[vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n
\u5728\u865b\u64ec\u5316\u5b89\u5168\u9818\u57df\uff0c\u7279\u5225\u662f\u5728Windows\u865b\u64ec\u6a5f\u5b89\u5168\u5834\u666f\u4e2d\uff0c\u53d7\u611f\u67d3\u7684Linux\u865b\u64ec\u6a5f<\/a>\u5e36\u4f86\u7684\u5a01\u8105\u65e5\u76ca\u4ee4\u4eba\u64d4\u6182\u3002\u672c\u6280\u8853\u6307\u5357\u63a2\u8a0e\u4e86\u4fdd\u8b77Windows\u4e3b\u6a5f\u514d\u53d7\u6f5b\u5728\u5f8c\u9580Linux\u865b\u64ec\u6a5f\u4fb5\u5bb3\u7684\u9ad8\u968e\u65b9\u6cd5\uff0c\u9019\u5c0d\u65bc\u8de8\u5e73\u53f0\u865b\u64ec\u5316\u666e\u904d\u5b58\u5728\u7684\u9999\u6e2f\u4f3a\u670d\u5668\u79df\u7528<\/a>\u74b0\u5883\u4f86\u8aaa\u5c24\u70ba\u91cd\u8981\u3002<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n \u865b\u64ec\u6a5f\u9003\u9038\u6f0f\u6d1e\u901a\u5e38\u6703\u5229\u7528\u5ba2\u6236\u6a5f\u548c\u4e3b\u6a5f\u7cfb\u7d71\u4e4b\u9593\u7684\u5171\u4eab\u8cc7\u6e90\u3002\u5e38\u898b\u7684\u653b\u64ca\u9014\u5f91\u5305\u62ec\uff1a<\/p>\n \u4e00\u500b\u7279\u5225\u5371\u96aa\u7684\u4f8b\u5b50\u662fVENOM\u6f0f\u6d1e\uff08CVE-2015-3456\uff09\u3002\u4ee5\u4e0b\u662f\u6aa2\u67e5\u8a72\u6f0f\u6d1e\u7684\u65b9\u6cd5\uff1a<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n \u9069\u7576\u7684\u865b\u64ec\u6a5f\u9694\u96e2\u662f\u4e3b\u6a5f\u7cfb\u7d71\u4fdd\u8b77\u7684\u57fa\u77f3\u3002\u8b93\u6211\u5011\u63a2\u8a0e\u4e3b\u8981\u865b\u64ec\u5316\u5e73\u53f0\u7684\u9ad8\u968e\u914d\u7f6e\u6280\u8853\u3002<\/p>\n \u9996\u5148\uff0c\u5be6\u65bd\u9019\u4e9bPowerShell\u547d\u4ee4\u4f86\u589e\u5f37Hyper-V\u5b89\u5168\u6027\uff1a<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n \u5728\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u4e2d\uff0c\u5be6\u65bd\u7db2\u8def\u5206\u6bb5\u81f3\u95dc\u91cd\u8981\u3002\u4ee5\u4e0b\u662f\u5168\u9762\u7684\u5be6\u65bd\u65b9\u6cd5\uff1a<\/p>\n \u4e3b\u6a5f\u7cfb\u7d71\u4e0a\u7684iptables\u914d\u7f6e\u793a\u4f8b\uff1a<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n \u5be6\u65bd\u56b4\u683c\u7684\u8cc7\u6e90\u63a7\u5236\u4ee5\u9632\u6b62\u901a\u904e\u8cc7\u6e90\u8017\u76e1\u9032\u884c\u7684\u865b\u64ec\u6a5f\u9003\u9038\u5617\u8a66\uff1a<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n \u5728\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u4e2d\uff0c\u5be6\u65bd\u5f37\u5927\u7684\u76e3\u63a7\u7cfb\u7d71\u81f3\u95dc\u91cd\u8981\u3002\u4ee5\u4e0b\u662f\u5c08\u6ce8\u65bc\u865b\u64ec\u6a5f\u5b89\u5168\u7684\u7d9c\u5408\u76e3\u63a7\u8a2d\u7f6e\uff1a<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n \u4f5c\u70ba\u4e3b\u8981\u7684\u4f3a\u670d\u5668\u79df\u7528\u4e2d\u5fc3\uff0c\u9999\u6e2f\u7684\u7279\u6b8a\u5730\u4f4d\u9700\u8981\u984d\u5916\u7684\u5b89\u5168\u8003\u616e\uff1a<\/p>\n \u5be6\u65bd\u4ee5\u4e0bPython\u8173\u672c\u9032\u884c\u5340\u57df\u6027\u5a01\u8105\u6aa2\u6e2c\uff1a<\/p>\n \u7576\u6aa2\u6e2c\u5230\u5165\u4fb5\u6642\uff0c\u57f7\u884c\u4ee5\u4e0b\u61c9\u6025\u97ff\u61c9\u8a08\u5283\uff1a<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n \u5be6\u65bd\u9019\u4e9b\u9ad8\u968e\u5b89\u5168\u63aa\u65bd\u9700\u8981\u5b9a\u671f\u66f4\u65b0\u548c\u7dad\u8b77\u3002\u4ee5\u4e0b\u662f\u865b\u64ec\u5316\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u4e2d\u6301\u7e8c\u5b89\u5168\u7ba1\u7406\u7684\u7d9c\u5408\u6aa2\u67e5\u6e05\u55ae\uff1a<\/p>\n \u865b\u64ec\u6a5f\u5b89\u5168\u9818\u57df\u4e0d\u65b7\u767c\u5c55\uff0c\u7279\u5225\u662f\u5728\u9999\u6e2f\u7684\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u4e2d\u3002\u5b9a\u671f\u7684\u5b89\u5168\u7a3d\u6838\u3001\u9069\u7576\u7684\u865b\u64ec\u6a5f\u9694\u96e2\u548c\u5f37\u5927\u7684\u76e3\u63a7\u7cfb\u7d71\u69cb\u6210\u4e86\u4fdd\u8b77Windows\u7cfb\u7d71\u514d\u53d7\u53d7\u611f\u67d3Linux\u865b\u64ec\u6a5f\u4fb5\u5bb3\u7684\u57fa\u790e\u3002\u8acb\u8a18\u4f4f\u6839\u64da\u60a8\u7684\u5177\u9ad4\u865b\u64ec\u5316\u5e73\u53f0\u548c\u5b89\u5168\u9700\u6c42\u8abf\u6574\u9019\u4e9b\u63aa\u65bd\u3002<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":" [vc_row el_class=”blog-detail-section”][vc_ […]<\/p>\n\u865b\u64ec\u6a5f\u9003\u9038\u653b\u64ca\uff1a\u6280\u8853\u5206\u6790<\/strong><\/h2>\n
\n
#!\/bin\/bash\r\n# \u6aa2\u67e5VENOM\u6f0f\u6d1e\r\nif [ -e \/proc\/sys\/kernel\/perf_event_paranoid ]; then\r\n paranoid=$(cat \/proc\/sys\/kernel\/perf_event_paranoid)\r\n if [ \"$paranoid\" -lt 2 ]; then\r\n echo \"\u7cfb\u7d71\u53ef\u80fd\u5b58\u5728VENOM\u6f0f\u6d1e\"\r\n else\r\n echo \"\u5df2\u5177\u5099\u91dd\u5c0dVENOM\u7684\u57fa\u672c\u9632\u8b77\"\r\n fi\r\nfi<\/code><\/pre>\n\u5be6\u65bd\u5f37\u5927\u7684\u865b\u64ec\u6a5f\u9694\u96e2<\/strong><\/h2>\n
Hyper-V\u9ad8\u968e\u5b89\u5168\u914d\u7f6e<\/h3>\n
## \u555f\u7528\u57fa\u65bc\u865b\u64ec\u5316\u7684\u5b89\u5168\u6027\r\nSet-VMSecurity -VMName \"LinuxVM\" -VirtualizationBasedSecurityOptimization On\r\n\r\n## \u914d\u7f6e\u7db2\u8def\u9694\u96e2\r\nNew-VMSwitch -Name \"IsolatedSwitch\" -SwitchType Private\r\nConnect-VMNetworkAdapter -VMName \"LinuxVM\" -SwitchName \"IsolatedSwitch\"\r\n\r\n## \u555f\u7528\u5b89\u5168\u7279\u6027\r\nSet-VMProcessor -VMName \"LinuxVM\" -EnableSecurityFeatures $true<\/code><\/pre>\n\u7db2\u8def\u5b89\u5168\u914d\u7f6e<\/strong><\/h2>\n
\n
#!\/bin\/bash\r\n# \u914d\u7f6e\u865b\u64ec\u6a5f\u9694\u96e2\u7684iptables\u898f\u5247\r\niptables -N VM_ISOLATION\r\niptables -A VM_ISOLATION -i virbr0 -o virbr1 -j DROP\r\niptables -A VM_ISOLATION -i virbr1 -o virbr0 -j DROP\r\niptables -A FORWARD -j VM_ISOLATION\r\n\r\n# \u8a18\u9304\u53ef\u7591\u6d3b\u52d5\r\niptables -A INPUT -i virbr+ -m state --state NEW -j LOG --log-prefix \"VM_NET: \"<\/code><\/pre>\n\u8cc7\u6e90\u5b58\u53d6\u63a7\u5236<\/strong><\/h2>\n
# PowerShell\u8cc7\u6e90\u63a7\u5236\u547d\u4ee4\r\nSet-VMMemory -VMName \"LinuxVM\" -MaximumBytes 4GB -MinimumBytes 512MB\r\nSet-VMProcessor -VMName \"LinuxVM\" -Count 2 -Maximum 70 -RelativeWeight 100\r\nSet-VMDvdDrive -VMName \"LinuxVM\" -ControllerNumber 1 -ControllerLocation 0 -Path $null<\/code><\/pre>\n\u5373\u6642\u76e3\u63a7\u548c\u6aa2\u6e2c<\/strong><\/h2>\n
# PowerShell\u865b\u64ec\u6a5f\u76e3\u63a7\u8173\u672c\r\n$VMName = \"LinuxVM\"\r\n$LogPath = \"C:\\VMlogs\\security.log\"\r\n\r\nfunction Monitor-VMMetrics {\r\n $VM = Get-VM -Name $VMName\r\n $CPUUsage = $VM.CPUUsage\r\n $MemoryUsage = $VM.MemoryAssigned\r\n \r\n if ($CPUUsage -gt 90 -or $MemoryUsage -gt 90) {\r\n $Alert = \"\u6aa2\u6e2c\u5230\u9ad8\u8cc7\u6e90\u4f7f\u7528\u7387: CPU: $CPUUsage%, \u8a18\u61b6\u9ad4: $MemoryUsage%\"\r\n Add-Content -Path $LogPath -Value \"$(Get-Date) - $Alert\"\r\n Send-AlertNotification $Alert\r\n }\r\n}<\/code><\/pre>\n\u9999\u6e2f\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u7684\u9ad8\u968e\u5b89\u5168\u63aa\u65bd<\/strong><\/h2>\n
\n
import pandas as pd\r\nfrom sklearn.ensemble import IsolationForest\r\n\r\ndef detect_regional_threats(log_data):\r\n # \u914d\u7f6e\u6aa2\u6e2c\u53c3\u6578\r\n clf = IsolationForest(\r\n n_estimators=100,\r\n max_samples='auto',\r\n contamination=0.1,\r\n random_state=42\r\n )\r\n \r\n # \u8655\u7406\u65e5\u8a8c\u8cc7\u6599\r\n features = ['source_ip', 'request_count', 'error_rate']\r\n X = log_data[features]\r\n \r\n # \u6aa2\u6e2c\u7570\u5e38\r\n predictions = clf.fit_predict(X)\r\n return predictions<\/code><\/pre>\n\u61c9\u6025\u97ff\u61c9\u5354\u8b70<\/strong><\/h2>\n
#!\/bin\/bash\r\n# \u865b\u64ec\u6a5f\u7dca\u6025\u9694\u96e2\u5354\u8b70\r\nVM_NAME=\"compromised_vm\"\r\n\r\nfunction isolate_vm() {\r\n # \u639b\u8d77\u865b\u64ec\u6a5f\r\n virsh suspend $VM_NAME\r\n \r\n # \u9694\u96e2\u7db2\u8def\r\n virsh domif-setlink $VM_NAME vnet0 down\r\n \r\n # \u5efa\u7acb\u8a18\u61b6\u9ad4\u8f49\u5132\r\n virsh dump $VM_NAME \/forensics\/memory_dump_$(date +%F_%H%M%S).dump\r\n \r\n # \u8a18\u9304\u4e8b\u4ef6\r\n logger \"\u865b\u64ec\u6a5f $VM_NAME \u56e0\u5b89\u5168\u4e8b\u4ef6\u5df2\u88ab\u9694\u96e2\"\r\n}<\/code><\/pre>\n\u6700\u4f73\u5be6\u8e10\u548c\u672a\u4f86\u898f\u5283<\/strong><\/h2>\n
# \u6708\u5ea6\u5b89\u5168\u7a3d\u6838\u8173\u672c\r\n#!\/bin\/bash\r\n\r\nfunction audit_vm_security() {\r\n echo \"=== \u865b\u64ec\u6a5f\u5b89\u5168\u7a3d\u6838\u5831\u544a ====\"\r\n date\r\n \r\n # \u6aa2\u67e5\u865b\u64ec\u6a5f\u9694\u96e2\r\n virsh list --all | while read vm; do\r\n if [ ! -z \"$vm\" ]; then\r\n echo \"\u6aa2\u67e5\u9694\u96e2\u72c0\u614b: $vm\"\r\n virsh dumpxml \"$vm\" | grep -i \"security\"\r\n fi\r\n done\r\n \r\n # \u9a57\u8b49\u8a18\u61b6\u9ad4\u9650\u5236\r\n virsh memtune \"$VM_NAME\"\r\n \r\n # \u6aa2\u67e5\u7db2\u8def\u9694\u96e2\r\n virsh nwfilter-list\r\n}<\/code><\/pre>\n\u7d50\u8ad6\u548c\u5efa\u8b70<\/strong><\/h2>\n