Okay, welcome everyone, so sorry, I've got a French name, but I'm very
old French, the Dutch, which is Victor Julien, as the L-Fishu, and was not
able to come. So I'm going to replace him for this talk, I'm
really sorry for that. We'll end that Friday night, so we have to prepare
the slide, so the slides are from Victor, I'm one of the most prolific
surricata developers after Victor, working on it since 2009,
on the slides are from Victor, and I'm going to work through that
review. Yeah, so Victor is the original creator,
and the current leader of surricata, his daily life is to lead the
deaf team, being a sponsor for that by the OESF Foundation,
which is being surricata.
It's not coming from computer science background, it's more
free software on two-yast that found some project,
work on it, and create them. So it's first software
that was a few years ago, to face on two,
vermur, a nice, pitiful, so firewalling, management tool,
that he did start to do in sea, I don't know what
it's strange I did, but at least he learned sea,
that was useful for him in the future, and it's still
used, it makes some news, it's a good software.
So then after a while, he discovered
the snort, we have a snort too good.
Where did he start to work on a snorting line that was
a fork of snort, the ideas, the original signature base
network ideas, and he did start to contribute
to snorting line. The life with community,
not the community of snorting line was okay, but the life
of community of snorting line with
a sofaya on snort, was kind of a problem.
A lot of ideas were not accepted by a sofaya.
I think, mostly because of that,
it did start to work on Victor IPS,
that was what was later, did became a surricata.
So it did showcase that to mat,
young man on the Whitt-Met-Calve.
Early 2008, at lunch, we were thinking about
O, they can build complete ideas, ideas,
based on the code that was just started.
But at the time, the code of snort was
actually the three Android 50,000 lines of code.
So by himself, we've got any funding,
it will not work.
But hopefully, we've found somebody
that we were discussing with Fibs for us
from a research institute in the US.
And they set up a meeting with Omelan security
on then, they got some funding,
they did create the Open Information Security Foundation
that did receive a funding on that just
as an objective to develop an open source,
GPLV2, ideas.
So the funding from DHS,
of Omelan, LVM2, start.
But Omelan did this to remove money every year.
So they had to find a sustainable way of getting
the foundation on getting that money
for the development.
On the way, if you have done it, it's a consortium
membership.
You have to make driver for the consortium.
Or because we consider that suricata is a common good
that we want to protect.
On the way, give money for that, for a sense,
it's the case of massive French cyber security
authority is giving money every year for suricata.
And the other one are using, in fact, the fact,
that suricata is GPL.
So if you want to do your own business,
by the modified suricata, you need to contribute
the modification, or you need to pay OISF,
and then you can have access to a double-layer essence,
where you will be able to use in your proprietary product.
So some of the consortium members are in this case.
So as Monshine, suricata is open source.
It's GPL D2.
It's developed with GIT, the merge request on GitHub,
but the management of suricata is done in my instance.
And that's the most important thing.
The discussion about the run map on this really
about the community.
So it may publicly, there is some virtual session
on various also some community brainstorm session
before the main event, which is suricone,
the annual user, conference, next year,
it's in Montreal.
Fabius Laret was in Madrid.
So that's the way it is working.
So there is a tremendous amount of new features
that are doing both over the years.
Two suricata front-view community.
Just come into welcoming community if you have somebody.
Just don't hesitate to propose.
So yeah, the initial idea was to do an ideas
on then things have got wild, become wild.
We have, it was simple.
We have an ideas.
So if you want to do an ideas that do
easy analysis of traffic, you need to understand the protocol.
If you understand the protocol, the application layer,
it means that if you understand it, you can log it.
So you can do an networks security monitoring.
You can log all the transaction.
On each you can log all the transaction,
because you need to have a flow on giant
to analyze the traffic, you can also log the net flow
like entry, so in season.
So you can have a continuing on networking flow.
On because you see all the packets,
you can also log the packet to the dice.
So you can do the full packet capture.
Or you can do a suricata seven conditionals.
Pick up capture, where you are just going to capture
the traffic on the same condition.
And because you understand the application layer well,
in a lot of application layer, there is file transfer.
So you can store the file on disk, on the strike, the file
on demand.
A new use case for suricata, that is being
more and more active recently, is the user of suricata
as a firewall, because it works in IPS mode.
Because it has access to the data on to the application
layer, where you can build some i-level policy
in terms of filtering, so there is some usage in AWS,
of suricata as a firewall on you can write your own filtering
rule, which are in fact, suricata signature,
to allow a specificity what you want.
So we figure to the activity in terms of development.
Major part of a development is on the OESF development team,
and there is also some organization that contribute
on the resource of some individual contributors.
On some intern, I would like to mention our 3D project,
that is an awesome organization that promote
a diversity in the open source world.
So in terms of commit, there is some organization
that are committing to suricata 8, something like 11.
There is a lot of individual that
did contribute to a new version.
And if you look at the part of war that has been done by OESF
on the latest work in progress, we got around 85% of the commit
that have been done by the foundation.
There is a set of challenges linked to working with suricata
on using suricata, one is on encryption,
when we got the traffic volume that we generate,
on what we need to ingest, also, on the alert fatigue
to many events, or do we do it with that.
On the deployment that be also very challenging.
So one of the challenges on encryption
forms to less on crypt, mostly where
when from almost no encryption to 95% of encryption
on the traffic on internet, that's perfect for privacy,
but for security in network analysis,
that's more a problem.
So the way suricata is on the lead is by doing
a analysis of non-chiptic part of a traffic,
which I'll owe it to extra information
just to have a certain indication of OESF,
the certificate, fingerprint technique,
just as GF4, GS3.
And but once it's done, what's remaining is to work
with the encryption system.
So on by getting the traffic from van,
on via, we're going to see a bit later,
where no have a library for suricata,
so using the Lyps suricata inside the product
that does the description.
The decryption, sorry.
The traffic volume, we have seen VPP talk before
with where we are suffering for the same thing.
We need to analyze super fast,
the traffic, we're talking about a single suricone
where the demo for Android,
the year by the second on one single server.
So that's something that we need to deal with.
On what we can deal with,
scalability, we have humidity threaded,
threading, as a work, as it really improved.
And yes, but also, if you have
this moment of traffic, any signature
that do an analysis, but it's too costly,
we're going to kill the enzyme,
so being able to control that is a key point.
Another fatigue, too many ideas event,
with 10 gigabit, one week is around 10 million
ideas event, so you need to have post processing,
you need to be sure that you have not too much false positive.
So improving the quality of the route is a key point,
so this can be made via better keywords,
and this can be made by helping the rule writer.
And it's also something that you need to be able to do
is to be able to classify.
So for that, there is two key things.
One is the fact that when you are writing a signature,
you can have metadata, vatrich, the alert event,
which means that you can contextualize everything
that has been generated efficiently.
On, you can also have all the application layer
or metadata, vatrich, the suricata alert,
which I'll show you to know which server it was,
which application layer protocol information we have,
the just TLS SMB, HTTP and stuff like that.
And on the road map part, sorry, one of the big things
is to improve extendability of software.
First thing is lib suricata, so basically,
you can plug suricata on any packet source
on any other software.
That's the goal here.
And on the other side, some of the features
we may not want to have 20, 20 years suricata,
so there is a plugin and infrastructure
that is in the making to be able to connect
to suricata, and under the traffic from vat,
so we need to add hooks inside suricata,
up to the point we can have access to some internal,
for instance, left to develop a GF4.
And then, the U.S. support improvement,
things is that the U.S. come from the build,
so we need to vandor, lua, to be able to have a lua
that come with a version of suricata,
so vat has been done for suricata eight.
And then, when you ingest the signature
that can call a lua script,
it means that they can do almost anything.
So some bugs in vat, that's something you need to know
because now signature can come from everywhere,
so you need to take vat into consideration.
One big change, if you have here some rule writer here,
that is coming with suricata eight is the bidirectional rules.
So you will be able to match on a request,
on a match, on a response.
So if I see vat in the response,
on if in a request, on even response,
confirm that my first hypothesis was correct,
that for instance, the exploit has been really made,
you can do vat in one single rule,
that's really a key somewhere.
And then there is also some work on making it homogeneous
between the log on the keywords.
There is something that are logged in suricata
where we have no keyword to match on.
So what we want is to bring everything to parity.
We got some new protocol, so LDIP is one of the biggest one.
We also got a little bit lower level with ARP.
We got some improvement SMB on some super for a student.
And then what we have also is a big move on request.
So we switch from the beginning of a project 2017-16%
of first eight years later, we are 20% of first,
which is a good thing for the security.
We're using non-the library to help us
to mostly protocol parser,
but it starts to do issues almost everywhere.
On suricata timeline, we are going to have the first initial
bit of release in April on the way
expect to have release end of spring beginning of summer.
On one thing to mention, it's that OESF is doing a lot
of work around tracking the run map.
So there is also more map website where you can have a clear view
of what is happening, and so you can really see the progress.
So that's really the being on just 8,000 line moved
and changed in suricata 8, till now,
that will be the big release.
So join the discussion.
If you have interest in network packet analysis,
in security, join the discussion
because a lot of features in suricata
are coming from contributors, some really
a main one are coming from contributors.
That's really what you listen to people,
discuss with people, a lot of people at OESF
are pure software developers.
So if you have security concerns,
because of your work, just come to us, discuss with us
and it will improve overall situation.
A very sobering session that suricata
on virtual, on the canopone feature tickets,
if you have summer ID.
On it, to 25, suricata 8, suricata in Montreal, CFP,
is coming soon, on the ESF, you got it?
Thank you very much.