Computer Networks: Security Threats & Countermeasures | 计算机网络：主要安全威胁与应对策略

📚 Computer Networks: Security Threats & Countermeasures | 计算机网络：主要安全威胁与应对策略

In the digital age, computer networks form the backbone of modern communication, commerce, and governance. However, as connectivity expands, so does the attack surface for malicious actors. Understanding the primary threats to network security and the strategies to mitigate them is essential for any computer science student preparing for the CIE A-Level examination.

在数字时代，计算机网络已成为现代通信、商业和政府运作的基石。然而，随着互联性的扩展，恶意行为者可利用的攻击面也在不断扩大。理解网络安全的主要威胁及其缓解策略，对于备考 CIE A-Level 考试的计算机科学学生来说至关重要。

1. Malware: Viruses, Worms & Trojans | 恶意软件：病毒、蠕虫与特洛伊木马

Malware — short for malicious software — refers to any program or code specifically designed to disrupt, damage, or gain unauthorized access to a computer system. The three most commonly examined categories are viruses, worms, and Trojan horses. A virus attaches itself to a legitimate host file and requires user action, such as opening an infected email attachment, to propagate. A worm, by contrast, is self-replicating and spreads automatically across networks without human interaction, often consuming bandwidth and overwhelming servers. A Trojan horse disguises itself as benign software but performs hidden malicious functions once installed, such as logging keystrokes or opening a backdoor for an attacker.

恶意软件（Malware）是恶意软件（malicious software）的缩写，指任何旨在破坏、损害或未经授权访问计算机系统的程序或代码。考试中最常考查的三类恶意软件是病毒、蠕虫和特洛伊木马。病毒将自己附着在合法的宿主文件上，需要用户操作（如打开受感染的电子邮件附件）才能传播。相比之下，蠕虫能够自我复制，无需人为交互即可在网络上自动传播，常常消耗带宽并使服务器过载。特洛伊木马伪装成良性软件，但一旦安装便会执行隐藏的恶意功能，例如记录键盘输入或为攻击者打开后门。

Virus: requires host + user action → Worm: self-replicating, no host → Trojan: disguised malicious software

病毒：需要宿主 + 用户操作 → 蠕虫：自我复制，无需宿主 → 木马：伪装的恶意软件

2. Phishing & Social Engineering | 网络钓鱼与社会工程学

Social engineering exploits human psychology rather than technical vulnerabilities. Phishing is the most prevalent form, where attackers send fraudulent emails or messages masquerading as trusted institutions — such as banks or government agencies — to trick victims into revealing sensitive information like passwords, credit card numbers, or national identification details. Spear-phishing is a targeted variant aimed at specific individuals or organisations, often using personalised information to increase credibility. Other social engineering techniques include pretexting (fabricating a scenario to obtain information), baiting (offering a digital lure such as a free movie download), and tailgating (physically following an authorised person into a restricted area).

社会工程学利用的是人的心理，而非技术漏洞。网络钓鱼（Phishing）是最普遍的形式，攻击者伪装成可信机构（如银行或政府机关）发送欺诈性电子邮件或消息，诱骗受害者泄露密码、信用卡号或身份证号码等敏感信息。鱼叉式网络钓鱼（Spear-phishing）是一种针对特定个人或组织的定向攻击变体，常利用个性化信息来增加可信度。其他社会工程学技术包括：借口诱导（编造情境以获取信息）、诱饵攻击（提供免费电影下载等数字诱饵），以及尾随攻击（在物理上尾随授权人员进入受限区域）。

3. Denial of Service (DoS) & Distributed DoS | 拒绝服务攻击与分布式拒绝服务攻击

A Denial of Service (DoS) attack aims to make a network service unavailable to its intended users by overwhelming it with a flood of requests, thereby exhausting bandwidth, memory, or processing capacity. A Distributed Denial of Service (DDoS) attack amplifies this by coordinating thousands — or even millions — of compromised devices, known as a botnet, to launch the attack simultaneously from multiple locations. This makes DDoS attacks significantly harder to defend against, as traffic originates from many distinct IP addresses. Common attack vectors include SYN floods (sending incomplete TCP handshake requests), UDP floods, and ICMP ping floods. The primary motivations range from political activism (‘hacktivism’) to extortion and competitive sabotage.

拒绝服务攻击（DoS）旨在通过大量请求淹没网络服务，耗尽带宽、内存或处理能力，从而使服务对目标用户不可用。分布式拒绝服务攻击（DDoS）通过协调数千甚至数百万台被入侵的设备（称为僵尸网络）从多个地点同时发起攻击，使攻击规模急剧放大。由于流量来自众多不同的 IP 地址，DDoS 攻击的防御难度显著增加。常见的攻击手段包括 SYN 泛洪（发送不完整的 TCP 握手请求）、UDP 泛洪和 ICMP Ping 泛洪。攻击动机各不相同，从政治激进主义（”黑客行动主义”）到勒索和商业破坏皆有之。

4. Man-in-the-Middle (MITM) Attacks | 中间人攻击

In a Man-in-the-Middle (MITM) attack, the attacker secretly intercepts and potentially alters the communication between two parties who believe they are directly communicating with each other. This can occur over unsecured Wi-Fi networks, where an attacker positions themselves between the user and the access point. The attacker can eavesdrop on sensitive data, such as login credentials or financial information, or actively modify the data in transit. Techniques used in MITM attacks include ARP spoofing, where the attacker sends falsified Address Resolution Protocol messages to associate their MAC address with the IP address of a legitimate device, and DNS spoofing, which redirects users to fraudulent websites by corrupting domain name resolution.

在中间人攻击（MITM）中，攻击者秘密拦截并在可能的情况下篡改两方之间的通信，而这两方都认为自己正在直接与对方通信。这种情况常发生在不安全的 Wi-Fi 网络上，攻击者将自己置于用户与接入点之间。攻击者可以窃听敏感数据（如登录凭据或财务信息），或主动修改传输中的数据。MITM 攻击使用的技术包括 ARP 欺骗（攻击者发送伪造的地址解析协议消息，将自己的 MAC 地址与合法设备的 IP 地址关联）和 DNS 欺骗（通过篡改域名解析将用户重定向到欺诈网站）。

5. SQL Injection & Code Injection | SQL 注入与代码注入

SQL injection is an attack technique where malicious SQL statements are inserted into an entry field of a web application, exploiting poorly sanitised user input. For example, if a login form directly concatenates user input into a SQL query, an attacker might enter ‘ OR ‘1’=’1 as the password, causing the query to return all records and thereby bypass authentication. More destructive forms can delete tables, drop databases, or exfiltrate large volumes of sensitive data. Injection attacks are not limited to SQL — command injection and cross-site scripting (XSS) operate on similar principles of untrusted data being processed without proper validation or encoding.

SQL 注入是一种攻击技术，将恶意的 SQL 语句插入到 Web 应用程序的输入字段中，利用的是对用户输入净化不足的弱点。例如，如果登录表单直接将用户输入拼接进 SQL 查询，攻击者可能会输入 ‘ OR ‘1’=’1 作为密码，从而使查询返回所有记录，绕过身份验证。更具破坏性的形式可删除表、丢弃数据库或窃取大量敏感数据。注入攻击不仅限于 SQL——命令注入和跨站脚本（XSS）的原理类似，都是未经验证或编码的不可信数据被直接处理。

SELECT * FROM users WHERE username = ‘admin’ AND password = ” OR ‘1’=’1′

6. Brute-Force & Password Attacks | 暴力破解与密码攻击

Brute-force attacks systematically attempt every possible combination of characters until the correct password is discovered. While simple in concept, the computational cost grows exponentially with password length — a 6-character lowercase password has 26⁶ ≈ 308 million combinations, while a 12-character mixed-case password with numbers and symbols has approximately 94¹² possibilities. Dictionary attacks are a more efficient variant that uses pre-compiled lists of common passwords and phrases rather than exhaustive character combinations. Defence mechanisms include account lockout policies, rate limiting, and the use of salted hashes — where a random value (the salt) is appended to the password before hashing, rendering precomputed rainbow tables ineffective.

暴力破解攻击会系统地尝试所有可能的字符组合，直到找到正确的密码。虽然概念简单，但计算成本随密码长度呈指数级增长——6 位小写字母密码有 26⁶ ≈ 3.08 亿种组合，而 12 位包含大小写字母、数字和符号的密码约有 94¹² 种可能性。字典攻击是一种更高效的变体，它使用预先编译的常见密码和短语列表，而非穷举所有字符组合。防御机制包括账户锁定策略、速率限制，以及使用加盐哈希——在密码哈希之前附加一个随机值（盐），使预计算的彩虹表失效。

7. Firewalls & Intrusion Detection Systems | 防火墙与入侵检测系统

A firewall acts as a barrier between a trusted internal network and an untrusted external network, such as the internet. It inspects each packet passing through it based on pre-defined security rules. Packet-filtering firewalls examine header information — source and destination IP addresses, ports, and protocols — and allow or block packets accordingly. Stateful inspection firewalls go further by tracking the state of active connections, ensuring that only legitimate response packets are permitted. Intrusion Detection Systems (IDS) monitor network traffic for suspicious patterns and known attack signatures, generating alerts when anomalies are detected. Intrusion Prevention Systems (IPS) extend this capability by actively blocking detected threats in real time.

防火墙充当可信内部网络与不可信外部网络（如互联网）之间的屏障。它根据预定义的安全规则检查通过的每个数据包。包过滤防火墙检查报头信息——源 IP 地址、目标 IP 地址、端口和协议——并据此允许或阻止数据包。状态检测防火墙更进一步，跟踪活动连接的状态，确保只允许合法的响应数据包通过。入侵检测系统（IDS）监控网络流量中的可疑模式和已知攻击特征，在检测到异常时生成警报。入侵防御系统（IPS）则扩展了这一能力，能够在实时主动阻止检测到的威胁。

8. Encryption & Cryptographic Protocols | 加密与密码协议

Encryption is the cornerstone of data protection, ensuring confidentiality — that only authorised parties can read the information. Symmetric encryption (e.g., AES, 3DES) uses a single shared key for both encryption and decryption; it is fast and suitable for bulk data, but the key distribution problem poses a security challenge. Asymmetric encryption (e.g., RSA) uses a pair of keys — a public key for encryption and a private key for decryption; while slower, it solves the key exchange problem and also enables digital signatures for authentication and non-repudiation. Transport Layer Security (TLS) combines both approaches: asymmetric encryption is used to securely exchange a session key, which then enables symmetric encryption for the remainder of the communication.

加密是数据保护的基石，确保机密性——只有授权方才能读取信息。对称加密（如 AES、3DES）使用单一共享密钥进行加密和解密；其速度快，适合批量数据，但密钥分发问题带来安全挑战。非对称加密（如 RSA）使用一对密钥——公钥用于加密，私钥用于解密；虽然速度较慢，但解决了密钥交换问题，还能通过数字签名实现身份验证和不可否认性。传输层安全协议（TLS）结合了两种方法：使用非对称加密来安全地交换会话密钥，然后利用该会话密钥在后续通信中使用对称加密。

9. Access Control & Authentication | 访问控制与身份验证

Access control determines who can access which resources and under what conditions. The principle of least privilege dictates that users should be granted only the minimum level of access necessary to perform their job functions. Multi-Factor Authentication (MFA) significantly enhances security by requiring two or more independent credentials from different categories: something you know (a password or PIN), something you have (a smart card or mobile device), and something you are (biometrics such as a fingerprint or facial recognition). Access control models include Discretionary Access Control (DAC), where the resource owner determines access rights, and Mandatory Access Control (MAC), where access is regulated by a central authority based on classification levels.

访问控制决定谁可以在什么条件下访问哪些资源。最小权限原则要求用户只被授予执行其工作职能所必需的最低访问级别。多因素身份验证（MFA）通过要求来自不同类别的两个或多个独立凭据来显著增强安全性：你知道的信息（密码或 PIN）、你拥有的物品（智能卡或移动设备）以及你的生物特征（指纹或人脸识别等生物识别信息）。访问控制模型包括自主访问控制（DAC，资源所有者决定访问权限）和强制访问控制（MAC，由中央机构根据密级级别管控访问权限）。

10. Backups & Disaster Recovery | 备份与灾难恢复

No security strategy is complete without a robust backup and disaster recovery plan. In the event of a ransomware attack, hardware failure, or natural disaster, backups enable the restoration of critical data and the continuity of business operations. The 3-2-1 backup rule is a widely recommended strategy: maintain at least three copies of data, stored on two different types of media, with one copy kept offsite. Regular testing of backup integrity is essential — a backup that cannot be restored is worthless. Additionally, organisations must consider Recovery Point Objective (RPO) — the maximum acceptable data loss measured in time — and Recovery Time Objective (RTO) — the maximum acceptable downtime before services must be restored.

没有强大的备份和灾难恢复计划，任何安全策略都是不完整的。在勒索软件攻击、硬件故障或自然灾害发生时，备份能够支持关键数据的恢复和业务运营的连续性。3-2-1 备份规则是广泛推荐的策略：至少保留三份数据副本，存储在两种不同类型的介质上，其中一份存放在异地。定期测试备份的完整性至关重要——无法恢复的备份毫无价值。此外，组织必须考虑恢复点目标（RPO，以时间衡量的最大可接受数据丢失量）和恢复时间目标（RTO，恢复服务前最大可接受的停机时间）。

11. User Education & Security Policy | 用户教育与安全策略

Technology alone cannot guarantee network security; human behaviour remains the weakest link. A comprehensive security awareness programme should train users to recognise phishing emails, create strong passwords, avoid suspicious downloads, and report security incidents promptly. Organisations should establish clear security policies covering acceptable use, password management, incident response procedures, and data classification. Regular security audits and penetration testing — where ethical hackers simulate attacks to identify vulnerabilities — are crucial for continuous improvement. As cyber threats evolve, security must be viewed not as a one-time investment but as an ongoing process of assessment, adaptation, and vigilance.

仅靠技术无法保证网络安全；人的行为仍然是最薄弱的环节。全面的安全意识培训计划应训练用户识别钓鱼电子邮件、创建强密码、避免可疑下载，并及时报告安全事件。组织应制定明确的安全政策，涵盖可接受使用、密码管理、事件响应流程和数据分类。定期进行安全审计和渗透测试——由道德黑客模拟攻击以识别漏洞——对于持续改进至关重要。随着网络威胁不断演变，安全不应被视为一次性投资，而是一个持续评估、适应和警惕的过程。

Published by TutorHao | Computer Science Revision Series | aleveler.com

更多咨询请联系16621398022（同微信）

Computer Networks: Security Threats & Countermeasures | 计算机网络：主要安全威胁与应对策略