2020网络安全观察.pdf

2020 , fR8nP Rc 882 m,S,P.FV m,e-S mBQpJ, m6pP6, mEOL, mvW6, mBQpJ_k= mOL, mOLg2 mO_v;82 mOLJR0?.7 k-S m/7 me1$,v;k-S m.k-S m-fYme1$,v;k-S mJ.DOme1$,v;k-S m5FOTPSMPX )LG m* nq,OLg 5PQ 2 m C,i8WOLg2OPE6wKg)OLW)CLW-)x m C5B,;lGR,WOL,O_v;2 ?,J0 IV naE6 CONTENTS L5CzD 5C mOY-x6-B 5C mOY-_B,i-B 5C mOY-_B5B,;-B 5C mOY-naS,i-B 5C mOY-naS5B,;-B 5C m/C)Oa 5C m) $744 KO-B 5C m C 501 )x6 5C m)-Dk=OY-x6a 5C mRj.4rOg)LG 5C m.BF 58nP 5C m.JSBJ P7RisCOawRbCx 5C m(BGHZU P7RisCOawRbCx 5C mGFUDI )x6F 5C m.PJ%)5 )LWD 5C mSc?n/5 *P5 )JL(R_BnB-B 501 5C m C %P4 OY-FV.7 5C m%P4 8COY-FV.7wOLR_B;7x 5C mOY-YOwOLR_B;7x 5C mOY-(wOLR_B;7x 5C m5B,;8OY-YO7x 5C m RbOY-R_BwOLR_B;7x 5C mOY-)-BwOLR_B;7x 5CmCWTC0P=C0PxWOY-YO/QZwOLR_B;7x 5C m8(OY-mYO0 .wOLR_B;7x 5C m C8(OY-mYO0 . 5C mOY-C5)1$RR)wOLR_B;7x 5C m%P4 8COY-C5)0 .7wOLR_B;7x 5C mOY-x6mOY-YO-BwOLR_B;nEs0J:GJnEs0J:GJnEs0J:GJnEs0J,i%P4FV.7H-oya5.x 5C mOY-KooP/QZwOLR_B;7x 5C m7x 5C m7x 5C m,iOY-_B *1 -BZ(wOLR_B 7x 5C m,5BOY-_B *1 -BZ(wOLR_B 7x 5C m,iOY-naS *1 -BZ(wOLR_B 7 x 5C m,5BOY-naS *1 -BZ( 5C m CKp$.7 5C mKp$dOY-m5/-Bw501x 5C m6yB0Eg1Q 5C m(k= +uN*jEl3f,3ijEZ.l3M +u=hN4T*eojY=aIjEE*+%|%M+u/p%/C%H*%HNHW%Y| |rg*av3 2020A.h+jEC/%C6l3O%1N4B2l3?bAbHW%Y RQOmN4BH%Ql3tm%6g*8.M+u/p*NJzI8Y=%Ytm%6g*8v |*lqIMX% 2020*gw6:VNJzZ=l3r %HNJz.VqZ %O,.=%X):i%|g*NY*gw|g*%/.i3DX,vnv 8a 2lYC 2019A 2020AN6 Q CWE-79w74T l3NP6 Windows ms17-010 xM+HKM+u%|%Y6*gwd|+iN* NJzuZV4T/pRQOmNK 03|M+u%HHgl3Su/B/pED6,qA%u8vr ,t*/p6l3%-,B iVw%NB ;B2v1N4B23AQhO6 Z.O%C*%g*IQQQ,vnNuBiiD B2.u6*U3O%NgtNeC|g*A6l3,v*3DJ%Z6uO AIl3O-B ?,J0 14 :FV.7 IM+ulR IPl3+A-Qhm3*gwv3t*%ZX%H3%H%1uZ!u-.%u/pZ!t3-rv 5C 4.4mOY-naS,i-B 15 ?,J0 :FV.7 5C 4.5mOY-naS5B,;-B ?,J0 16 :FV.7 4.2m)FV.7 4.2.1m)F(dFV.7 RJz NVDNJzBAMCl3*B.A-Nlf8=H 2020A 12P 31N 2020AN6 ,v l3N%Y 14443%DlYC 2019A/g%y,!%HZK hfv(lDZFll3Om 2020AB2JT l3 AgentTeslaG%H%HT3il3|Ar juRDPi,q%gqO: AgentTeslaQC.P %DiN Maze3i% 6i%*3|k3i%l3eXD%lOm DDoSQl3*DR%o3vZ%f6v*6v 5C 4.22mSc?n/5 IoT )JL(R_B-BnB TOP10 8=.g WebM+u.h34%Z+A-3%H36ou3u%H3.wuNQt3N3U%Y%| %/.s6%/,w%H3i WebIQHW%Y%,J0 :FV.7 5C 4.30m Web OY-0rO56-B TOP 10 =R%3*l3 WebM+u.h%1uA%1tlA,v 5C 4.31mOY-0rO5B,;nB-B TOP10 4.4.2m DDoS : 4.4.2.1m DDoSOY-YO1$()G, DDoSM+uWN/pM+ur 2020A HX 2020A 12P|*lqIlJ+ DDoSM+uWN%Y 15.25%WM+uEr%Y ?,J0 38 :FV.7 38.65% TB% 2019A.PlYCM+uWN+5=% 16.16%M+uEr%y% 19.67%v CbQDR Om7E3U%YM+uWN/pM+ur+5=P%Zl3. 3UOmI; D;6S/pUII,qQhCUII.V OPM3DM+u|H+uZPMQH6/pq,s%NZNl3rZ3P,.O7x 39 ?,J0 :FV.7 X76%(.8OY-YO7x 5C 4.37m 1-4 RbOY-R_BwOLR_B;7x M+u?(l+A- 3*( DDoSM+u%H 18.16%l3M+u?(l3 5-10Gbps%o3HP-r%H-YCPv%l YC 2019AM+u?(l. 1-5G-q+-, 2020Al3M+u?(l3 5-50Gl3.-r+A-%A3-*(M +ul3 53.07% 5Gbps6 .iA6 ,v.O%d|)=|H+i3*Hf DDoSl3.iA,J0 :FV.7 5Gg5%l3 DDoSN7x 7x HX7x ?,J0 44 :FV.7 4.4.2.2m DDoSOY-x6-S M+uw74T-YC 2020A%Zl3M+uw74T%Y UDP Flood SYN Flood NTP Reflection Flood%6w7M+u-%E M+uWNl3 56v UDP Flood/p SYN FlooddbOm DDoSl3%ZM+uHZv(lD*Zl3Om ACK Flood i 2019Al3M+uWN-YC 14.9%+5= 2% NTP Reflection Flood.gnEs0J:GJnEs0J:GJnEs0J:GJ6mT 5G/pd|l3Dn.= IoT;66 Zn%6.GnM+uY7 IPl3M+ul3f/pXAiHl3v3tfI %3DnEs0J:GJ D;6MISAUII.w7AnsuQns.=dM+uv P6OY- N4TM+uNZ%N.g DDoSUDIQ.VOPNv DNS-+g*1 NXNSAttack2.=W64T DDoSM+uv 2020A 5P7x ?,J0 52 :FV.7 DDoSOY-naS56-B 2020A.hM+uP%=l33Om%H3-*(M+u3,J0 :FV.7 33*Z!.gKp$FV.7-S 4%.w7g*/NJz|*lqI=R 2020AKp$.7 7 3 4.56 HpmT 2020A%P6CHC+BAE+v APT 343 3P MBl3M+uh,%H3i Microsoft Exchange-+g%4%6 IDuiZ.nu IMEItv FIN6/p Evilnum3uA7u iHkNb%HIJNCB C6 IDuiZ.nu IMEI t#uZutS t SWEEDl3 Guloader6Zut#uOY-m5/-Bw TOP10 x =RM+uOm3* IPv633l3+Q.g56M+uAil31In233*M+u%3vX6 Qh3*l3M+u=hM+ulRP6m+%|sP,w3 TOP10l3M+u% 3*3f%/+ IPv6BiHWcYB2HW%YM+ul3aM+ulRv0- IPv6BiHWcYB2n0%HW%YM+ul3alR%o%v3-6l3BiAHW%Y%NAih%.H|ll3%(+.Om3+%o6%HP l3g*%=xGvRJz|*lqI8EIJ%HDPl3k%EIJ|*lqI3 3 6.1 %H+t% 2020AP= =E+%Y%=l3d|k%l3Nv6l3P=NvlJ;6l3P=N% 1560%.6w74Tv 6w74TOm_i(/pK)7 -YC 80%6/p|iZ;6%DHW%YM+ul3*Z =Rv 5C 6.4mf)?m8x6-B 6.1Om|*lqIIbl*NDjN| D+l3d|+i Top10+vJ.tm%l3Om=R MVPowerNC)Q,l3r 6|M+ul3.DA%/J+xM| Bbf3dg|ql3g5%H b!i%g5%Hl3,J0 78 P6D6yB0Eg1Q 3i DNP3-+l3l*AJk%P=P6l3Om%H3*6IOm.6 7QQ=3Ql3,v%o,J0 P6DNg*= CISA.A-%N%,J0 P6D6A%6v|*lqI8EIJA.Op 2020A 4PNl3 SCADAxM| 6W.h%M+uv%M+u%P=3%|%l3 PLC;6 M+uMn.NrHW%A6l3n3v %X.OM+u%=hl*D.BM+u6%H.V-I HPu Schneider Electricu Intelu Rockwell Automationu Caterpillaru Baxter t6B0vHW,u+i%.*R53.hC/xM| %r Hf6u. g|3HRDPuZQh, 2020A33Mt%I|:, 5G%/l3.= 5GB;POm/g*,q,vneoDvN4B%l3 5G g*+82 5Gl3g* %Co+3uWl/p%H3 2020A*%N.A-g*MtQhQQh 5G,O_v; 3X+t.% 5G,J0 84 P6DN|qi1%.2B0 2020A 8P 33,w*A-H1A+ 5G|+2Aa+t%6 2020A 8P 3|g*/p4n;N,O_v; WlK +t%xM+PLN/p%Z3Ol3%Zk%u 8u 8/pDROD+ *Nt 5Gk%l3g*t/pH%Ql3g*8v 2020A 1P Wl8g/% %H3MBB26t%/.=4lNl36 savv 2020.02 . IMT-2020(5G)J |A+% 5Gg*IJ/ xM| 3Sxg|% 5G*IQu*4TBi3O.V%/iDl3g*K +t%g*g|D/pB =RD_JNA=R.|,vC.N%. Ng*uC-, 5G|NJzg*IIu4l 5G|g*%/iD 3%DNmT,qQ B 5Gg*%RDPIQg*4NB;|K .Gv ETSI WYiR+-,- 5G,S, HX33 5G|4n;Nt4l3ig*w7R+Al=RHWcY%Y- 5G%/,wuNJzu| tNl3g*Yf%/R+n+X 6/pg*IQl3R+n+ 5Gq,| g*IQY 5Gq,|;6g*IQY 4s;6 5Gq,|;6g*IQY RDP|,u 5G|+dg*IQY 4% 5GP,w-,QQ SBAl3g*nr.V 5G|,e-S 5G|C*l3|,uI-,u|+duf|Cuu|,qBMtNIQ%r B2%AQh %Nl3g*8/p=Rg*UII/p(|tNK +t%PYv 2 6.3.3.1m SDNL-V4 SDNJ+(OmN.I%Dg *.l3 SDNJ+(=R%q,|QhqOmDR%.=l3v 3 1t fqM5f9 5Gg*%R+-,Ak-S SDNk% g*tj Bi= 166HNJz%rHWl3 DDoSM+uuEeFl APP+ir*r |ntQ,+I + DDoSM+u;rk-S NFVk% g*tj | 4n;N|+%Y%uYg|u)4|u%/,w|/pA6 uYg|vQ=RuYg|uJ+/p)4rfqQ+g *4=Wl%C/v B=RuYg|uJ+/p)4r(7dg|q7%.|J* %.l3 leaf%JfQ,A6uYg|.J*A6uYg|%JfQ,+ +g*4%.g*tl3g*43i VLAN fq NFVI %u4n;Nl3g*w7k-S MECk% g*tj dg|g5/p|QQ i% MECca|f|C6%l=R%g*l3 dg|g5OD.hJQ9uMFNJzZ=u DDoS M+uu;6dg|M+ut8v.6-%D MECcag*,q.hl3E+i MECc al3-NuYg|tv w7k-S |+dk% g*tj sJ* 1+d2I,EP=36P=3iEv 2sJ*r %H.+tgQJQ9 UEe +duH UEl+d|%.l3g*tj%Y%.g*+l3+d;|%.l3* i NF 2 +d* NF %6|;6g*3+d* NF %6|;6 B(|IUa6 Hdg|Ua6II+d*|%6|l3g* 3%.+d NFqB|+ukqu.i SBA +d NF qv +duYg| 1M+u.|lBl3uJQ9Q,+duYg|xM| .V+d| (nNDuQ,DIIk-S |,qBMk% g*tj %DNl3HW(+|*lqI=RNl3rTD/pg*DK +t%Nl3Yv%N|;N %Hl3M+uf%YG7 DDoS/p+it=W|+tgl3.ON3UB.8 Fln3H6qAD% COVID-19SIQZA%, 2020A=RI;RQM+uuuZ.M+uuV4Tr.gM+uuV4T.l=Wtn3RQM+uOmDNJzRQI8Y=%/,wBi%Hl3 AI/ML*NJzRQRQP6l3SDv .M+u/p*NJzI8Y=%OmP,_lGR,W3D-.%Hj-tIb.+.%1b%HDP-t 600082 2 O MtZ:%I-CYFl7rn 2020A 8P 28N *3Eg*R+8g/%YC76 ,v3|s%6 ,viHQ9+/BQ/p6g|rr .%NB.gMFNJzg*UIIJNYC7.g,vuNJzpMuNJzyJd5/p.=%X):i|g*NYvmT3=l36,qJ,N l3,.=|*lqIX%Hw,q(7A/p8EIJBi6 CHMU=RI;,q!Bl3% %/Dg*nrv*dH*.%/l3g*3Y/pC6l3g*nr,q=R*gw|g*8/p D,fI|8=/p+Q&T8EIJl3i%uuBit,q.V*IQ&%YRDPnr* J+t%|*l8EIJA.&T.V%xM+XHW8EIJl3N%&O=P0E)L 8CRnEs0J.5,OYmpGtU &O_CnX2AnnJ_Bn=/On/kvd&k=J*L( ,(RcTMEuJ0.m,a1w/R,P0TiC.PJ*Jh&.m,kgXdo 5oHBm0_P80)LFm&o