The Next Generation Open IDS Engine Suricata and Emerging Threats

Open Information Security Foundation

Suricata, The Next Generation IPS

Balancing Open Security Software
with
Commercial Interests

Tuesday, August 3, 2010

Introduction

EmergingThreats.net

Open Information Security Foundation
OpenInfoSecFoundation.org


A Few Truths

Great Ideas Often Result
from Open Collaboration


A Few Truths

Open Source Projects Don’t
Become Effective Complete
Products on Their Own


A Few Truths

Open Community Hippies
Don’t Trust
Vendors


A Few Truths

Vendors
Don’t Collaborate With
Well


A Few Truths

The Military
Doesn’t Trust


A Few Truths

Vendors try to Reinvent
the Wheel on Every
Military Contract


The Result

We have a

Hippie-Vendor-Mil Gap


Fixing it...


Fixing it...

(please don’t laugh)


Fixing it...

(please don’t laugh)

We Involve The Government


A Case Study


A Case Study

Intrusion Detection Systems


A Case Study

12+ Years Old


A Case Study

12+ Years Old
Open and Proprietary


A Case Study

12+ Years Old
Open and Proprietary
Productized by EV


A Case Study

In the last 5 years
No Innovation.
Nada.
Zilch.
Nothing.


A Case Study

“IDS is Dead.”

-Gartner


IDS

• Intrusion Detection Has Not:
• Innovated
• Gone Multi-Threaded
• Integrated with other technologies
• Risen to solve our new threats


OISF


OISF

Non-Proﬁt Foundation


OISF

Initially DHS Funded


OISF

Initially DHS Funded

OSH, Mil, and EV Involvement


The Dirty Little Secret



It’s working!



It’s working!
Why?



The OSH, EV, Consumers, Mil, and Government



The OSH, EV, Consumers, Mil, and Government

ALL WANT THE SAME THING



New Ideas
Constant Innovation
Reliable Implementations
Effective Support
Put their Kids through College


Consortium


Consortium

Vendors are part of a Consortium


Consortium

50/50 voting rights with the Community


Consortium

50/50 voting rights with the Community
Support required for a non-GPL license


OISF Consortium


Consortium

•Currently Bringing in 19 New Members
•Global Defense Contractors...
•Several Government Research Groups
•Many CERTs
•Universities
•Security Vendors (that use other engines...)


The Engine


Features

Major Goals


Features

Multi-Threading


Features

Native IPv6 Support


Features

Snort Syntax

with additions


Features

Automatic Protocol Detection


Features

High Speed Regex


Features

Advanced HTTP Parsing


Features

Multiple Model
Statistical Anomaly Detection


Features

Native Hardware Acceleration
Support


Features

GPU Acceleration


Features

IP Reputation

Distributed Blocking and Feedback


Features

Scoring Thresholds


Features

Very High Speed Regex


Features

In Stream File Extraction


Features

Web-Based Config Manager


Other Features

HTTP Access Logging
SMB Access/Action Logging
Windows INLINE Support
Full Windows Support
Virtual Environment Support
Stopbadware.org URI Matching
Passive SSL Decryption


Features

Go ask your Commercial
Vendor for any of that....


Status

 Releases
•Initial Stable Release, December 31, 2010
•Second Stable Release, February 15, 2010
•Phase One RC1, May 6, 2010
•Phase One Production, July 1, 2010


Get Involved

Brainstorming Meeting
July 16, 2010
San Francisco


Get Involved
Interim Goals:
Architecture Documentation
Performance Optimization
Run Mode Support (Likely Endace completed)
Error Code Cleanup and Documentation
Full Documentation (community interactable docs)
Advanced Proﬁling and Engine stats
Accuracy Improvements
Add Protocol Detections (SMTP, etc)
Classiﬁcations Update
2.8.6 Compatibility
LibHTP Error Handling
Heavy Inline Testing


Get Involved

Phase Two:
Max Inspection Time
File Capture in Stream
REGEX Optimization/Accel
Live Ruleset Updates
Flow Logging (Netﬂow)
Add Replace keyword support
Host attribute scrubbing
URI Matching lookups (stopbadware, websense, etc)
CUDA Support


Get Involved

Phase Two Team Two:
IP Reputation - Explore other items, dns, etc
Distributed Blocking
Global Flowbits and ﬂowvars
Full Stream Capture
Trafﬁc Redirection


What We Need


What We Need

Consortium Members


What We Need

Consortium Members
Coding Support


What We Need

Consortium Members
Coding Support

Further Government/Mil Support


What We Need

Consortium Members
Coding Support

Further Government/Mil Support

YOU!


Will you get involved?


Will you get involved?

Questions?


www.EmergingThreats.net


The Next Generation Open IDS Engine Suricata and Emerging Threats

Recommended

Recommended

More Related Content

Similar to The Next Generation Open IDS Engine Suricata and Emerging Threats

Similar to The Next Generation Open IDS Engine Suricata and Emerging Threats (8)

More from Joshua L. Davis

More from Joshua L. Davis (20)

Recently uploaded

Recently uploaded (20)

The Next Generation Open IDS Engine Suricata and Emerging Threats