without your knowledge.
–窃听 ：在这种攻击中，欺诈者不断监视或侦听传输中的网络流量。 在仔细分析之后，将跟踪并记录所有可能的未保护数据。 然后，使用嗅探技术窃听基于Internet协议(IP)的网络以捕获传输中的流量。 IP地址欺骗 ：这是攻击者常用的技术，在这种类型中，源IP地址由攻击者采用并被屏蔽，就像IP数据包来自合法IP地址一样。 IP欺骗攻击的唯一目的是识别网络上的计算机。 欺诈者通常会在发起攻击之前监视和分析流量，这被称为嗅探 。 许多嗅探工具很容易在Web上获得，通常被称为嗅探器或协议分析器，用于在攻击之前收集目标数据。 这些工具可帮助攻击者收集特定的网络信息，例如密码和其他用户凭据。 –密码攻击的唯一目的是找出系统的访问密码。 它的算法贯穿于不同的排列和组合，直到匹配正确的密码为止。 一旦知道登录凭据，它们就可以轻松地对公司网络发起攻击。 很少有人甚至可以结合使用字典或蛮力攻击来发动攻击，以强行获得对资源的访问权限，而该访问权限的访问级别也与合法用户的访问级别相似。 –暴力攻击 ：许多网站管理员甚至用户都将意识到对连接到Internet的任何系统构成的这种威胁。 了解有关什么是蛮力攻击以及如何防止这种攻击的更多信息？ 在此，使用一个简单的脚本来破解目标系统的密码。 它甚至可能损害利用简单邮件传输协议的网络。 –拒绝服务(DoS)或DDoS(分布式拒绝服务) ：在这种类型的攻击中，无效数据被设置到目标系统，导致其无法处理的情况下被多个请求淹没，因此导致进入挂起状态。 了解有关(D)DoS攻击(拒绝服务)的更多信息 。 TCP攻击是DoS的非常常见的方法之一。 当DoS定位于整个网络时，称为DDoS。 在这里，攻击的强度广泛分布，并且针对来自多个位置的单个网络。 由于管理员发现很难将攻击者系统与合法用户系统隔离开来，因此这是最难处理的攻击之一。 – 中间人(MITM)攻击 ：在这种威胁中，攻击者能够闯入系统并将自己放置在通信通道之间。 通过这种方式，黑客可以知道所交换的数据，甚至可以对其进行控制。 无需提及在您不知情的情况下可能泄漏的数据。
如何避免网络和其他安全威胁？ (How to Avoid Network and other Security Threats?)
IDS ie. Intrusion Detection System is supposed to be an ideal method for protecting a network against attacks. Every type of attack must be logged and analyzed to identify the posed risks to a network or a particular system. This usually helps anticipating the upcoming threats and prepare you to tackle or avoid it.
IDS即 入侵检测系统被认为是保护网络免受攻击的理想方法。 必须记录并分析每种类型的攻击，以识别对网络或特定系统造成的风险。 这通常有助于预测即将到来的威胁，并为您解决或避免它做好准备。
An Incident Response Plan is usually helpful with counteracting in case of an attack. A strategically planned process flow chart can help dealing with the incident in a short span of time and avoiding any serious damage to the network and the systems.
突发事件响应计划通常有助于抵御攻击。 战略规划的过程流程图可帮助在短时间内处理事件，并避免对网络和系统造成任何严重损害。
If you have enough man-power, you may even setup an Incident response team comprising of highly skilled members who would be responsible for managing the situation in event of an attack. The team would not only protect the system from threats but would also play a key role in recovering from an attack in the shortest time.
如果您有足够的人力，甚至可以组建由高技能成员组成的事件响应团队，他们将负责在发生攻击时管理情况。 该团队不仅将保护系统免受威胁，而且还将在最短的时间内从攻击中恢复中发挥关键作用。
分析攻击 (Analyzing an Attack)
There are multiple ways how intruders and attackers can compromise a network.
入侵者和攻击者可以通过多种方式来破坏网络。
– Cracking In progress attacks : Hackers and individuals with illegal intentions constantly try different methods of decrypting confidential encrypted data, evading evading authentications to gain an access to a system or into a network, this is referred as cracking. Cracking in progress attacks imply to the risks when the illegal activity is in process over a network and that the attacker is still within the system. If s/he isn’t active at a given point of time, there are chances of them returning.Scanning the systems and network using various tools should help identify the event of a compromised security. In event of a breach, it is necessary to be prepared for any unexpected incident on your system. Usually an attacker would trespass the installed security of a system, leave a backdoor, shield their activities and leave for that moment, so that they may return whenever they wish to in the past. Its a bit difficult to encounter a cracking in progress attack over a network. Though if you do identify an attacker to be active over your network, it is necessary to identify it and block them from doing any further activity over the system. Below are couple of options you may choose from :
–进行中的破解攻击 ：黑客和有非法意图的个人不断尝试使用不同的方法解密机密加密数据，逃避规避身份验证以获得对系统或网络的访问权，这称为破解。 当通过网络进行非法活动并且攻击者仍在系统内时，进行中的破解攻击意味着存在风险。 如果他/她在给定的时间未处于活动状态，则有可能他们返回。使用各种工具扫描系统和网络应有助于确定安全性受到破坏的事件。 发生违规时，有必要为系统上的任何意外事件做好准备。 通常，攻击者会越过系统已安装的安全性，离开后门，掩盖其活动并暂时离开，以使他们可以在过去希望的任何时候返回。 在网络上遇到正在进行的破解攻击有点困难。 尽管如果您确实确定攻击者正在网络上活动，则有必要对其进行识别并阻止他们在系统上进行任何进一步的活动。 以下是您可以选择的几个选项：
* Restrict the attacker from carrying out any activities further over your system or network by blocking the connection that s/he has established with your system.
*通过阻止攻击者与您的系统建立的连接，限制攻击者进一步在您的系统或网络上进行任何活动。
* Monitor the activities of the hacker
*监控黑客的活动
– Denial of Service attacks: The sole aim of a DoS attack is to restrict legitimate users from accessing the services over a network.Varied types of DoS attacks are found to be used by attackers, below listed are couple of those .
–拒绝服务攻击 ：DoS攻击的唯一目的是限制合法用户访问网络上的服务。发现各种类型的DoS攻击被攻击者使用，下面列出了几种。
– Flooding the network with invalid data to an extent where the legitimate users fails to establish a connection and proceed with their activity.
–在合法用户无法建立连接并继续其活动的程度上，用无效数据泛洪网络。
– Flood the network with invalid service requests until the host offering the services is inefficient with serving to it. In this case, the network gets overloaded with incoming requests and goes into a hang state.
–向网络充斥无效的服务请求，直到提供服务的主机无法有效地为其提供服务为止。 在这种情况下，网络会因传入请求而过载，并进入挂起状态。
– Communication between hosts and clients can be broken by altering the system configuration settings or even breaking it entirely.
–可以通过更改系统配置设置甚至完全断开主机和客户端之间的通信来中断它。
Some bold attackers may even indulge into carrying out a large volume of unauthorised DNS dynamic updates via the DHCP server. With DNS DoS attacks the DNS servers are targeted by sending constant requests to an extent that it gets flooded resulting in the system failure from responding to any requests made to it. If the attack lasts for too long, the entire system tends to shut down eventually.
一些大胆的攻击者甚至可能会沉迷于通过DHCP服务器执行大量未经授权的DNS动态更新。 借助DNS DoS攻击，DNS服务器将不断发送请求，使其泛滥成灾，从而导致系统无法响应对其发出的任何请求，从而成为DNS服务器的目标。 如果攻击持续时间太长，则整个系统往往最终会关闭。
什么是DoS攻击类型？ (What are the Types of DoS Attacks ?)
Network scanning: This is when a fraudster has already gained an access into the system and scans it to grab information abotu the services and applications running over the network. In this the prime motive is to identify open ports within the system.The first action to be taken incase you identify the breach is to instantly restrict the access to your system.
网络扫描 ：这是欺诈者已经获得对系统的访问权并对其进行扫描以获取有关网络上运行的服务和应用程序的信息的时候。 这样做的主要目的是识别系统中的开放端口。如果您发现违规行为，首先要采取的措施是立即限制对系统的访问。
Smurf attack : In this type of DoS, the Internet Control Message Protocol (ICMP) is the target and attackers try to compromise it. Following are certain measures that one can use inorder to disable the attack: – Disable hosts from responding to ICMP packets transmitted to a broadcast address. – Disable IP broadcast traffic on perimeter routers. – Activate ingress filtering on perimeter routers to stop spoofed traffic from moving over the network.
蓝精灵攻击 ：在这种DoS中，Internet控制消息协议(ICMP)是目标，攻击者试图对其进行破坏。 以下是可以用来阻止攻击的某些措施：–禁止主机响应发送到广播地址的ICMP数据包。 –在外围路由器上禁用IP广播流量。 –在外围路由器上激活入口过滤，以阻止欺骗性流量通过网络移动。
SYN flooding attacks : In this type of DoS attack, the system resources are targeted and are utilized to an extent until it gets exhausted. To carry out such an attack SYN packets are used. Following are couple of ways to restrict SYN flooding attacks :
SYN泛洪攻击 ：在这种类型的DoS攻击中，以系统资源为目标并在一定程度上加以利用，直到耗尽为止。 为了进行这种攻击，使用了SYN数据包。 以下是限制SYN泛洪攻击的几种方法：
- Activate ingress filtering on service provider routers. 在服务提供商路由器上激活入口过滤。
- The firewall must be configured to block SYN attacks. 必须将防火墙配置为阻止SYN攻击。
- Increase the size of TCP connection attempts. 增加TCP连接尝试的大小。
- Reduce the time out setting for TCP connection attempts. 减少TCP连接尝试的超时设置。
Unexpected Files found at certain locations within the system : This could be a serious pointer towards a possible attack that has happened without your knowledge. This is something that needs to be addressed at the earliest as there are chances the attacker might return in the near future.
在系统中某些位置发现意外的文件 ：这可能是严重的指针，指出了您不知情的情况下可能发生的攻击。 这是需要尽早解决的问题，因为攻击者有可能在不久的将来返回。
调查和收集有关攻击的证据 (Investigation and Collection of Proofs with reference to Attacks )
It is necessary to make a list of evidences that point towards a possibility of an attack.
Check for the below information
检查以下信息
- – Application event log information. –应用程序事件日志信息。
- – System event log information. –系统事件日志信息。
- – Security event log information. –安全事件日志信息。
- – All other machine specific event logs, such as DNS logs, DHCP logs, or File Replication logs. –所有其他计算机特定的事件日志，例如DNS日志，DHCP日志或文件复制日志。
Logs describing possible malicious activities:
描述可能的恶意活动的日志：
- – Modifies, corrupted, or deleted files. –修改，损坏或删除文件。
- – All unauthorized processes running. –所有未经授权的进程正在运行。
Places where you can get the necessary information about a network attack are :
可以获取有关网络攻击的必要信息的地方是：
– System logs
–系统日志
– Network logs
–网络日志
– System state
–系统状态
– Network state
–网络状态
中和网络攻击者 (Neutralizing Network Attackers)
Administrators can choose amongst multiple techniques to checkmate attacks carried out by fraudsters. Following are couple of those :
管理员可以从多种技术中进行选择，以核实欺诈者所进行的攻击。 以下是其中的几个：
- – Preparing an access control list and implementing it over firewalls and routers. –准备访问控制列表并通过防火墙和路由器实施它。
- – Taking the Server offline incase of an attack –遭受攻击时使服务器脱机
- – Disconnect the host being attacked from the network –断开被攻击主机与网络的连接
- – Taking the site down from the Internet –从Internet断开站点
Furthermore, it is essential to analyze the attack even after it has been pacified. This usually seems useful and helps you gather useful information that can help you prepare for similar attacks for future.
此外，即使已经平息了攻击，也必须分析攻击。 这通常看起来很有用，并且可以帮助您收集有用的信息，这些信息可以帮助您为将来的类似攻击做准备。
You may even use a sniffer over the network that can identify any strange activity within a network.
您甚至可以在网络上使用嗅探器，以识别网络中任何奇怪的活动。
如何确定您的系统是否受到安全性的威胁？ (How to identify whether your system has been compromised of security?)
Even a layman would realise that a system security to be compromised, very true. But there is something more to look for. As stated earlier, an attacker would leave a backdoor so that it can be used at a later stage.
即使是外行，也会意识到系统安全性将受到损害，这是非常正确的。 但是还有更多需要寻找的东西。 如前所述，攻击者会留下后门，以便以后可以使用。
What most aren’t aware are the vulnerabilities that hackers look for within a system for the purpose of exploiting it. Here is a list :
大多数人不知道的是，黑客为了利用系统而在系统中寻找的漏洞。 这是一个清单：
- – Mis-configured network service(s). –错误配置的网络服务。
- – Bugs in operating systems –操作系统中的错误
- – Application bug. –应用程序错误。
如何处理这些漏洞？ (How to deal with these vulnerabilities ?)
- – Disconnect the system from the network instantly –立即断开系统与网络的连接
- – Reporting the attack as soon as you encounter it to the network service provider. –遇到攻击后立即将其报告给网络服务提供商。
- – If you are well verse with server and network administration, creating an image of the system can help with for analyzing the attack. –如果您精通服务器和网络管理，则创建系统映像可以帮助您分析攻击。
– Validate the system for any modified components such as :
–验证系统中是否有任何已修改的组件，例如：
- – System files. –系统文件。
- – Data files. –数据文件。
- – Configuration files. –配置文件。
- – Configuration settings –配置设置
- – Deleted data. –删除的数据。
- You should use a clean install to recover a compromised system. 您应该使用全新安装来恢复受到威胁的系统。
Hardening the system security for possible threats.
加强系统安全性以应对可能的威胁。
()
如何检测网络入侵？ (How to Detect Network Intrusions ?)
It is advisable to monitor the network regularly for any possible intrusion. It’s rarely possible that you detect an intrusion in the first instance as hackers would usually camouflage themselves are seem to show processes that appear to be normal.But, you can look for any strange activities or strange files on your network.
建议定期监视网络是否存在任何可能的入侵。 由于黑客通常会伪装自己看起来似乎正常的进程，因此您很少有可能在一开始就检测到入侵，但是您可以在网络上查找任何奇怪的活动或奇怪的文件。
You can make use of logging information to detect an intrusion attempt.
您可以利用日志记录信息来检测入侵尝试。
– Intrusion detection system (IDS) logs: The IDS is designed to monitor the network scanning through every activity over a network. It’s algorithm analyzes suspicious data patterns. If it detects something spooky, it alerts the administrators instantly. It is one of the trusted precautionary mechanisms to protect a system from threats. This system can be implemented on either or on both ie. over the Network and/or on Hosts
–入侵检测系统(IDS)日志 ：IDS旨在监视网络中所有活动的网络扫描。 它的算法分析可疑数据模式。 如果发现怪异，则会立即向管理员发出警报。 它是保护系统免受威胁的值得信赖的预防机制之一。 该系统可以在一个或两个上实现。 通过网络和/或在主机上
– Firewall logs: System firewall can be configured in a way that it logs all the traffic that it detects suspicious and logs it for you. These logs are one of the trusted means to identify an intrusion attempt that has been failed.
–防火墙日志 ：可以通过配置系统防火墙的方式来记录所有检测到的可疑流量并为您记录。 这些日志是识别失败的入侵尝试的可信方式之一。
– Event logs : An Event Viewer is used to monitor every event that occurs on a server. These events are stored and categorized as system log, application log, and security log.
–事件日志 ：事件查看器用于监视服务器上发生的每个事件。 这些事件被存储并归类为系统日志，应用程序日志和安全日志。
– Syslog data : Syslog is specifically for Unix systems utilized.
– Syslog数据 ：Syslog专用于所使用的Unix系统。
Following these procedures can help protect your system from any threats and attacks. Though these are just counteracting measures that can be implemented. If an attack is of greater intensity, you don’t have any option other than taking the system offline for may couple of hours or days.
遵循以下步骤可以帮助保护您的系统免受任何威胁和攻击。 尽管这些只是可以实施的措施。 如果攻击强度更大，则除了将系统离线几个小时或几天之外，您别无选择。
翻译自: https://www.eukhost.com/blog/webhosting/checkmate-ddos-network-attacks-and-security-threats/
2189
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
