{"id":96219,"date":"2020-10-09T13:42:03","date_gmt":"2020-10-09T11:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0"},"modified":"2020-10-09T13:42:03","modified_gmt":"2020-10-09T11:42:03","slug":"vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","title":{"rendered":"Lansarea sistemului de detectare a atacurilor Suricata 6.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Dup\u0103 un an de dezvoltare, organiza\u021bia OISF (Open Information Security Foundation) <noindex><a rel=\"nofollow\" href=\"https:\/\/suricata-ids.org\/2020\/10\/08\/suricata-6-0-0-released\">a publicat<\/a><\/noindex> lansarea sistemului de detectare \u0219i prevenire a intruziunilor \u00een re\u021bea <noindex><a rel=\"nofollow\" href=\"http:\/\/suricata-ids.org\/\">Suricata 6.0<\/a><\/noindex>, care ofer\u0103 instrumente pentru inspectarea diferitelor tipuri de trafic. \u00cen configura\u021biile Suricata este permis\u0103 utilizarea <noindex><a rel=\"nofollow\" href=\"http:\/\/www.snort.org\/vrt\">bazei de semn\u0103turi<\/a><\/noindex>, dezvoltat\u0103 de proiectul Snort, precum \u0219i a seturilor de reguli <noindex><a rel=\"nofollow\" href=\"http:\/\/rules.emergingthreats.net\/\">Emerging Threats<\/a><\/noindex> \u0219i <noindex><a rel=\"nofollow\" href=\"http:\/\/rules.emergingthreatspro.com\/\">Emerging Threats Pro<\/a><\/noindex>. Codurile surs\u0103 ale proiectului <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OISF\/suricata\">sunt distribuite<\/a><\/noindex> sub licen\u021ba GPLv2. <\/p>\n<p>Modific\u0103ri principale:<\/p>\n<ul>\n<li class=\"l\"> Suport ini\u021bial pentru HTTP\/2.\n<li class=\"l\"> Suport pentru protocoalele RFB \u0219i MQTT, inclusiv capacitatea de a determina protocolul \u0219i de a \u021bine log-uri.\n<li class=\"l\"> Capacitatea de a \u021bine log-uri pentru protocolul DCERPC.\n<li class=\"l\"> Cre\u0219tere semnificativ\u0103 a performan\u021bei log\u0103rii prin subsistemul EVE, care asigur\u0103 output-ul evenimentelor \u00een format JSON. Viteza a fost crescut\u0103 datorit\u0103 utiliz\u0103rii unui nou constructor de fluxuri JSON, scris \u00een limbajul Rust.\n<li class=\"l\"> Scalabilitatea sistemului de loguri EVE a fost \u00eembun\u0103t\u0103\u021bit\u0103 \u0219i a fost implementat\u0103 capacitatea de a avea un fi\u0219ier de log separat pentru fiecare thread.\n<li class=\"l\"> Capacitatea de a determina condi\u021biile pentru rescrierea informa\u021biilor \u00een log.\n<li class=\"l\"> Capacitatea de a reflecta adresele MAC \u00een logul EVE \u0219i de a spori detalierea logului DNS.\n<li class=\"l\"> \u00cembun\u0103t\u0103\u021birea performan\u021bei motorului de procesare a fluxurilor (flow engine).\n<li class=\"l\"> Suport pentru identificarea implement\u0103rilor SSH (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/salesforce\/hassh\">HASSH<\/a><\/noindex>).\n<li class=\"l\"> Implementarea unui decodor pentru tuneluri GENEVE.\n<li class=\"l\"> Codul pentru procesarea <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/ASN.1\">ASN.1<\/a><\/noindex>, DCERPC \u0219i SSH a fost ref\u0103cut \u00een Rust. Suportul pentru noile protocoale a fost, de asemenea, realizat \u00een Rust.\n<li class=\"l\"> \u00cen limbajul de definire a regulilor, cuv\u00e2ntul cheie byte_jump a fost \u00eembun\u0103t\u0103\u021bit prin ad\u0103ugarea suportului pentru parametrul from_end, iar \u00een byte_test \u2014 pentru parametrul bitmask. A fost implementat cuv\u00e2ntul cheie pcrexform, care permite utilizarea expresiilor regulate (pcre) pentru a captura un sub\u0219ir. A fost ad\u0103ugat suport pentru conversia urldecode. A fost ad\u0103ugat cuv\u00e2ntul cheie byte_math.\n<li class=\"l\"> Oferrea posibilit\u0103\u021bii de a utiliza cbindgen pentru generarea leg\u0103turilor \u00een limbajele Rust \u0219i C.\n<li class=\"l\"> A fost ad\u0103ugat suport ini\u021bial pentru plugin-uri.\n<\/ul>\n<p>Caracteristici ale Suricata:\n<\/p>\n<ul>\n<li class=\"l\"> Utilizarea unui format unificat pentru output-ul rezultatelor verific\u0103rii <noindex><a rel=\"nofollow\" href=\"http:\/\/searchsecuritychannel.techtarget.com\/tip\/0,289483,sid97_gci1339679,00.html\">Unified2<\/a><\/noindex>, utilizat de asemenea de proiectul Snort, ceea ce permite utilizarea instrumentelor standard pentru analiz\u0103, cum ar fi <noindex><a rel=\"nofollow\" href=\"http:\/\/www.securixlive.com\/barnyard2\/index.php\">barnyard2<\/a><\/noindex>. Posibilitatea de integrare cu produsele BASE, Snorby, Sguil \u0219i SQueRT. Suport pentru output \u00een format PCAP;\n<\/li>\n<li class=\"l\">  Suport pentru detectarea automat\u0103 a protocoalelor (IP, TCP, UDP, ICMP, HTTP, TLS, FTP, SMB \u0219.a.m.d.), care permite operarea \u00een reguli doar dup\u0103 tipul de protocol, f\u0103r\u0103 leg\u0103tur\u0103 cu num\u0103rul de port (de exemplu, blocarea traficului HTTP pe un port nestructurat). Existen\u021ba decodoarelor pentru protocoalele HTTP, SSL, TLS, SMB, SMB2, DCERPC, SMTP, FTP \u0219i SSH;\n<\/li>\n<li class=\"l\"> Un sistem puternic de analiz\u0103 a traficului HTTP, care utilizeaz\u0103 o bibliotec\u0103 special\u0103 HTP, creat\u0103 de autorul proiectului Mod_Security pentru a descompune \u0219i normaliza traficul HTTP. Este disponibil un modul pentru \u021binerea unui jurnal detaliat al redirec\u021bion\u0103rilor HTTP transitate, jurnalul fiind salvat \u00een format standard<br \/>\nApache. Suport pentru extragerea \u0219i verificarea fi\u0219ierelor transmise prin protocolul HTTP. Suport pentru descompunerea con\u021binutului comprimat. Posibilitatea de a identifica prin URI, Cookie, anteturi, user-agent, corpul cererii\/r\u0103spunsului;<\/p>\n<\/li>\n<li class=\"l\"> Suport pentru diverse interfe\u021be pentru interceptarea traficului, inclusiv NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING. Este posibil\u0103 analiza fi\u0219ierelor deja salvate \u00een format PCAP;\n<\/li>\n<li class=\"l\"> Performan\u021b\u0103 ridicat\u0103, capacitatea de a procesa fluxuri de p\u00e2n\u0103 la 10 gigabi\u021bi\/secund\u0103 pe echipamente obi\u0219nuite.\n<\/li>\n<li class=\"l\"> Un mecanism de asociere de mare performan\u021b\u0103 cu seturi mari de adrese IP. Suport pentru extragerea con\u021binutului pe baza masc\u0103rii \u0219i expresiilor regulate. Extragerea fi\u0219ierelor din trafic, inclusiv identificarea acestora dup\u0103 nume, tip sau sum\u0103 de control MD5.\n<\/li>\n<li class=\"l\"> Posibilitatea utiliz\u0103rii variabilelor \u00een reguli: se pot salva informa\u021bii din flux \u0219i ulterior se pot folosi \u00een alte reguli;\n<\/li>\n<li class=\"l\"> Utilizarea formatului YAML \u00een fi\u0219ierele de configurare, ceea ce permite p\u0103strarea clarit\u0103\u021bii \u00een raport cu u\u0219urin\u021ba de procesare automat\u0103;\n<\/li>\n<li class=\"l\"> Suport complet pentru IPv6;\n<\/li>\n<li class=\"l\"> Un motor integrat pentru defragmentarea automat\u0103 \u0219i reasamblarea pachetelor, care asigur\u0103 o procesare corect\u0103 a fluxurilor, indiferent de ordinea de sosire a pachetelor;\n<\/li>\n<li class=\"l\"> Suport pentru protocoale de tunelare: Teredo, IP-IP, IP6-IP4, IP4-IP6, GRE;\n<\/li>\n<li class=\"l\"> Suport pentru decodificarea pachetelor: IPv4, IPv6, TCP, UDP, SCTP, ICMPv4, ICMPv6, GRE, Ethernet, PPP, PPPoE, Raw, SLL, VLAN;\n<\/li>\n<li class=\"l\"> Mod de \u021binere a jurnalului cheilor \u0219i certificatelor ce apar \u00een cadrul conexiunilor TLS\/SSL;\n<\/li>\n<li class=\"l\"> Posibilitatea de a scrie scripturi \u00een limbajul Lua pentru a asigura o analiz\u0103 extins\u0103 \u0219i implementarea func\u021bionalit\u0103\u021bilor suplimentare necesare pentru a determina tipurile de trafic pentru care regulile standard nu sunt suficiente.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Sursa: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53857\">opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 Suricata 6.0, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0438\u043d\u0441\u043f\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 Suricata \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0430\u0437\u044b \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Snort, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u043f\u0440\u0430\u0432\u0438\u043b Emerging Threats \u0438 Emerging Threats Pro. \u0418\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f: [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-96219","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a Suricata 6.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lansarea sistemului de detectare a atacurilor Suricata 6.0 | ProHoster","description":"Dup\u0103 un an de dezvoltare, organiza\u021bia OISF (Open Information Security Foundation) a publicat lansarea sistemului.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a Suricata 6.0 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T11:42:03+00:00","article:modified_time":"2020-10-09T11:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96219","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:22","updated":"2022-10-02 08:38:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/96219","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=96219"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/96219\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=96219"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=96219"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=96219"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}