网络安全攻防概述 / Introduction to Network Security Attack and Defense

网络空间已成为继陆、海、空、天之后的第五作战域，其战略地位在数字时代日益凸显。在全球化和信息化的双重驱动下，网络空间不仅是信息传输的基础设施，更是国家治理、经济运行、社会发展的核心支撑。从金融系统的实时交易到电力网络的智能调度，从医疗记录的电子化管理到军事装备的精准控制，网络空间与物理世界的深度融合创造了前所未有的便利，同时也打开了潘多拉的盒子——网络安全威胁随之演变为影响国家安全、社会稳定和经济发展的重大挑战。根据Cybersecurity Ventures的统计数据，2023年全球网络犯罪造成的经济损失预计达到8万亿美元，而这一数字在未来几年仍将以每年15%的速度增长。面对如此严峻的形势，深入理解网络安全的攻防本质，掌握科学的分析框架，对于每一位安全从业者而言都是必修的功课。

The strategic importance of cyberspace has become increasingly prominent in the digital age, as it has evolved into the fifth domain of operations alongside land, sea, air, and space. Driven by globalization and informatization, cyberspace serves not only as the infrastructure for information transmission but also as the core support for national governance, economic operations, and social development. From real-time financial transactions to intelligent power grid scheduling, from electronic management of medical records to precise control of military equipment, the deep integration of cyberspace and the physical world has created unprecedented convenience while simultaneously opening Pandora's box—cybersecurity threats have evolved into major challenges affecting national security, social stability, and economic development. According to Cybersecurity Ventures, global cybercrime damages are expected to reach $8 trillion in 2023, with this figure continuing to grow at an annual rate of approximately 15%. In the face of such severe circumstances, deeply understanding the essence of cybersecurity attack and defense and mastering scientific analytical frameworks have become essential knowledge for every security professional.

网络安全作为一个多维度、跨学科的研究领域，其内涵远非“防止黑客入侵”这般简单。从学术定义来看，网络安全是指在网络环境中保护信息的机密性、完整性和可用性，防止未授权的访问、使用、披露、中断、修改或销毁信息资产的一系列技术、策略和实践。这一概念的形成经历了从早期计算机安全（Computer Security）到信息安全（Information Security），再到网络空间安全（Cybersecurity）的演进过程。每一个阶段的演进都反映了安全威胁的变化和安全需求的扩展。值得注意的是，网络安全与信息安全并非完全等同的概念——信息安全更强调信息本身的价值保护，而网络安全则更关注网络基础设施和网络服务的持续可用性。在实际工作中，两者相互交织、互为补充，共同构成了组织安全体系的基石。

Cybersecurity, as a multi-dimensional and interdisciplinary field of study, encompasses far more than simply "preventing hacker intrusions." From an academic perspective, cybersecurity refers to a comprehensive set of technologies, strategies, and practices designed to protect the confidentiality, integrity, and availability of information in network environments, preventing unauthorized access, use, disclosure, interruption, modification, or destruction of information assets. The formation of this concept has undergone an evolutionary process from early Computer Security to Information Security, and then to Cybersecurity. Each stage of evolution reflects changes in security threats and expansions in security requirements. It is noteworthy that cybersecurity and information security are not entirely synonymous concepts—information security places greater emphasis on protecting the value of information itself, while cybersecurity focuses more on the continuous availability of network infrastructure and network services. In practical work, the two are intertwined and mutually complementary, together forming the foundation of an organization's security architecture.

当前的网络安全威胁态势呈现出几个显著特征，这些特征深刻影响着安全防护策略的制定和实施。首先是攻击主体的多元化趋势。从早期的个体黑客（Script Kiddies）到如今有组织的高级持续性威胁（APT）团体，国家级攻击力量也深度介入网络空间博弈。臭名昭著的APT组织如Lazarus Group（据信与朝鲜政府有关）、APT28（ Fancy Bear，与俄罗斯军事情报局有关联）、APT41（具有商业犯罪和国家情报活动双重属性）等，其攻击能力和资源投入已经达到了令人震惊的水平。其次是攻击手段的复杂化程度不断提升。传统的单点攻击模式正在被多阶段、多路径的复合攻击所取代，攻击者往往能够根据目标环境的特点动态调整攻击策略，甚至利用合法工具和系统功能来规避检测。再次是攻击目标的泛化趋势——从最初以获取经济利益为直接目的，逐渐扩展到政治目的（如选举干预、信息战）、破坏目的（如针对关键基础设施的恐怖活动）和间谍目的（如窃取国家机密和商业机密）。

The current cybersecurity threat landscape exhibits several notable characteristics that profoundly influence the formulation and implementation of security protection strategies. First is the diversification of threat actors. From early individual hackers (Script Kiddies) to today's organized Advanced Persistent Threat (APT) groups, state-level attack forces have also deeply engaged in cyberspace competition. Notorious APT groups such as Lazarus Group (believed to be associated with the North Korean government), APT28 (Fancy Bear, linked to Russia's military intelligence agency), and APT41 (possessing dual attributes of commercial crime and national intelligence operations) have achieved astonishing levels of attack capability and resource investment. Second is the escalating sophistication of attack techniques. Traditional single-point attack patterns are being replaced by multi-stage, multi-path compound attacks, where attackers dynamically adjust their strategies based on target environment characteristics, even leveraging legitimate tools and system functions to evade detection. Third is the broadening of attack targets—from the initial direct purpose of economic gain to political purposes (such as election interference, information warfare), destructive purposes (such as terrorist activities targeting critical infrastructure), and espionage purposes (such as stealing state secrets and commercial secrets).

以2017年的WannaCry勒索软件攻击为例，这一事件充分展示了现代网络安全威胁的破坏力和传播速度。WannaCry利用美国国家安全局（NSA）泄露的漏洞利用工具EternalBlue进行传播，在短短几天内感染了全球超过150个国家的20多万台计算机。受害目标包括英国国家医疗服务体系（NHS）的多家医院，导致数千个预约和手术被迫取消；西班牙电信巨头Telefonica的多家分支机构；德国铁路系统；以及俄罗斯内政部、美国联邦快递等重要机构。据估算，WannaCry造成的直接经济损失超过80亿美元。这一攻击事件之所以造成如此巨大的影响，一方面是因为漏洞的通用性（影响Windows XP到Windows Server 2008的多个版本），另一方面则暴露出全球范围内系统补丁管理、应急响应机制等方面的严重不足。更为深远的影响在于，WannaCry开创了“漏洞武器化+勒索软件”这种高效攻击模式的先河，此后类似手法被反复使用，造成了巨大的社会和经济损失。

Taking the 2017 WannaCry ransomware attack as an example, this incident fully demonstrates the destructive power and propagation speed of modern cybersecurity threats. WannaCry leveraged the NSA-leaked exploit tool EternalBlue for propagation, infecting over 200,000 computers in more than 150 countries within just a few days. Victim targets included multiple hospitals of the UK's National Health Service (NHS), forcing thousands of appointments and surgeries to be cancelled; branches of Spanish telecommunications giant Telefonica; German railway systems; as well as Russia's Ministry of Internal Affairs, FedEx in the United States, and other important organizations. It is estimated that WannaCry caused direct economic losses exceeding $8 billion. The reasons this attack caused such massive impact were, on one hand, the universality of the vulnerability (affecting multiple versions from Windows XP to Windows Server 2008), and on the other hand, revealing serious deficiencies in system patch management and emergency response mechanisms globally. More far-reaching was that WannaCry pioneered the "vulnerability weaponization + ransomware" efficient attack pattern, which was repeatedly used afterward, causing enormous social and economic losses.

理解攻击类型的分类体系是构建有效防御策略的前提。从攻击的来源角度，可以分为主动攻击和被动攻击。主动攻击涉及对数据的篡改、伪造和系统功能的破坏，攻击者主动与目标系统进行交互；被动攻击则主要涉及对敏感信息的窃听和监视，攻击者尽可能隐蔽自身存在。从攻击的目标层次来看，可以分为协议层攻击（如ARP欺骗、DNS投毒）、系统层攻击（如缓冲区溢出、权限提升）和应用层攻击（如SQL注入、跨站脚本）。从攻击的技术特征来看，又可以分为利用已知漏洞的攻击（Known Exploit）、利用零日漏洞的攻击（Zero-Day Exploit）和社会工程学攻击。近年来，一种被称为“供应链攻击”的新型攻击模式引起了广泛关注——攻击者不再直接攻击最终目标，而是通过入侵目标组织的供应商或合作伙伴，利用信任关系作为跳板间接达成攻击目的。2020年的SolarWinds事件堪称供应链攻击的教科书式案例，攻击者在SolarWinds Orion平台的更新包中植入恶意代码，影响了包括美国政府机构（国土安全部、财政部、商务部和能源部等）、大型科技企业（微软、英特尔、思科）以及众多研究机构在内的约18000个组织，其中约250家被确认为受到了进一步的后续渗透。

Understanding the classification system of attack types is a prerequisite for constructing effective defense strategies. From the perspective of attack sources, attacks can be divided into active attacks and passive attacks. Active attacks involve data tampering, fabrication, and system function disruption, where attackers actively interact with target systems; passive attacks primarily involve eavesdropping and monitoring sensitive information, with attackers concealing their presence as much as possible. From the perspective of attack target layers, attacks can be divided into protocol layer attacks (such as ARP spoofing, DNS poisoning), system layer attacks (such as buffer overflows, privilege escalation), and application layer attacks (such as SQL injection, cross-site scripting). From the perspective