{"id":96219,"date":"2020-10-09T13:42:03","date_gmt":"2020-10-09T11:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0"},"modified":"2020-10-09T13:42:03","modified_gmt":"2020-10-09T11:42:03","slug":"vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","title":{"rendered":"Lan\u00e7amento do sistema de detec\u00e7\u00e3o de ataques Suricata 6.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Ap\u00f3s um ano de desenvolvimento, a organiza\u00e7\u00e3o OISF (Open Information Security Foundation) <noindex><a rel=\"nofollow\" href=\"https:\/\/suricata-ids.org\/2020\/10\/08\/suricata-6-0-0-released\">publicou<\/a><\/noindex> lan\u00e7ou um sistema de detec\u00e7\u00e3o e preven\u00e7\u00e3o de intrus\u00f5es na rede <noindex><a rel=\"nofollow\" href=\"http:\/\/suricata-ids.org\/\">Suricata 6.0<\/a><\/noindex>, que fornece ferramentas para inspecionar diferentes tipos de tr\u00e1fego. Nas configura\u00e7\u00f5es do Suricata, \u00e9 permitido o uso de <noindex><a rel=\"nofollow\" href=\"http:\/\/www.snort.org\/vrt\">bancos de assinaturas<\/a><\/noindex>, desenvolvidos pelo projeto Snort, assim como conjuntos de regras <noindex><a rel=\"nofollow\" href=\"http:\/\/rules.emergingthreats.net\/\">Emerging Threats<\/a><\/noindex> e <noindex><a rel=\"nofollow\" href=\"http:\/\/rules.emergingthreatspro.com\/\">Emerging Threats Pro<\/a><\/noindex>. Os c\u00f3digos-fonte do projeto <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OISF\/suricata\">s\u00e3o distribu\u00eddos<\/a><\/noindex> sob a licen\u00e7a GPLv2. <\/p>\n<p>Principais mudan\u00e7as:<\/p>\n<ul>\n<li class=\"l\"> Suporte inicial para HTTP\/2.\n<li class=\"l\"> Suporte para os protocolos RFB e MQTT, incluindo a capacidade de identificar o protocolo e registrar logs.\n<li class=\"l\"> Capacidade de registrar logs para o protocolo DCERPC.\n<li class=\"l\"> Aprimoramento significativo no desempenho da gera\u00e7\u00e3o de logs atrav\u00e9s do subsistema EVE, que fornece a sa\u00edda de eventos no formato JSON. A acelera\u00e7\u00e3o foi alcan\u00e7ada gra\u00e7as ao uso de um novo construtor de streams JSON, escrito em Rust.\n<li class=\"l\"> A escalabilidade do sistema de logs EVE foi aumentada e a capacidade de gerar um arquivo de log separado para cada thread foi implementada.\n<li class=\"l\"> Capacidade de definir condi\u00e7\u00f5es para a grava\u00e7\u00e3o de informa\u00e7\u00f5es nos logs.\n<li class=\"l\"> Capacidade de refletir endere\u00e7os MAC no log EVE e aumento da detalhamento do log DNS.\n<li class=\"l\"> Aumento da performance do mecanismo de processamento de fluxos (flow engine).\n<li class=\"l\"> Suporte \u00e0 identifica\u00e7\u00e3o de implementa\u00e7\u00f5es SSH (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/salesforce\/hassh\">HASSH<\/a><\/noindex>).\n<li class=\"l\"> Implementa\u00e7\u00e3o de um decodificador de t\u00faneis GENEVE.\n<li class=\"l\"> O c\u00f3digo para processamento de <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/ASN.1\">ASN.1<\/a><\/noindex>, DCERPC e SSH foi reescrito em Rust. O suporte para novos protocolos tamb\u00e9m foi implementado em Rust.\n<li class=\"l\"> Na linguagem de defini\u00e7\u00e3o de regras, a palavra-chave byte_jump ganhou suporte para o par\u00e2metro from_end, enquanto byte_test agora suporta o par\u00e2metro bitmask. Foi implementada a palavra-chave pcrexform, que permite usar express\u00f5es regulares (pcre) para capturar substrings. Adicionada a transforma\u00e7\u00e3o urldecode. A palavra-chave byte_math foi inclu\u00edda.\n<li class=\"l\"> Possibilidade de usar cbindgen para gerar bindings nas linguagens Rust e C.\n<li class=\"l\"> Foi adicionada a suporte inicial para plugins.\n<\/ul>\n<p>Caracter\u00edsticas do Suricata:\n<\/p>\n<ul>\n<li class=\"l\"> Uso de um formato unificado para a sa\u00edda dos resultados de verifica\u00e7\u00e3o <noindex><a rel=\"nofollow\" href=\"http:\/\/searchsecuritychannel.techtarget.com\/tip\/0,289483,sid97_gci1339679,00.html\">Unified2<\/a><\/noindex>, tamb\u00e9m utilizado pelo projeto Snort, permitindo o uso de ferramentas padr\u00e3o para an\u00e1lise, como <noindex><a rel=\"nofollow\" href=\"http:\/\/www.securixlive.com\/barnyard2\/index.php\">barnyard2<\/a><\/noindex>. Possibilidade de integra\u00e7\u00e3o com produtos BASE, Snorby, Sguil e SQueRT. Suporte para sa\u00edda no formato PCAP;\n<\/li>\n<li class=\"l\">  Suporte para a detec\u00e7\u00e3o autom\u00e1tica de protocolos (IP, TCP, UDP, ICMP, HTTP, TLS, FTP, SMB, etc.), permitindo operar nas regras apenas pelo tipo de protocolo, sem vincula\u00e7\u00e3o ao n\u00famero da porta (por exemplo, bloquear tr\u00e1fego HTTP em uma porta n\u00e3o padr\u00e3o). Presen\u00e7a de decodificadores para os protocolos HTTP, SSL, TLS, SMB, SMB2, DCERPC, SMTP, FTP e SSH;\n<\/li>\n<li class=\"l\"> Sistema poderoso de an\u00e1lise de tr\u00e1fego HTTP, utilizando uma biblioteca especial HTP para o desmembramento e normaliza\u00e7\u00e3o do tr\u00e1fego HTTP, criada pelo autor do projeto Mod_Security. M\u00f3dulo dispon\u00edvel para manter um log detalhado das transmiss\u00f5es HTTP, que \u00e9 salvo em formato padr\u00e3o;<br \/>\nApache. Suporte para extra\u00e7\u00e3o e verifica\u00e7\u00e3o de arquivos transferidos pelo protocolo HTTP. Suporte para an\u00e1lise de conte\u00fado compactado. Possibilidade de identifica\u00e7\u00e3o por URI, Cookie, cabe\u00e7alhos, user-agent, corpo da solicita\u00e7\u00e3o\/resposta;<\/p>\n<\/li>\n<li class=\"l\"> Suporte a v\u00e1rias interfaces para captura de tr\u00e1fego, incluindo NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING. Possibilidade de an\u00e1lise de arquivos j\u00e1 salvos no formato PCAP;\n<\/li>\n<li class=\"l\"> Alta performance, capacidade de processar em hardware comum fluxos de at\u00e9 10 gigabits\/segundo.\n<\/li>\n<li class=\"l\"> Mecanismo de correspond\u00eancia de m\u00e1scara de alto desempenho com grandes conjuntos de endere\u00e7os IP. Suporte para a extra\u00e7\u00e3o de conte\u00fado por m\u00e1scara e express\u00f5es regulares. Extra\u00e7\u00e3o de arquivos do tr\u00e1fego, incluindo identifica\u00e7\u00e3o por nome, tipo ou soma de verifica\u00e7\u00e3o MD5.\n<\/li>\n<li class=\"l\"> Possibilidade de utilizar vari\u00e1veis nas regras: \u00e9 poss\u00edvel salvar informa\u00e7\u00f5es do fluxo e us\u00e1-las posteriormente em outras regras;\n<\/li>\n<li class=\"l\"> Uso do formato YAML em arquivos de configura\u00e7\u00e3o, que permite manter a clareza enquanto facilita o processamento por m\u00e1quinas;\n<\/li>\n<li class=\"l\"> Suporte completo para IPv6;\n<\/li>\n<li class=\"l\"> Engine incorporado para desfragmenta\u00e7\u00e3o autom\u00e1tica e reorganiza\u00e7\u00e3o de pacotes, garantindo o processamento correto dos fluxos, independentemente da ordem de chegada dos pacotes;\n<\/li>\n<li class=\"l\"> Suporte a protocolos detunelamento: Teredo, IP-IP, IP6-IP4, IP4-IP6, GRE;\n<\/li>\n<li class=\"l\"> Suporte ao decodifica\u00e7\u00e3o de pacotes: IPv4, IPv6, TCP, UDP, SCTP, ICMPv4, ICMPv6, GRE, Ethernet, PPP, PPPoE, Raw, SLL, VLAN;\n<\/li>\n<li class=\"l\"> Modo de log de chaves e certificados envolvidos nas conex\u00f5es TLS\/SSL;\n<\/li>\n<li class=\"l\"> Possibilidade de escrever scripts em Lua para proporcionar uma an\u00e1lise avan\u00e7ada e implementar funcionalidades adicionais necess\u00e1rias para determinar tipos de tr\u00e1fego para os quais as regras padr\u00e3o n\u00e3o s\u00e3o suficientes.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53857\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 Suricata 6.0, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0438\u043d\u0441\u043f\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 Suricata \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0430\u0437\u044b \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Snort, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u043f\u0440\u0430\u0432\u0438\u043b Emerging Threats \u0438 Emerging Threats Pro. \u0418\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f: [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-96219","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a Suricata 6.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lan\u00e7amento do sistema de detec\u00e7\u00e3o de ataques Suricata 6.0 | ProHoster","description":"Ap\u00f3s um ano de desenvolvimento, a organiza\u00e7\u00e3o OISF (Open Information Security Foundation) publicou o lan\u00e7amento do sistema.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a Suricata 6.0 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T11:42:03+00:00","article:modified_time":"2020-10-09T11:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96219","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:22","updated":"2022-10-02 08:38:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/96219","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=96219"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/96219\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=96219"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=96219"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=96219"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}