{"id":96219,"date":"2020-10-09T13:42:03","date_gmt":"2020-10-09T11:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0"},"modified":"2020-10-09T13:42:03","modified_gmt":"2020-10-09T11:42:03","slug":"vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","title":{"rendered":"Sortie du syst\u00e8me de d\u00e9tection des attaques Suricata 6.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Apr\u00e8s un an de d\u00e9veloppement, l'organisation OISF (Open Information Security Foundation) <noindex><a rel=\"nofollow\" href=\"https:\/\/suricata-ids.org\/2020\/10\/08\/suricata-6-0-0-released\">a publi\u00e9<\/a><\/noindex> lance un syst\u00e8me de d\u00e9tection et de pr\u00e9vention des intrusions r\u00e9seau <noindex><a rel=\"nofollow\" href=\"http:\/\/suricata-ids.org\/\">Suricata 6.0<\/a><\/noindex>, qui fournit des outils d'inspection de divers types de trafic. Dans les configurations de Suricata, il est possible d'utiliser <noindex><a rel=\"nofollow\" href=\"http:\/\/www.snort.org\/vrt\">une base de signatures<\/a><\/noindex>, d\u00e9velopp\u00e9e par le projet Snort, ainsi que des ensembles de r\u00e8gles <noindex><a rel=\"nofollow\" href=\"http:\/\/rules.emergingthreats.net\/\">Emerging Threats<\/a><\/noindex> et <noindex><a rel=\"nofollow\" href=\"http:\/\/rules.emergingthreatspro.com\/\">Emerging Threats Pro<\/a><\/noindex>. Les codes sources du projet <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OISF\/suricata\">sont distribu\u00e9s<\/a><\/noindex> sous licence GPLv2. <\/p>\n<p>Principales modifications :<\/p>\n<ul>\n<li class=\"l\"> Support initial pour HTTP\/2.\n<li class=\"l\"> Support des protocoles RFB et MQTT, y compris la possibilit\u00e9 de d\u00e9tecter le protocole et de cr\u00e9er des journaux.\n<li class=\"l\"> Possibilit\u00e9 de journaliser le protocole DCERPC.\n<li class=\"l\"> Am\u00e9lioration significative des performances de journalisation gr\u00e2ce au sous-syst\u00e8me EVE, fournissant des \u00e9v\u00e9nements au format JSON. L'acc\u00e9l\u00e9ration a \u00e9t\u00e9 atteinte gr\u00e2ce \u00e0 l'utilisation d'un nouveau constructeur de flux JSON, \u00e9crit en Rust.\n<li class=\"l\"> Scalabilit\u00e9 am\u00e9lior\u00e9e du syst\u00e8me de journaux EVE et possibilit\u00e9 de cr\u00e9er un fichier journal distinct pour chaque flux.\n<li class=\"l\"> Possibilit\u00e9 de d\u00e9finir des conditions pour r\u00e9initialiser les informations dans le journal.\n<li class=\"l\"> Possibilit\u00e9 de refl\u00e9ter les adresses MAC dans le journal EVE et d'am\u00e9liorer la granularit\u00e9 du journal DNS.\n<li class=\"l\"> Am\u00e9lioration des performances du moteur de traitement des flux (flow engine).\n<li class=\"l\"> Support pour l'identification des impl\u00e9mentations SSH (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/salesforce\/hassh\">) et DHCP.<\/a><\/noindex>).\n<li class=\"l\"> Impl\u00e9mentation d'un d\u00e9codeur de tunnels GENEVE.\n<li class=\"l\"> Le code pour le traitement <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/ASN.1\">ASN.1<\/a><\/noindex>, DCERPC et SSH a \u00e9t\u00e9 r\u00e9\u00e9crit en Rust. Le support de nouveaux protocoles a \u00e9galement \u00e9t\u00e9 impl\u00e9ment\u00e9 en Rust.\n<li class=\"l\"> Le langage de d\u00e9finition des r\u00e8gles a \u00e9t\u00e9 enrichi avec le mot-cl\u00e9 byte_jump, qui prend d\u00e9sormais en charge le param\u00e8tre from_end, et dans byte_test \u2014 le param\u00e8tre bitmask. Le mot-cl\u00e9 pcrexform a \u00e9t\u00e9 impl\u00e9ment\u00e9, permettant d'utiliser des expressions r\u00e9guli\u00e8res (pcre) pour capturer des sous-cha\u00eenes. La conversion urldecode a \u00e9t\u00e9 ajout\u00e9e. Le mot-cl\u00e9 byte_math a \u00e9t\u00e9 instaur\u00e9.\n<li class=\"l\"> Offre la possibilit\u00e9 d'utiliser cbindgen pour g\u00e9n\u00e9rer des liaisons en Rust et C.\n<li class=\"l\"> Support initial des plugins ajout\u00e9.\n<\/ul>\n<p>Caract\u00e9ristiques de Suricata :\n<\/p>\n<ul>\n<li class=\"l\"> Utilisation d'un format unifi\u00e9 pour le retour des r\u00e9sultats de v\u00e9rification <noindex><a rel=\"nofollow\" href=\"http:\/\/searchsecuritychannel.techtarget.com\/tip\/0,289483,sid97_gci1339679,00.html\">Unified2<\/a><\/noindex>, \u00e9galement utilis\u00e9 par le projet Snort, ce qui permet d'utiliser des outils standard d'analyse, tels que <noindex><a rel=\"nofollow\" href=\"http:\/\/www.securixlive.com\/barnyard2\/index.php\">barnyard2<\/a><\/noindex>. Possibilit\u00e9 d'int\u00e9gration avec les produits BASE, Snorby, Sguil et SQueRT. Support pour l'exportation au format PCAP;\n<\/li>\n<li class=\"l\">  Prise en charge de la d\u00e9tection automatique des protocoles (IP, TCP, UDP, ICMP, HTTP, TLS, FTP, SMB, etc.), permettant de travailler avec des r\u00e8gles bas\u00e9es uniquement sur le type de protocole, sans se r\u00e9f\u00e9rer au num\u00e9ro de port (par exemple, bloquer le trafic HTTP sur un port non standard). Pr\u00e9sence de d\u00e9codeurs pour les protocoles HTTP, SSL, TLS, SMB, SMB2, DCERPC, SMTP, FTP et SSH ;\n<\/li>\n<li class=\"l\"> Syst\u00e8me d'analyse puissant du trafic HTTP, utilisant une biblioth\u00e8que sp\u00e9ciale HTP, d\u00e9velopp\u00e9e par l'auteur du projet Mod_Security pour analyser et normaliser le trafic HTTP. Un module est disponible pour tenir un journal d\u00e9taill\u00e9 des transmissions HTTP en transit, le journal est enregistr\u00e9 dans un format standard.<br \/>\nApache. Support de l'extraction et de la v\u00e9rification des fichiers transmis via le protocole HTTP. Support de l'analyse du contenu compress\u00e9. Possibilit\u00e9 d'identification par URI, Cookie, en-t\u00eates, user-agent, corps de la requ\u00eate\/r\u00e9ponse ;<\/p>\n<\/li>\n<li class=\"l\"> Prise en charge de diverses interfaces pour l'interception du trafic, y compris NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING. Analyse possible de fichiers d\u00e9j\u00e0 sauvegard\u00e9s au format PCAP ;\n<\/li>\n<li class=\"l\"> Performances \u00e9lev\u00e9es, capables de traiter des d\u00e9bits allant jusqu'\u00e0 10 gigabits\/seconde sur du mat\u00e9riel standard.\n<\/li>\n<li class=\"l\"> M\u00e9canisme de correspondance haute performance bas\u00e9 sur un masque avec de grands ensembles d'adresses IP. Prise en charge de l'extraction de contenu par masque et expressions r\u00e9guli\u00e8res. Extraction de fichiers \u00e0 partir du trafic, y compris leur identification par nom, type ou checksum MD5.\n<\/li>\n<li class=\"l\"> Possibilit\u00e9 d'utiliser des variables dans les r\u00e8gles : il est possible de conserver des informations provenant du flux et de les utiliser ult\u00e9rieurement dans d'autres r\u00e8gles ;\n<\/li>\n<li class=\"l\"> Utilisation du format YAML dans les fichiers de configuration, permettant de maintenir une clart\u00e9 tout en \u00e9tant facilement traitable par machine ;\n<\/li>\n<li class=\"l\"> Prise en charge compl\u00e8te de l'IPv6 ;\n<\/li>\n<li class=\"l\"> Moteur int\u00e9gr\u00e9 pour la d\u00e9flectation automatique et la reconstruction des paquets, permettant d'assurer un traitement correct des flux, quel que soit l'ordre d'arriv\u00e9e des paquets ;\n<\/li>\n<li class=\"l\"> Prise en charge des protocoles de tunneling : Teredo, IP-IP, IP6-IP4, IP4-IP6, GRE ;\n<\/li>\n<li class=\"l\"> Prise en charge du d\u00e9codage des paquets : IPv4, IPv6, TCP, UDP, SCTP, ICMPv4, ICMPv6, GRE, Ethernet, PPP, PPPoE, Raw, SLL, VLAN ;\n<\/li>\n<li class=\"l\"> Mode de conservation des cl\u00e9s et certificats dans le cadre des connexions TLS\/SSL ;\n<\/li>\n<li class=\"l\"> Possibilit\u00e9 d'\u00e9crire des scripts en Lua pour assurer une analyse avanc\u00e9e et mettre en \u0153uvre des fonctionnalit\u00e9s suppl\u00e9mentaires n\u00e9cessaires pour identifier des types de trafic pour lesquels les r\u00e8gles standard ne suffisent pas.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Source : <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53857\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 Suricata 6.0, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0438\u043d\u0441\u043f\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 Suricata \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0430\u0437\u044b \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Snort, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u043f\u0440\u0430\u0432\u0438\u043b Emerging Threats \u0438 Emerging Threats Pro. \u0418\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f: [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-96219","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a Suricata 6.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sortie du syst\u00e8me de d\u00e9tection des menaces Suricata 6.0 | ProHoster","description":"Apr\u00e8s un an de d\u00e9veloppement, l'organisation OISF (Open Information Security Foundation) a publi\u00e9 la version du syst\u00e8me.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a Suricata 6.0 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T11:42:03+00:00","article:modified_time":"2020-10-09T11:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96219","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:22","updated":"2022-10-02 08:38:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/96219","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=96219"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/96219\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=96219"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=96219"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=96219"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}