Release of the Suricata 6.0 attack detection system

After a year of development, the organization OISF (Open Information Security Foundation) released release of the intrusion detection and prevention system Suricata 6.0, which provides tools for inspecting various types of traffic. In Suricata configurations, it is permissible to engage signature databases, developed by the Snort project, as well as rule sets Emerging Threats and Emerging Threats Pro. The source codes of the project is distributed is licensed under GPLv2.

Key Changes:

• Initial support for HTTP/2.
• Support for RFB and MQTT protocols, including protocol detection and logging capability.
• Logging capability for the DCERPC protocol.
• Significant performance improvements in logging through the EVE subsystem, which outputs events in JSON format. The acceleration has been achieved by utilizing a new JSON stream builder written in Rust.
• Increased scalability of the EVE logging system and the implementation of a dedicated log file for each thread.
• Ability to define conditions for flushing log information.
• Ability to reflect MAC addresses in the EVE log and increased detail in DNS logging.
• Enhanced performance of the flow engine.
• Support for identifying SSH implementations () and DHCP has been added.).
• Implementation of the GENEVE tunnel decoder.
• The code for processing has been rewritten in Rust ASN.1, DCERPC, and SSH. Support for new protocols has also been implemented in Rust.
• In the rule definition language, the byte_jump keyword has been updated to support the from_end parameter, and the byte_test keyword has been updated to include the bitmask parameter. The pcrexform keyword has been implemented, allowing the use of regular expressions (pcre) for substring capturing. urldecode transformation has been added. Additionally, the byte_math keyword has been introduced.
• Providing the ability to use cbindgen for generating bindings in Rust and C languages.
• Initial support for plugins has been added.

Features of Suricata:

• Using a unified format for outputting verification results Unified2, which is also used by the Snort project, allows the use of standard analysis tools such as barnyard2. Integration with BASE, Snorby, Sguil, and SQueRT products is possible. Support for output in PCAP format;
• Support for automatic protocol detection (IP, TCP, UDP, ICMP, HTTP, TLS, FTP, SMB, etc.), allowing operation in rules based solely on the protocol type, without being tied to a port number (for example, blocking HTTP traffic on a non-standard port). There are decoders for HTTP, SSL, TLS, SMB, SMB2, DCERPC, SMTP, FTP, and SSH protocols;
• A powerful HTTP traffic analysis system that uses a special library, HTP, created by the author of the Mod_Security project, for parsing and normalizing HTTP traffic. A module for keeping a detailed log of transit HTTP transfers is available, and the log is saved in standard
  Apache format. The extraction and verification of files transmitted via the HTTP protocol is supported. There is support for parsing compressed content. Identification by URI, Cookie, headers, user-agent, and request/response body is possible;
• Support for various interfaces for traffic interception, including NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING. Analysis of already saved files in PCAP format is possible;
• High performance, capable of processing streams of up to 10 gigabits/second on standard hardware.
• A high-performance pattern matching mechanism with large sets of IP addresses. Support for content filtering by masks and regular expressions. Extraction of files from traffic, including identification by name, type, or MD5 checksum.
• The ability to use variables in rules: you can save information from the stream and later use it in other rules;
• Using the YAML format in configuration files, which allows for clarity while being easy for machine processing;
• Full support for IPv6;
• Built-in engine for automatic defragmentation and reassembly of packets, allowing for correct stream processing, regardless of the order of packet arrival;
• Support for tunneling protocols: Teredo, IP-IP, IP6-IP4, IP4-IP6, GRE;
• Support for packet decoding: IPv4, IPv6, TCP, UDP, SCTP, ICMPv4, ICMPv6, GRE, Ethernet, PPP, PPPoE, Raw, SLL, VLAN;
• Logging mode for keys and certificates involved in TLS/SSL connections;
• The ability to write scripts in Lua for enhanced analysis and implementation of additional features necessary for identifying types of traffic where standard rules are insufficient.

Source: opennet.ru