{"id":96219,"date":"2020-10-09T13:42:03","date_gmt":"2020-10-09T11:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0"},"modified":"2020-10-09T13:42:03","modified_gmt":"2020-10-09T11:42:03","slug":"vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","title":{"rendered":"Utg\u00e5van av attackdetekteringssystemet Suricata 6.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Efter ett \u00e5rs utveckling har organisationen OISF (Open Information Security Foundation) <noindex><a rel=\"nofollow\" href=\"https:\/\/suricata-ids.org\/2020\/10\/08\/suricata-6-0-0-released\">publicerade<\/a><\/noindex> utgivning av systemet f\u00f6r uppt\u00e4ckts- och f\u00f6rhindrandesystem f\u00f6r n\u00e4tverksintr\u00e5ng <noindex><a rel=\"nofollow\" href=\"http:\/\/suricata-ids.org\/\">Suricata 6.0<\/a><\/noindex>, som tillhandah\u00e5ller verktyg f\u00f6r inspektion av olika typer av trafik. I Suricatas konfigurationer \u00e4r det till\u00e5tet att anv\u00e4nda <noindex><a rel=\"nofollow\" href=\"http:\/\/www.snort.org\/vrt\">signaturdatabaser<\/a><\/noindex>, utvecklade av projektet Snort, samt regelupps\u00e4ttningar <noindex><a rel=\"nofollow\" href=\"http:\/\/rules.emergingthreats.net\/\">Emerging Threats<\/a><\/noindex> och <noindex><a rel=\"nofollow\" href=\"http:\/\/rules.emergingthreatspro.com\/\">Emerging Threats Pro<\/a><\/noindex>. Projektets k\u00e4llkoder <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OISF\/suricata\">sprids<\/a><\/noindex> \u00e4r under GPLv2-licensen. <\/p>\n<p>Huvudsakliga f\u00f6r\u00e4ndringar:<\/p>\n<ul>\n<li class=\"l\"> F\u00f6rsta st\u00f6det f\u00f6r HTTP\/2.\n<li class=\"l\"> St\u00f6d f\u00f6r protokollen RFB och MQTT, inklusive m\u00f6jlighet att identifiera protokollet och logga.\n<li class=\"l\"> M\u00f6jlighet att logga f\u00f6r protokollet DCERPC.\n<li class=\"l\"> Betydande \u00f6kning av loggningsprestandan genom EVE-systemet, vilket m\u00f6jligg\u00f6r utskrift av h\u00e4ndelser i JSON-format. F\u00f6rb\u00e4ttringar uppn\u00e5ddes genom anv\u00e4ndning av en ny JSON-str\u00f6mgenerator skriven i Rust.\n<li class=\"l\"> Skalbarheten hos EVE-loggarna har \u00f6kat och m\u00f6jligheten att ha en separat loggfil f\u00f6r varje str\u00f6m har implementerats.\n<li class=\"l\"> M\u00f6jlighet att definiera villkor f\u00f6r att rensa logguppgifter.\n<li class=\"l\"> M\u00f6jlighet att \u00e5terspegla MAC-adresser i EVE-loggen och \u00f6kad detaljrikedom i DNS-loggen.\n<li class=\"l\"> \u00d6kning av prestanda f\u00f6r fl\u00f6desbehandlingsmotorn (flow engine).\n<li class=\"l\"> St\u00f6d f\u00f6r identifiering av SSH-implementeringar (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/salesforce\/hassh\">HASSH<\/a><\/noindex>).\n<li class=\"l\"> Implementering av en tunneldecoder f\u00f6r GENEVE.\n<li class=\"l\"> Koden f\u00f6r bearbetning har skrivits om i Rust <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/ASN.1\">ASN.1<\/a><\/noindex>, DCERPC och SSH. St\u00f6d f\u00f6r nya protokoll har ocks\u00e5 implementerats i Rust.\n<li class=\"l\"> I spr\u00e5kdefinitionerna f\u00f6r regler har nyckelordet byte_jump st\u00f6d f\u00f6r parametern from_end lagts till, och i byte_test har parametern bitmask lagts till. Det har implementerats ett nyckelord pcrexform som g\u00f6r det m\u00f6jligt att anv\u00e4nda regulj\u00e4ra uttryck (pcre) f\u00f6r att f\u00e5nga understr\u00e4ngar. Urldecode-konvertering har lagts till. Nyckelordet byte_math har lagts till.\n<li class=\"l\"> M\u00f6jlighet att anv\u00e4nda cbindgen f\u00f6r att generera bindningar i Rust och C.\n<li class=\"l\"> Inledande st\u00f6d f\u00f6r plugins har lagts till.\n<\/ul>\n<p>Funktioner i Suricata:\n<\/p>\n<ul>\n<li class=\"l\"> Anv\u00e4ndning av ett enhetligt format f\u00f6r resultatutmatning <noindex><a rel=\"nofollow\" href=\"http:\/\/searchsecuritychannel.techtarget.com\/tip\/0,289483,sid97_gci1339679,00.html\">Unified2<\/a><\/noindex>, som ocks\u00e5 anv\u00e4nds av Snort-projektet, vilket g\u00f6r det m\u00f6jligt att anv\u00e4nda standardanalysverktyg som <noindex><a rel=\"nofollow\" href=\"http:\/\/www.securixlive.com\/barnyard2\/index.php\">barnyard2<\/a><\/noindex>. M\u00f6jlighet till integration med produkter som BASE, Snorby, Sguil och SQueRT. St\u00f6d f\u00f6r utmatning i PCAP-format;\n<\/li>\n<li class=\"l\">  St\u00f6d f\u00f6r automatisk protokolldetektering (IP, TCP, UDP, ICMP, HTTP, TLS, FTP, SMB etc.) vilket g\u00f6r det m\u00f6jligt att arbeta med regler endast baserat p\u00e5 protokollets typ utan koppling till portnumret (till exempel blockera HTTP-trafik p\u00e5 en icke-standardport). F\u00f6rekomst av avkodare f\u00f6r protokoll som HTTP, SSL, TLS, SMB, SMB2, DCERPC, SMTP, FTP och SSH;\n<\/li>\n<li class=\"l\"> Ett kraftfullt system f\u00f6r analys av HTTP-trafik som anv\u00e4nder ett s\u00e4rskilt bibliotek, HTP, f\u00f6r att analysera och normalisera HTTP-trafik, d\u00e4r skaparen av Mod_Security-projektet st\u00e5r bakom. En modul finns f\u00f6r att f\u00f6ra detaljerad logg \u00f6ver transitera HTTP-omdirigeringar, loggen sparas i standardformatet<br \/>\nApache. St\u00f6d f\u00f6r extrahering och verifiering av filer som \u00f6verf\u00f6rs via HTTP-protokollet. St\u00f6d f\u00f6r analys av komprimerat inneh\u00e5ll. M\u00f6jlighet till identifiering via URI, cookies, rubriker, user-agent och kropp i beg\u00e4ran\/svar;<\/p>\n<\/li>\n<li class=\"l\"> St\u00f6d f\u00f6r olika gr\u00e4nssnitt f\u00f6r trafikf\u00e5ngst, inklusive NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING. Analys av redan sparade filer i PCAP-format \u00e4r m\u00f6jlig;\n<\/li>\n<li class=\"l\"> H\u00f6g prestanda, f\u00f6rm\u00e5ga att hantera str\u00f6mmar upp till 10 gigabit\/s p\u00e5 vanlig h\u00e5rdvara.\n<\/li>\n<li class=\"l\"> H\u00f6gpresterande maskmatchningsmotor med stora upps\u00e4ttningar av IP-adresser. St\u00f6d f\u00f6r inneh\u00e5llsutvinning baserat p\u00e5 mask och regulj\u00e4ra uttryck. Utdrag av filer fr\u00e5n trafik, inklusive identifiering av filer efter namn, typ eller MD5-kontrollsumma.\n<\/li>\n<li class=\"l\"> M\u00f6jlighet att anv\u00e4nda variabler i regler: du kan spara information fr\u00e5n fl\u00f6det och senare anv\u00e4nda den i andra regler;\n<\/li>\n<li class=\"l\"> Anv\u00e4ndning av YAML-format i konfigurationsfiler, vilket sparar tydlighet vid enkel maskinbearbetning;\n<\/li>\n<li class=\"l\"> Fullt st\u00f6d f\u00f6r IPv6;\n<\/li>\n<li class=\"l\"> Inbyggd motor f\u00f6r automatisk defragmentering och ombyggnad av paket, vilket s\u00e4kerst\u00e4ller korrekt bearbetning av fl\u00f6den oavsett paketens ankomstordning;\n<\/li>\n<li class=\"l\"> St\u00f6d f\u00f6r tunnelingprotokoll: Teredo, IP-IP, IP6-IP4, IP4-IP6, GRE;\n<\/li>\n<li class=\"l\"> St\u00f6d f\u00f6r dekodning av paket: IPv4, IPv6, TCP, UDP, SCTP, ICMPv4, ICMPv6, GRE, Ethernet, PPP, PPPoE, Raw, SLL, VLAN;\n<\/li>\n<li class=\"l\"> Loggning av nycklar och certifikat som figurerar i TLS\/SSL-anslutningar;\n<\/li>\n<li class=\"l\"> M\u00f6jlighet att skriva skript i Lua f\u00f6r att m\u00f6jligg\u00f6ra avancerad analys och genomf\u00f6rande av ytterligare funktioner som kr\u00e4vs f\u00f6r att identifiera trafiktyper d\u00e4r standardreglerna inte r\u00e4cker till.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>K\u00e4lla: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53857\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 Suricata 6.0, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0438\u043d\u0441\u043f\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 Suricata \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0430\u0437\u044b \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Snort, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u043f\u0440\u0430\u0432\u0438\u043b Emerging Threats \u0438 Emerging Threats Pro. \u0418\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f: [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-96219","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a Suricata 6.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Utg\u00e5van av attackdetekteringssystemet Suricata 6.0 | ProHoster","description":"Efter ett \u00e5rs utveckling har organisationen OISF (Open Information Security Foundation) publicerat en version av systemet.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a Suricata 6.0 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OISF (Open Information Security Foundation) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-sistemy-obnaruzheniya-atak-suricata-6-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T11:42:03+00:00","article:modified_time":"2020-10-09T11:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96219","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:22","updated":"2022-10-02 08:38:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/96219","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=96219"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/96219\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=96219"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=96219"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=96219"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}