the next generation open ids engine suricata and emerging threats

Open Information Security Foundation

Suricata, The Next Generation IPS

Balancing Open Security Softwarewith

Commercial Interests

Tuesday, August 3, 2010

Introduction

EmergingThreats.net

Open Information Security Foundation

OpenInfoSecFoundation.org


A Few Truths

Great Ideas Often Result from Open Collaboration


A Few Truths

Open Source Projects Don’tBecome Effective Complete

Products on Their Own


A Few Truths

Open Community HippiesDon’t Trust

Vendors


A Few Truths

VendorsDon’t Collaborate With

Open Community HippiesWell


A Few Truths

The MilitaryDoesn’t Trust

Open Community Hippies


A Few Truths

Vendors try to Reinventthe Wheel on EveryMilitary Contract


The Result

We have a

Hippie-Vendor-Mil Gap


Fixing it...


Fixing it...

(please don’t laugh)


Fixing it...

(please don’t laugh)

We Involve The Government


A Case Study


A Case Study

Intrusion Detection Systems


A Case Study

Intrusion Detection Systems12+ Years Old


A Case Study


Open and Proprietary


A Case Study


Open and ProprietaryProductized by EV


A Case Study

In the last 5 yearsNo Innovation.

Nada.Zilch.

Nothing.


A Case Study

“IDS is Dead.”

-Gartner


IDS

•Intrusion Detection Has Not:• Innovated• Gone Multi-Threaded• Integrated with other technologies• Risen to solve our new threats


OISF


OISF

Non-Profit Foundation


OISF

Non-Profit FoundationInitially DHS Funded


OISF

Non-Profit FoundationInitially DHS Funded

OSH, Mil, and EV Involvement


The Dirty Little Secret



It’s working!



It’s working!Why?



The OSH, EV, Consumers, Mil, and Government



The OSH, EV, Consumers, Mil, and Government

ALL WANT THE SAME THING



New IdeasConstant Innovation

Reliable ImplementationsEffective Support

Put their Kids through College


Consortium


Consortium

Vendors are part of a Consortium


Consortium

Vendors are part of a Consortium50/50 voting rights with the Community


Consortium

Vendors are part of a Consortium50/50 voting rights with the CommunitySupport required for a non-GPL license


OISF Consortium


http://www.dhs.gov/

http://www.dhs.gov/

http://www.bivio.net/

http://www.bivio.net/

http://www.kerio.com/


































































































http://www.mammothlawgroup.com/

http://www.mammothlawgroup.com/

Consortium

•Currently Bringing in 19 New Members•Global Defense Contractors...•Several Government Research Groups•Many CERTs•Universities•Security Vendors (that use other engines...)


The Engine


Features

Major Goals


Features

Multi-Threading


Features

Native IPv6 Support


Features

Snort Syntax

with additions


Features

Automatic Protocol Detection


Features

High Speed Regex


Features

Advanced HTTP Parsing


Features

Multiple Model

Statistical Anomaly Detection


Features

Native Hardware Acceleration Support


Features

GPU Acceleration


Features

IP Reputation

Distributed Blocking and Feedback


Features

Scoring Thresholds


Features

Very High Speed Regex


Features

In Stream File Extraction


Features

Web-Based Config Manager


Other Features

HTTP Access LoggingSMB Access/Action LoggingWindows INLINE SupportFull Windows SupportVirtual Environment SupportStopbadware.org URI MatchingPassive SSL Decryption


Features

Go ask your Commercial Vendor for any of that....


Status

Releases•Initial Stable Release, December 31, 2010•Second Stable Release, February 15, 2010•Phase One RC1, May 6, 2010 •Phase One Production, July 1, 2010


Get Involved

Brainstorming MeetingJuly 16, 2010San Francisco


Get InvolvedInterim Goals:Architecture DocumentationPerformance OptimizationRun Mode Support (Likely Endace completed)Error Code Cleanup and DocumentationFull Documentation (community interactable docs)Advanced Profiling and Engine statsAccuracy ImprovementsAdd Protocol Detections (SMTP, etc)Classifications Update2.8.6 CompatibilityLibHTP Error HandlingHeavy Inline Testing


Get Involved

Phase Two:Max Inspection TimeFile Capture in StreamREGEX Optimization/AccelLive Ruleset UpdatesFlow Logging (Netflow)Add Replace keyword supportHost attribute scrubbingURI Matching lookups (stopbadware, websense, etc)CUDA Support


Get Involved

Phase Two Team Two:IP Reputation - Explore other items, dns, etcDistributed Blocking Global Flowbits and flowvarsFull Stream CaptureTraffic Redirection


What We Need


What We Need

Consortium Members


What We Need

Consortium Members Coding Support


What We Need


Further Government/Mil Support


What We Need


Further Government/Mil Support

YOU!


Will you get involved?


Will you get involved?

Questions?


www.EmergingThreats.net


http://www.EmergingThreats.net

http://www.EmergingThreats.net

the next generation open ids engine suricata and emerging threats

Technology