{"id":181,"date":"2025-12-28T20:47:29","date_gmt":"2025-12-28T19:47:29","guid":{"rendered":"https:\/\/mybox.com\/help\/?post_type=manual_kb&#038;p=181"},"modified":"2026-05-29T23:12:20","modified_gmt":"2026-05-29T21:12:20","slug":"atenuarea-si-efectele-ddos","status":"publish","type":"manual_kb","link":"https:\/\/mybox.com\/help\/ro\/knowledgebase\/ddos-mitigation-and-effects\/","title":{"rendered":"Atenuarea \u0219i efectele DDoS"},"content":{"rendered":"<div class=\"translation-block translation-block-merged\">\n<p class=\"wp-block-paragraph\">Atunci c\u00e2nd se coordoneaz\u0103 securitatea infrastructurii, se protejeaz\u0103 re\u021belele de produc\u021bie sau se consolideaz\u0103 mediile de testare a aplica\u021biilor, implementarea unui cadru multistratificat <strong>de atenuare a atacurilor DDoS<\/strong> reprezint\u0103 un standard opera\u021bional esen\u021bial. Deoarece tacticile de atac de tip \"denial-of-service\" distribuit evolueaz\u0103 continuu ca amploare \u0219i complexitate, un sistem robust de ap\u0103rare trebuie s\u0103 combine monitorizarea telemetric\u0103 \u00een timp real cu instrumente active de filtrare a traficului. Acest lucru asigur\u0103 c\u0103 re\u021beaua dvs. poate identifica, izola \u0219i neutraliza at\u00e2t semn\u0103turile cunoscute, c\u00e2t \u0219i anomaliile de trafic de tip \"zero-day\", f\u0103r\u0103 a \u00eentrerupe activitatea utilizatorilor legitimi.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 ez-toc-wrap-left counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Cuprins<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class=\"ez-toc-list ez-toc-list-level-1\"><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/ddos-mitigation-and-effects\/#Phase_1_Proactive_Risk_Assessment_and_Auditing\">Faza 1: Evaluarea proactiv\u0103 a riscurilor \u0219i auditul<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/ddos-mitigation-and-effects\/#Phase_2_Core_Traffic_Dispersal_and_Filtering_Strategies\">Faza 2: Strategii de dispersare \u0219i filtrare a traficului principal<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/ddos-mitigation-and-effects\/#Structural_Comparison_of_Mitigation_Tools\">Compara\u021bie structural\u0103 a instrumentelor de atenuare<\/a><\/li><\/ul><\/nav><\/div>\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Phase_1_Proactive_Risk_Assessment_and_Auditing\"><\/span>Faza 1: Evaluarea proactiv\u0103 a riscurilor \u0219i auditul<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Baza oric\u0103rei strategii defensive este un ciclu de via\u021b\u0103 continuu al auditului. De\u0219i este imposibil din punct de vedere tehnic s\u0103 \u00eempiedici un actor r\u0103u inten\u021bionat s\u0103 lanseze un atac de tip \"trafic flood\" \u00eempotriva terminalelor tale expuse publicului, o \u00een\u021belegere detaliat\u0103 a punctelor forte \u0219i a vulnerabilit\u0103\u021bilor arhitecturale determin\u0103 indicatorii t\u0103i de supravie\u021buire.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Urm\u0103rirea activelor \u0219i cartografierea suprafe\u021bei de expunere:<\/strong> Organiza\u021biile trebuie s\u0103 efectueze audituri de rutin\u0103 asupra tuturor serverelor cloud, dispozitivelor periferice IoT, echilibratoarelor de sarcin\u0103 \u0219i gateway-urilor de re\u021bea.<\/li>\n\n\n\n<li><strong>Identificarea segmentelor vulnerabile:<\/strong> Cartografierea aplica\u021biilor cu utilizare intens\u0103 a bazelor de date, a punctelor finale API deschise \u0219i a g\u00e2tuirilor de l\u0103\u021bime de band\u0103 redus\u0103 permite echipelor de securitate a re\u021belei s\u0103 creeze reguli de protec\u021bie \u021bintite \u00een jurul activelor cu cel mai ridicat risc, \u00eenainte ca o infiltrare s\u0103 aib\u0103 loc.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Phase_2_Core_Traffic_Dispersal_and_Filtering_Strategies\"><\/span>Faza 2: Strategii de dispersare \u0219i filtrare a traficului de baz\u0103<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<\/div>\n\n<div id=\"mybox-4058074171\" class=\"mybox-content mybox-entity-placement\"><div class=\"early-access-banner-inpost\">\r\n  <div class=\"banner-left-inpost\">\r\n    <div class=\"icon-box-inpost\">\r\n      <img decoding=\"async\" src=\"https:\/\/mybox.com\/help\/wp-content\/uploads\/2026\/02\/square-info-icon.svg\" alt=\"Info\">\r\n    <\/div>\r\n    <div class=\"text-box-inpost\">\r\n      <span class=\"label-inpost\"><span class=\"translation-block translation-block-banner-text\">Acces timpuriu<\/span><\/span>\r\n      <h4><span class=\"translation-block translation-block-banner-text\">Mai ave\u021bi nevoie de ajutor?<\/span><\/h4>\r\n      <p><span class=\"translation-block translation-block-banner-text\">Contacta\u021bi echipa noastr\u0103 de servicii pentru clien\u021bi.<\/span><\/p>\r\n    <\/div>\r\n  <\/div>\r\n\r\n  <div class=\"banner-right-inpost\">\r\n    <a href=\"https:\/\/panel.mybox.com\/helpdesk2\/v\/list\/\" class=\"banner-button-inpost\"><span class=\"translation-block translation-block-banner-text\">Trimite mesaj<\/span><\/a>\r\n  <\/div>\r\n<\/div><\/div>\n\n<div class=\"translation-block translation-block-merged\"><p class=\"wp-block-paragraph\">Atunci c\u00e2nd se \u00eenregistreaz\u0103 un v\u00e2rf de volum anormal la grani\u021bele re\u021belei, administratorii de re\u021bea implementeaz\u0103 contram\u0103suri structurale specifice pentru a gestiona afluxul.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Diferen\u021bierea traficului \u0219i distribu\u021bia Anycast<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Prioritatea imediat\u0103 \u00een timpul unui atac activ este evaluarea sursei \u0219i a calit\u0103\u021bii traficului de intrare. \u00centreruperea complet\u0103 a liniilor de conexiune este rareori o op\u021biune, deoarece blocarea accesului global f\u0103r\u0103 discern\u0103m\u00e2nt ar duce, f\u0103r\u0103 inten\u021bie, la \u00eendeplinirea obiectivului atacatorului de a face serviciul inaccesibil.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pentru a gestiona volumul, organiza\u021biile implementeaz\u0103 <strong>re\u021bele Anycast<\/strong>. Rutarea Anycast aloc\u0103 un spa\u021biu de adrese IP unic \u0219i unificat \u00eentr-un cluster de noduri de server distribuit la nivel global. Atunci c\u00e2nd o re\u021bea de bo\u021bi lanseaz\u0103 un atac volumetric masiv, infrastructura Anycast distribuie automat pachetele de trafic primite \u00eentre centrele de date regionale separate. Prin divizarea unui atac volumetric masiv localizat \u00een fluxuri mai mici \u0219i mai u\u0219or de gestionat, re\u021beaua distribuit\u0103 absoarbe cu u\u0219urin\u021b\u0103 impactul, permi\u021b\u00e2nd modulelor locale de filtrare s\u0103 elimine pachetele r\u0103u inten\u021bionate f\u0103r\u0103 a bloca serverul principal al aplica\u021biei.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Limitarea ratei (controlul limit\u0103rii vitezei)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Limitarea ratei implic\u0103 codificarea strict\u0103 a unor praguri \u00een fi\u0219ierele de configurare ale re\u021belei pentru a reglementa num\u0103rul maxim de solicit\u0103ri simultane pe care o interfa\u021b\u0103 de destina\u021bie individual\u0103 sau o adres\u0103 IP surs\u0103 le poate executa \u00eentr-un interval de timp specific.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Aliniere pe mai multe fronturi:<\/strong> De\u0219i limitarea de baz\u0103 a ratei nu poate opri singur\u0103 un flux masiv \u0219i extrem de descentralizat la nivelul stratului de aplica\u021bie, aceasta serve\u0219te ca o linie excelent\u0103 de ap\u0103rare pentru stabilizarea portalurilor de autentificare, a gateway-urilor API \u0219i a scripturilor de finalizare a comenzii \u00een timpul cre\u0219terilor de trafic din faza ini\u021bial\u0103.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Firewall-uri pentru aplica\u021bii web (WAF \u2013 Protec\u021bie la nivelul stratului 7)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Pentru a neutraliza atacurile sofisticate <strong>de la nivelul 7 (nivelul aplica\u021biei)<\/strong> care imit\u0103 comportamentele autentice ale utilizatorilor, organiza\u021biile implementeaz\u0103 un <strong>firewall pentru aplica\u021bii web (WAF)<\/strong>. Func\u021bion\u00e2nd ca un proxy invers de \u00eenalt\u0103 securitate pozi\u021bionat direct \u00eentre web-ul public \u0219i serverele gazd\u0103 interne de origine, WAF inspecteaz\u0103 activ datele de \u00eenc\u0103rcare ale aplica\u021biei din cererile HTTP\/HTTPS care trec prin el.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Inginerii de re\u021bea configureaz\u0103 seturi de reguli WAF personalizate \u0219i dinamice pentru a filtra cererile primite. Dac\u0103 se identific\u0103 un model de atac \u2014 cum ar fi un \u0219ir User-Agent automatizat specific, o distribu\u021bie geografic\u0103 neregulat\u0103 sau o semn\u0103tur\u0103 repetat\u0103 a interog\u0103rilor bazei de date \u2014 WAF respinge cererile care corespund acestor criterii la marginea re\u021belei. Aceste reguli pot fi ajustate rapid, pe parcurs, pe m\u0103sur\u0103 ce botnetul \u00ee\u0219i schimb\u0103 tacticile de atac.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Rutare c\u0103tre \"gaura neagr\u0103\" (comutatorul de oprire la perimetru)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Atunci c\u00e2nd un atac de tip \u201cflood\u201d volumetric dep\u0103\u0219e\u0219te complet l\u0103\u021bimea de band\u0103 disponibil\u0103 a unei organiza\u021bii sau capacitatea instrumentelor de filtrare, administratorii sau furnizorii de servicii de internet (ISP) din amonte pot declan\u0219a o manevr\u0103 defensiv\u0103 cunoscut\u0103 sub numele de <strong>Black Hole Routing<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Administratorul de re\u021bea modific\u0103 tabelele de rutare pentru a direc\u021biona tot traficul de intrare destinat gazdei victime c\u0103tre o interfa\u021b\u0103 de destina\u021bie inexistent\u0103 (o rut\u0103 nul\u0103 sau \"gaur\u0103 neagr\u0103\"), unde pachetele sunt imediat respinse \u0219i eliminate. De\u0219i aceast\u0103 m\u0103sur\u0103 extrem\u0103 protejeaz\u0103 cu succes infrastructura de re\u021bea mai larg\u0103 \u00eempotriva colapsului cauzat de valul de trafic, ea \u00eentrerupe totodat\u0103 toate conexiunile utilizatorilor legitimi, ceea ce duce la pierderi temporare la nivel opera\u021bional \u0219i de afaceri.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Structural_Comparison_of_Mitigation_Tools\"><\/span>Compara\u021bie structural\u0103 a instrumentelor de atenuare<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td><strong>Mecanism de atenuare<\/strong><\/td><td><strong>Nivelul OSI vizat<\/strong><\/td><td><strong>Avantaj opera\u021bional<\/strong><\/td><td><strong>Compromis tehnic \/ Risc<\/strong><\/td><\/tr><\/thead><tbody><tr><td><strong>Dispersie Anycast<\/strong><\/td><td>Stratul 3 \u0219i Stratul 4<\/td><td>Distribuie volume masive de trafic la nivel global pentru a preveni saturarea canalelor locale.<\/td><td>Necesit\u0103 configura\u021bii complexe de rutare \u0219i o infrastructur\u0103 de noduri distribuite.<\/td><\/tr><tr><td><strong>Proxy invers WAF<\/strong><\/td><td>Stratul 7 (Aplica\u021bie)<\/td><td>Inspecteaz\u0103 con\u021binutul pachetelor pentru a filtra semn\u0103turile specifice ale cererilor HTTP r\u0103u inten\u021bionate.<\/td><td>Introduce o sarcin\u0103 de procesare minor\u0103 pentru inspec\u021bia profund\u0103 a pachetelor.<\/td><\/tr><tr><td><strong>Limitarea ratei<\/strong><\/td><td>Stratul 4 \u0219i Stratul 7<\/td><td>\u00cempiedic\u0103 robo\u021bii automatiza\u021bi s\u0103 suprasolicite formularele de autentificare sau de finalizare a comenzii, care consum\u0103 multe resurse.<\/td><td>Poate restric\u021biona involuntar utilizatorii avansa\u021bi dac\u0103 pragurile sunt configurate prea strict.<\/td><\/tr><tr><td><strong>Rutare \u201eBlack Hole\u201d<\/strong><\/td><td>Stratul 3 (Re\u021bea)<\/td><td>Respinge instantaneu traficul cople\u0219itor pentru a p\u0103stra integritatea re\u021belei mai largi.<\/td><td>Ac\u021bioneaz\u0103 ca o \u00eentrerupere autoimpus\u0103, \u00eentrerup\u00e2nd f\u0103r\u0103 discriminare conexiunile utilizatorilor valizi.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n<\/div>","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"template":"","format":"standard","manualknowledgebasecat":[10,42],"manual_kb_tag":[980,3973,3974,3975,3976,3977,3978,3979,3980,3981],"class_list":["post-181","manual_kb","type-manual_kb","status-publish","format-standard","hentry","manualknowledgebasecat-safety","manualknowledgebasecat-miscellaneous","manual_kb_tag-distributed-denial-of-service","manual_kb_tag-denial-of-service-attacks","manual_kb_tag-denial-of-service-mitigation","manual_kb_tag-distributed-denial-of-service-protection","manual_kb_tag-mitigation-strategies","manual_kb_tag-risk-assessment","manual_kb_tag-network-risk-assessment","manual_kb_tag-traffic-differentiation","manual_kb_tag-traffic-analysis","manual_kb_tag-anycast-mitigation"],"_links":{"self":[{"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb\/181","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb"}],"about":[{"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/types\/manual_kb"}],"author":[{"embeddable":true,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/users\/1"}],"version-history":[{"count":1,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb\/181\/revisions"}],"predecessor-version":[{"id":8957,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb\/181\/revisions\/8957"}],"wp:attachment":[{"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/media?parent=181"}],"wp:term":[{"taxonomy":"manualknowledgebasecat","embeddable":true,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manualknowledgebasecat?post=181"},{"taxonomy":"manual_kb_tag","embeddable":true,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb_tag?post=181"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}