{"id":96219,"date":"2020-10-09T13:42:03","date_gmt":"2020-10-09T11:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0"},"modified":"2020-10-09T13:42:03","modified_gmt":"2020-10-09T11:42:03","slug":"vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","title":{"rendered":"Objavljeno je izdanje sustava za otkrivanje napada Suricata 6.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Nakon godine razvoja, organizacija OISF (Open Information Security Foundation) <noindex><a rel=\"nofollow\" href=\"https:\/\/suricata-ids.org\/2020\/10\/08\/suricata-6-0-0-released\">objavila<\/a><\/noindex> izdala je sustav za otkrivanje i sprje\u010davanje mre\u017enih provale <noindex><a rel=\"nofollow\" href=\"http:\/\/suricata-ids.org\/\">Suricata 6.0<\/a><\/noindex>, koji pru\u017ea sredstva za inspekciju razli\u010ditih vrsta prometa. U konfiguracijama Suricata mogu\u0107e je koristiti <noindex><a rel=\"nofollow\" href=\"http:\/\/www.snort.org\/vrt\">bazu potpisa<\/a><\/noindex>, koju razvija projekt Snort, kao i skupove pravila <noindex><a rel=\"nofollow\" href=\"http:\/\/rules.emergingthreats.net\/\">Emerging Threats<\/a><\/noindex> i <noindex><a rel=\"nofollow\" href=\"http:\/\/rules.emergingthreatspro.com\/\">Emerging Threats Pro<\/a><\/noindex>. Izvorni kodovi projekta <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OISF\/suricata\">distribuiraju se<\/a><\/noindex> pod GPLv2 licencom. <\/p>\n<p>Glavne promjene:<\/p>\n<ul>\n<li class=\"l\"> Po\u010detna podr\u0161ka za HTTP\/2.\n<li class=\"l\"> Podr\u0161ka za protokole RFB i MQTT, uklju\u010duju\u0107i mogu\u0107nost prepoznavanja protokola i vo\u0111enja loga.\n<li class=\"l\"> Mogu\u0107nost vo\u0111enja loga za protokol DCERPC.\n<li class=\"l\"> Zna\u010dajno pobolj\u0161anje performansi vo\u0111enja loga preko EVE pod sustava, koji osigurava izlaz doga\u0111aja u JSON formatu. Brzina je postignuta zahvaljuju\u0107i novom graditelju JSON toka, napisanom na jeziku Rust.\n<li class=\"l\"> Pove\u0107ana skalabilnost sustava logova EVE i implementirana mogu\u0107nost vo\u0111enja zasebnog log-fajla za svaku nit.\n<li class=\"l\"> Mogu\u0107nost definiranja uvjeta za resetiranje informacija u log.\n<li class=\"l\"> Mogu\u0107nost odra\u017eavanja MAC adresa u EVE logu i pove\u0107anje detaljnosti DNS loga.\n<li class=\"l\"> Pove\u0107anje performansi motora obrade tokova (flow engine).\n<li class=\"l\"> Podr\u0161ka za identifikaciju implementacija SSH (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/salesforce\/hassh\">HASSH<\/a><\/noindex>).\n<li class=\"l\"> Implementacija dekodera tunela GENEVE.\n<li class=\"l\"> Kod za obradu <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/ASN.1\">ASN.1<\/a><\/noindex>, DCERPC i SSH je prepisan na jeziku Rust. Tako\u0111er je implementirana podr\u0161ka za nove protokole.\n<li class=\"l\"> U jeziku za definiciju pravila u klju\u010dnoj rije\u010di byte_jump dodana je podr\u0161ka za parametar from_end, a u byte_test za parametar bitmask. Implementirana je klju\u010dna rije\u010d pcrexform, koja omogu\u0107uje kori\u0161tenje regularnih izraza (pcre) za hvatanje podstringa. Dodana je funkcija urldecode. Dodana je klju\u010dna rije\u010d byte_math.\n<li class=\"l\"> Omogu\u0107ena upotreba cbindgen za generiranje veza na jezicima Rust i C.\n<li class=\"l\"> Dodana je po\u010detna podr\u0161ka za dodatke.\n<\/ul>\n<p>Zna\u010dajke Suricate:\n<\/p>\n<ul>\n<li class=\"l\"> Kori\u0161tenje za prikaz rezultata provjere jedinstvenog formata <noindex><a rel=\"nofollow\" href=\"http:\/\/searchsecuritychannel.techtarget.com\/tip\/0,289483,sid97_gci1339679,00.html\">Unified2<\/a><\/noindex>, koji tako\u0111er koristi projekt Snort, \u0161to omogu\u0107ava kori\u0161tenje standardnih alata za analizu, kao \u0161to su <noindex><a rel=\"nofollow\" href=\"http:\/\/www.securixlive.com\/barnyard2\/index.php\">barnyard2<\/a><\/noindex>. Mogu\u0107nost integracije s proizvodima BASE, Snorby, Sguil i SQueRT. Podr\u0161ka za izlaz u PCAP formatu;\n<\/li>\n<li class=\"l\">  Podr\u0161ka za automatsko prepoznavanje protokola (IP, TCP, UDP, ICMP, HTTP, TLS, FTP, SMB itd.), koja omogu\u0107ava upravljanje pravilima samo na temelju tipa protokola, bez vezivanja za broj porta (na primjer, blokiranje HTTP prometa na nestandardnom portu). Prisutnost dekodera za protokole HTTP, SSL, TLS, SMB, SMB2, DCERPC, SMTP, FTP i SSH;\n<\/li>\n<li class=\"l\"> Mo\u0107an sustav analize HTTP prometa, koji koristi posebnu biblioteku HTP za razdvajanje i normalizaciju HTTP prometa, stvorenu od strane autora projekta Mod_Security. Dostupan je modul za vo\u0111enje detaljnog loga transitnih HTTP proslje\u0107ivanja, log se \u010duva u standardnom formatu<br \/>\nApache. Podr\u017eava izdvajanje i provjeru datoteka prenesenih putem HTTP protokola. Podr\u0161ka za razdvajanje komprimiranog sadr\u017eaja. Mogu\u0107nost identifikacije po URI, kola\u010di\u0107u, zaglavljima, user-agentu, tijelu zahtjeva\/odgovora;<\/p>\n<\/li>\n<li class=\"l\"> Podr\u0161ka za razli\u010dite su\u010delje za presretanje prometa, uklju\u010duju\u0107i NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING. Mogu\u0107a je analiza ve\u0107 sa\u010duvanih datoteka u PCAP formatu;\n<\/li>\n<li class=\"l\"> Visoka u\u010dinkovitost, sposobnost obrade tokova do 10 gigabita\/u sekundi na obi\u010dnoj opremi.\n<\/li>\n<li class=\"l\"> Visokou\u010dinkovit mehanizam usporedbe maski s velikim skupovima IP adresa. Podr\u0161ka za izdvajanje sadr\u017eaja prema maski i regularnim izrazima. Izdvajanje datoteka iz prometa, uklju\u010duju\u0107i njihovu identifikaciju po imenu, tipu ili MD5 kontrolnoj sumi.\n<\/li>\n<li class=\"l\"> Mogu\u0107nost kori\u0161tenja varijabli u pravilima: mogu\u0107e je pohraniti informacije iz toka i kasnije ih koristiti u drugim pravilima;\n<\/li>\n<li class=\"l\"> Kori\u0161tenje YAML formata u datotekama konfiguracije, \u0161to omogu\u0107ava o\u010duvanje preglednosti uz jednostavno strojno obra\u0111ivanje;\n<\/li>\n<li class=\"l\"> Potpuna podr\u0161ka za IPv6;\n<\/li>\n<li class=\"l\"> Ugra\u0111eni motor za automatsku defragmentaciju i rekonstrukciju paketa, omogu\u0107uju\u0107i pravilnu obradu tokova, neovisno o redoslijedu dolaska paketa;\n<\/li>\n<li class=\"l\"> Podr\u0161ka za protokole tuneliranja: Teredo, IP-IP, IP6-IP4, IP4-IP6, GRE;\n<\/li>\n<li class=\"l\"> Podr\u0161ka za dekodiranje paketa: IPv4, IPv6, TCP, UDP, SCTP, ICMPv4, ICMPv6, GRE, Ethernet, PPP, PPPoE, Raw, SLL, VLAN;\n<\/li>\n<li class=\"l\"> Na\u010din vo\u0111enja loga klju\u010deva i certifikata koji se pojavljuju unutar TLS\/SSL veza;\n<\/li>\n<li class=\"l\"> Mogu\u0107nost pisanja skripti na jeziku Lua za osiguravanje napredne analize i implementaciju dodatnih mogu\u0107nosti potrebnih za definisanje vrsta prometa za koje standardna pravila nisu dovoljna.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Izvor: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53857\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 Suricata 6.0, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0438\u043d\u0441\u043f\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 Suricata \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0430\u0437\u044b \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Snort, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u043f\u0440\u0430\u0432\u0438\u043b Emerging Threats \u0438 Emerging Threats Pro. \u0418\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f: [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-96219","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a Suricata 6.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Izdanje sustava za otkrivanje napada Suricata 6.0 | ProHoster","description":"Nakon godine dana razvoja, organizacija OISF (Open Information Security Foundation) objavila je izdanje sustava.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a Suricata 6.0 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T11:42:03+00:00","article:modified_time":"2020-10-09T11:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96219","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:22","updated":"2022-10-02 08:38:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/96219","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=96219"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/96219\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=96219"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=96219"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=96219"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}