Zeek 3.0.0 traffic analyzer yakaburitswa

Makore manomwe mushure mekuumbwa kwebazi rekupedzisira rakakosha yakaunzwa kuburitswa kwekuongorora traffic uye network intrusion yekuona system Zeek 3.0.0 , yakamboparadzirwa pasi pezita rokuti Bro. Iyi ndiyo yekutanga kuburitswa kwakakosha kubva kupazve chirongwa, akazvipira nekuti zita rekuti Bro raive rakabatana neiyo marginal subculture yezita rimwechete, uye kwete sechirevo chakanangidzirwa ku "Big Brother" kubva mubhuku raGeorge Orwell "1984" rakarongwa nevanyori. Iyo system code yakanyorwa muC ++ uye inoparadzirwa ne pasi peBSD rezinesi.

Zeek ipuratifomu yekuongorora traffic yakatarisana zvakanyanya, asi isina kuganhurirwa kune, kuchengetedza chiitiko chekutarisa. Mamodule anopihwa kuti aongorore uye kupenengura akasiyana-siyana-level network mapuroteni, uchifunga nezve mamiriro ekubatanidza uye kubvumira kugadzirwa kweiyo yakadzama logi (yakachengetedzwa) yetiweki chiitiko. Mutauro wakanangana nedomasi unopihwa kuti unyore zvinyorwa zvekutarisa uye kuona zvisizvo, tichifunga nezvezvakananga zvezvivakwa. Iyo sisitimu yakagadziridzwa kuti ishandiswe mune yakakwirira-bandwidth network. API inopihwa yekubatanidzwa neyechitatu-bato ruzivo masisitimu uye kuchinjanisa data munguva chaiyo.

В kuburitswa kutsva:

• Iyo analyzer yeNTP protocol yakanyorwa zvachose uye muongorori mutsva weMQTT wawedzerwa. Kugona kwevanoongorora kweDNS, RDP, SMB uye TLS kwakawedzerwa. Kune DNS, kupatsanurwa kweSPF marekodhi kunopihwa, uye yeDNSSEC - RRSIG, DNSKEY, DS, NSEC uye NSEC3 uye kusarudzwa kwezviitiko zvine chekuita nazvo. Yakawedzerwa rutsigiro rweSMB 3.x protocol kune SMB analyzer, uye rutsigiro rweTLS 1.3 yeTLS;
• Tsigiro yekudzikamisa hova dzinofambiswa mukati meVXLAN tunnel yakaitwa;
• Yakawedzera tsigiro yezvibatanidza neiyo NFLOG mhando;
• Yakawedzera kugona kuchengetedza yakabviswa data murogi muUTF8 encoding;
• Tsigiro yekuvharwa kwemabasa asingazivikanwe yawedzerwa mumutauro wekunyora, mushandisi wekuverenga matafura mune kiyi-kukosha fomati ("ye (kiyi, kukosha mu t)") yawedzerwa, Python-style vector separation mashandiro akaitwa. (“v[2:4]”), chimiro chitsva, paraglob, chinokurudzirwa kukurumidza kuenzanisa masks etambo mumaseti makuru edata rebhinari;
• Zvese zvinongedzo kuzita rekuti "bro" munzira dzemafaira, marongero, mapakeji, zvinyorwa, nzvimbo dzemazita uye mabasa akatsiviwa ne "zeek" (rutsigiro rwemazita echikuru anochengeterwa kuenderana kumashure). Iyo bro-pkg package maneja yakatumidzwa zita rekuti zkg.

Source: opennet.ru