{"id":96219,"date":"2020-10-09T13:42:03","date_gmt":"2020-10-09T11:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0"},"modified":"2020-10-09T13:42:03","modified_gmt":"2020-10-09T11:42:03","slug":"vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","title":{"rendered":"Udgivelsen af indtr\u00e6ngingsdetekteringssystemet Suricata 6.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Efter et \u00e5rs udvikling har organisationen OISF (Open Information Security Foundation) <noindex><a rel=\"nofollow\" href=\"https:\/\/suricata-ids.org\/2020\/10\/08\/suricata-6-0-0-released\">offentliggjorde<\/a><\/noindex> udgivet et system til detektion og forebyggelse af netv\u00e6rksindtr\u00e6ngen <noindex><a rel=\"nofollow\" href=\"http:\/\/suricata-ids.org\/\">Suricata 6.0<\/a><\/noindex>, som tilbyder v\u00e6rkt\u00f8jer til inspektion af forskellige typer trafik. I konfigurationer af Suricata er det muligt at anvende <noindex><a rel=\"nofollow\" href=\"http:\/\/www.snort.org\/vrt\">signaturdatabaser<\/a><\/noindex>, der udvikles af projektet Snort, samt reglerne fra <noindex><a rel=\"nofollow\" href=\"http:\/\/rules.emergingthreats.net\/\">Emerging Threats<\/a><\/noindex> og <noindex><a rel=\"nofollow\" href=\"http:\/\/rules.emergingthreatspro.com\/\">Emerging Threats Pro<\/a><\/noindex>. Kildekoderne til projektet <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OISF\/suricata\">distribueres<\/a><\/noindex> er under GPLv2-licensen. <\/p>\n<p>Vigtige \u00e6ndringer:<\/p>\n<ul>\n<li class=\"l\"> Begyndende support for HTTP\/2.\n<li class=\"l\"> Support for RFB og MQTT-protokoller, inklusive mulighed for protokoldetektion og logging.\n<li class=\"l\"> Mulighed for logging af DCERPC-protokollen.\n<li class=\"l\"> Betydelig forbedring af loggerens ydeevne gennem EVE-subsystemet, der muligg\u00f8r output af h\u00e6ndelser i JSON-format. Hastigheden er opn\u00e5et ved at bruge en ny JSON-builder skrevet i Rust.\n<li class=\"l\"> Skalerbarheden af EVE-logsystemet er forbedret, og der er tilf\u00f8jet mulighed for at f\u00f8re separate logfiler for hver str\u00f8m.\n<li class=\"l\"> Mulighed for at definere betingelser for at nulstille oplysninger i loggen.\n<li class=\"l\"> Mulighed for at inkludere MAC-adresser i EVE-loggen og forbedre detaljeringen af DNS-loggen.\n<li class=\"l\"> Forbedret ydeevne af flow-motoren.\n<li class=\"l\"> Support til identifikation af SSH-implementationer (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/salesforce\/hassh\">HASSH<\/a><\/noindex>).\n<li class=\"l\"> Implementering af GENEVE-tunnel dekoder.\n<li class=\"l\"> Koden til behandling af <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/ASN.1\">ASN.1<\/a><\/noindex>, DCERPC og SSH er gen skrevet i Rust. Support for nye protokoller er ogs\u00e5 implementeret i Rust.\n<li class=\"l\"> I regelsproget er der tilf\u00f8jet support for parameteren from_end i n\u00f8gleordet byte_jump, samt bitmask i byte_test. Der er implementeret et n\u00f8gleord pcrexform, der muligg\u00f8r brugen af regul\u00e6re udtryk (pcre) til at fange delstrenge. Der er tilf\u00f8jet en urldecode konvertering. N\u00f8gleordet byte_math er ogs\u00e5 blevet tilf\u00f8jet.\n<li class=\"l\"> Mulighed for at bruge cbindgen til at generere bindings p\u00e5 Rust- og C-sprog.\n<li class=\"l\"> Begyndende support for plugins.\n<\/ul>\n<p>Funktioner i Suricata:\n<\/p>\n<ul>\n<li class=\"l\"> Brug af et ensartet format til output af resultaterne af inspektioner <noindex><a rel=\"nofollow\" href=\"http:\/\/searchsecuritychannel.techtarget.com\/tip\/0,289483,sid97_gci1339679,00.html\">Unified2<\/a><\/noindex>, som ogs\u00e5 bruges af projektet Snort, hvilket muligg\u00f8r brug af standardv\u00e6rkt\u00f8jer til analyse, s\u00e5som <noindex><a rel=\"nofollow\" href=\"http:\/\/www.securixlive.com\/barnyard2\/index.php\">barnyard2<\/a><\/noindex>. Mulighed for integration med produkter som BASE, Snorby, Sguil og SQueRT. Support for output i PCAP-format;\n<\/li>\n<li class=\"l\">  Underst\u00f8ttelse af automatisk identifikation af protokoller (IP, TCP, UDP, ICMP, HTTP, TLS, FTP, SMB osv.), der g\u00f8r det muligt at arbejde med regler kun baseret p\u00e5 protokoltypen, uden tilknytning til portnummeret (f.eks. blokere HTTP-trafik p\u00e5 en ikke-standard port). Tilstedev\u00e6relsen af dekodere til protokoller som HTTP, SSL, TLS, SMB, SMB2, DCERPC, SMTP, FTP og SSH;\n<\/li>\n<li class=\"l\"> En kraftfuld HTTP-trafikanalysesystem, der bruger et specielt bibliotek HTP til at analysere og normalisere HTTP-trafik, udviklet af forfatteren af Mod_Security-projektet. Der er en modul til at f\u00f8re detaljerede logfiler over transit HTTP-transmissioner, loggen gemmes i standardformat;<br \/>\nApache. Underst\u00f8ttelse af udtr\u00e6kning og verifikation af filer overf\u00f8rt via HTTP-protokollen. Underst\u00f8ttelse af analyse af komprimeret indhold. Mulighed for identifikation baseret p\u00e5 URI, cookies, headers, user-agent, samt indholdet af anmodningen\/svaret;<\/p>\n<\/li>\n<li class=\"l\"> Underst\u00f8ttelse af forskellige gr\u00e6n interfaces til trafikfangst, herunder NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING. Mulighed for at analysere allerede gemte filer i PCAP-format;\n<\/li>\n<li class=\"l\"> H\u00f8j ydeevne, evne til at behandle streams op til 10 gigabit\/s p\u00e5 almindeligt udstyr.\n<\/li>\n<li class=\"l\"> H\u00f8jtydende maskematch-mekanisme med store s\u00e6t IP-adresser. Underst\u00f8ttelse af indholdsforskydning baseret p\u00e5 masker og regul\u00e6re udtryk. Udtr\u00e6kning af filer fra trafikken, herunder identifikation baseret p\u00e5 navn, type eller MD5-kontrolsum.\n<\/li>\n<li class=\"l\"> Mulighed for at bruge variable i regler: man kan gemme information fra streamen og senere bruge den i andre regler;\n<\/li>\n<li class=\"l\"> Brug af YAML-formatet i konfigurationsfiler, hvilket g\u00f8r det muligt at bevare overskueligheden samtidig med at maskinerne kan behandle dem nemt;\n<\/li>\n<li class=\"l\"> Fuld underst\u00f8ttelse af IPv6;\n<\/li>\n<li class=\"l\"> Indbygget motor til automatisk defragmentering og gensamling af pakker, der muligg\u00f8r korrekt behandling af streams uanset r\u00e6kkef\u00f8lgen af pakkerne;\n<\/li>\n<li class=\"l\"> Underst\u00f8ttelse af tunnelprotokoller: Teredo, IP-IP, IP6-IP4, IP4-IP6, GRE;\n<\/li>\n<li class=\"l\"> Underst\u00f8ttelse af dekodering af pakker: IPv4, IPv6, TCP, UDP, SCTP, ICMPv4, ICMPv6, GRE, Ethernet, PPP, PPPoE, Raw, SLL, VLAN;\n<\/li>\n<li class=\"l\"> Logf\u00f8ringsfunktion til n\u00f8gler og certifikater, der indg\u00e5r i TLS\/SSL-forbindelser;\n<\/li>\n<li class=\"l\"> Mulighed for at skrive scripts i Lua-sproget for at sikre udvidet analyse og implementering af yderligere funktioner, der er n\u00f8dvendige for at definere trafiktyper, som ikke kan h\u00e5ndteres med standardregler;\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Kilde: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53857\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 Suricata 6.0, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0438\u043d\u0441\u043f\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 Suricata \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0430\u0437\u044b \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Snort, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u043f\u0440\u0430\u0432\u0438\u043b Emerging Threats \u0438 Emerging Threats Pro. \u0418\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f: [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-96219","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a Suricata 6.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Udgivelse af angrebsdetektionssystemet Suricata 6.0 | ProHoster","description":"Efter et \u00e5rs udvikling offentliggjorde organisationen OISF (Open Information Security Foundation) en release af systemet.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a Suricata 6.0 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T11:42:03+00:00","article:modified_time":"2020-10-09T11:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96219","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:22","updated":"2022-10-02 08:38:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/96219","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=96219"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/96219\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=96219"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=96219"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=96219"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}