Hey folks, pleasure to be here, such a great conference, among such a good community, and
lots of open source folks, and among friends as well.
We have talked a little bit about the required, because we have to actually highlight all
the good things that we do for two years in 20 minutes, so please bear with me.
My name is Peter, I'm at this gentleman here on my right, at the project called
Serrikara, open source projects in Rikara six years ago, where we still actually work and
collaborate and donate a lot with the community.
I'm a Serrikara evangelist, I do a lot of QA and trainings for the project, and as I mentioned
I found with a Rikko phone in the company called Stamocetworks.
Would you like to say that?
Yes, I'm very deeply French, sorry for the accent, and I'm a vestitial at Stamocetworks
on the bottom of the Rikko, and from time to time I do the development on Syrikata.
So for those of you that are not familiar with Syrikara, it's been around, it's widely
used by a lot of different organizations, folks and community, it's a thread detection engine
that actually inspects the network traffic, it can generate any and all data, relevant
to forensics, malware detection, ideas alerts, the protocol logs, we did the file extraction,
the PECAP, it has the whole capability, has been constantly evolving, could have passed
16 years.
It's a Swiss army knife for a little bit.
So born in 2008, 600,000 lines of code, some of the major code creators are here in the
room with us today, so super big pleasure to be here.
It's written in C and Rust, it says life packets on the network, or dead ones, because
we have to actually inspect the traffic regardless of whether the traffic is good enough
or not good enough, or following the RFC.
Basically, produces protocol transaction, ideas alerts, PECAP, and it's actually characterized
with very high performance in open source driven by community, actually not by a single
person or vendor, it's actually a lot of collaborative effort, and it's actually governed
by the open information security foundation just to make sure that actually everything is
proper to stay open source, we cannot be bought, we cannot be sold, but we're a GPL version
too, but there is also a proprietary license for vendors that need so, so that also, we all want
to make sure that the code is always open source and always there, but there is also ways
to facilitate specific vendors if they need to.
There is a lot of frequent class questions and answers on the URL there, if you need to have
look. So where's Riccada is developed? Actually, I'm actually super happy because one of the
guys responsible for the 46% there is sitting right in front of me, Riccada, please raise your hand
up. Thank you. So here's the creator, the food, the initial quote, another person that is responsible
for most of the 16% is right here, whom I write with her to run, and it's as you can see it's
a lot of collaborative effort, my part of this 16 year journey has been kind of sitting in between
these guys in trying to convince them directly how bad their code is, but at the end it all,
it all really works and I'm evangelizing it the most I can. So, non-technical challenges for
those two years of developing to Riccada is a huge variety of users, right? For me,
corporations, if you actually Google AWS, if you Google or Firewall AWS, Riccada is actually
the default Firewall AWS. So we have a lot of big usage, a lot of big vendors, a lot of
researchers, hobbies, trailers, professors, universities, students, sandboxing,
online tools like any around triage and things like that, they all use Riccada, vendors, integrators
of applying. So we have a very active community, all five continents, always, they're always evolving.
We need to keep all these people happy and hopefully we're doing a good job because if it's not
useful, we wouldn't be here actually. So it has usage of what we do. And of course,
consortium members, so we have to keep all of them engaged. Now, anything goes from a Raspberry
to 400 gigabit a second installation. So we actually have to do that at speed and with huge
performance and be flexible. So the input is traffic capture, RFC doesn't really matter to malware,
including some commerce, also some commercial vendors as well. So we need to actually
be procuring and spectrum catch all of these things, independent of threat intel ingestion,
and we have to output in a default format that is easily ingestable by a lot of vendors. So,
as I said, in these two years, we actually changed suggested at about the quarter of the
cold, of the whole body. And a lot of docs, a lot of arrests, improvements,
implementation for security and threat safety. So it was a huge effort by a lot of people on
organizations, not just a couple. One of the things that was added to improved in surricata eight
is like, we were using the motor if you can log it. You can use it in a row or a signature detection,
let's put it. Basically creating those extra buffers, we can point to the traffic and say,
hey, I want to check something in here, but in an extremely fast way. One thing that we did
greatly differentiated matter was adding a 177-new keywords or buffers rather to the surricata.
As you can see, all the way to the right of the screen, you have a purple line, and this is the
difference for surricata eight and between all the other surricatas that are from the orange
one on the low, so a huge addition in there. So a lot of new protocol came in and if you're
interested to see what the new buffers are, there's about 38% of those, so it's very easy to see
that on a command line with surricata dash dash list keywords. And all those buffers and
detections have been added so that they can be used in the detection language in the signature
writing, would addition to different protocols. On top of the regular step that surricata already
does the logging and you can put in CEM and actually do the detection algorithmic there as well.
Now, there were some detection limitations and the surricata team actually managed to fix
those in a groundbreaking manner. First, the whole industry had a problem with that in general,
the directionality of the rule. So in other words, as the example goes in here, you check
based on the direction to client or to server when you actually do the detection. And it was kind of
a signature, a simple signature. The basic example like this actually needed two rules to detect,
you know, one to the client and then there is one to the server. So that was the limitation.
So you had to be split into signatures and fourth negative, it could happen a lot. So one way that
this was fixed and it was a long journey but when it came to fix it, it's actually the introduction
of transaction rules. In other words, as you can see on the screen in here, you can actually say
something like if there is this content and the server crushes, you know, a state is called
content 500, I would like to be alerted. So that combines actually both things. So it was
that's one of the other things that were in there. So now, I shouldn't really talk about that
because I didn't write it. So I personally took the guide that wrote the code for it and
he'll take it over here. So one thing that has been introduced by Victor, remember that we were
on the beach, we discussed in that when I discovered that the feature was that asset because
a lot of things that we want too much is a list. So you'll get a list of domains, but of course
potentially bad, you got a list of user ads on that, or potentially bad, only want to match
really fast on that. So as we concept of data set, in just a list, write one single signature
on you will be able to match on this list really fast. So basically, you get the list of
those names that are not correct, and you are going to write one signature on you're going to
match on that. But when you do that, basically you're going to have all your bad people
in the same box. You don't know why we are bad in the generated alert on that was an issue.
So what has been introduced in suricata 8 is the capability to ingest
gison format where we can get context on top of IUC's indicator of compromise.
And we can use that in the signature on our website. So for example, here we say,
if HTTP host is in the set that is coming from this IUC.nd gison, on the IUC and the gison is here,
you get the IUC key on the context. And this is going to end up in the alert.
IUC check one single signature on then you've got the context coming in to the event.
So this arrow you to directly knows why it is bad, and why you have a problem. So it's
a cat as everybody knows. That's all you name Icelandic volcano. So, so that's one of
the fifth feature on the another feature that has been done is part of adding a lot of keywords.
It was also full to be able to add keywords because a lot of protocol had been added.
So I'm not going to cover every one of them here. One of the most important
for me is LDP because it's easy to use in a top-rive in a lateral movement. When somebody is
already inside, I'm trying to take control of a full information system. But you also have
some of a protocol like CIP, ARP, for low level, and DNS server HTTP, it's a lot of friends
from FireFox in the previous talk. And so, as mentioned by Peter, surgata, he's
parsing the method. Everything goes. We need to do our best. People, for some people, it's a sport,
to make us crash. So we need to be as best as we can. And the experience has make us learn that
yes, we are not going to be able to get correct code on a we need help from the language that we
are using. So that's why we have switched from C to Rust for the new development mostly. Let's say
like that. And with a big focus on the analysis of data coming from Venezuela. So for performance
inside the system, we can still see that if we want to parse a new protocol is going to be in Rust
and the increase of Rust has been a huge from 2017 to 2025. We wait up to 27% for a project that is 15 years
old, that's quite cool. So that's a big effort that has been done and so we've got the eight
increase has been as big as the huge. And yes, and also I've worked on the lower. So the
rest of the big move that has been done is the parsing of HTTP that was written in C library, but
it's now built in in surricata on this done in Rust. And we also have some other interesting
parsing like mine parsing is a nightmare. And it has been moved to Rust. One big problem that we
add in the past is that we add lower since the beginning. It was looking like the best feature ever
when we get the lower support out. So basically you have a signature on you image and then you want to
say, okay, but what is going to happen if I don't have a keyword to access the protocol or
a logic is really complex. And very, you can just you could just say, oh, I'm going to send
the data to a lower script and because it's a language, I can write anything. So the concept is really interesting,
but because when you deploy surricata, you don't know, when you write a lower role, you don't know
which version of what you're going to have because it was the lower from the system that was used,
you don't know what a module we're available. So everything was a problem. And also the
word is a language. So if it's a language, it can do stuff. So you can must do anything.
So that was another big issue. So that has been fixed in surricata 8. With some boxing
to protect, uh, on a try to avoid a vision. And also by to invandored inside surricata. So we have
exactly the same version for fixed version of surricata. So it's predictable for V2.
For the rule of right hand, for V2, they're sorry.
Whenever evolution is surricata as a library, so surricata can now be on beddy,
or part of surricata can now be on beddy, in some of her software. For example, you have a
HTTP proxy. And you want to add the capability to do surricata analysis on it. So that's
the development that you can do now with surricata 8. Part of surricata 8. But another evolution
is surricata add a lot of running mode. And the new running mode has been added, which is a fire
wall mode where surricata can now pass on this side, on the packet, on the flow based on some
metadata. So let's see an example. That would be a little bit better. So for example, you can say that
you want to block TLS version 1. So something really low level in the protocol. And so you can do
drop on the flow. So you're going to drop all the flow. When the surricata server is a negotiation
started and you get the version 1 on this is going to block everything. So you can really use
go deep into the understanding of a protocol to write a really advanced rule that are going to
be applied. And one of the important things is that it's just not like a signature. It becomes a real
rule set lacking fire wall. It's sequential. You can predict what is going to be the decision
because with the traditional surricata online you can have multiple signature firing on the
same packet and the logic is completely different. So big funds to the team, big funds to the community,
a lot of future being contributed by external people. For example, I was talking about the conversion
of the U.S.G.T.P. to rest. It has been done by our Canadian friends. We had it contributed
back. So the cyber security from Canada has done the conversion and so that's the way it is possible.
Funds to the community and funds to the gratitude of the U.S.F. If you have questions.
Thank you. How good is surricata for processing plain HTTP comparing with specialization of
application for the walls? Assuming the elasticity of the community is already. So are you suggesting
to use surricata for everything or we can just use the application for the wall for HTTP?
Right. And surricata for all of us.
I will consider surricata as a good system to be able to go above the capacity that you could have
in your application firewall. Because the signature language is kind of powerful, but if you
I will say that it's not special as for what? It's not going to act as a proxy. So you will need to do
a specific development for what? Yeah, it needs to be considered. But to be fully honest,
I will not just go straight on that. I will try to see if I it will emit of my actual system before
going for what? But look at the capability of surricata signature but can be interesting.
But it would not be my first step. Okay, thank you. Sorry, if I made a one more question.
I regard in there, may please clarify the rules ordering possible for surricata.
Can you package it and make it a play specific order? Yeah, so in this failure world mode,
you can have ordering of the rules that is taken into account. But in the regular ideas or
IPS mode is not the case. Because we are super 90 million packet per second, 70,000 rules.
If we go second, sure. Yeah, we're not going to do it. So we've got optimization.
Do we have any other questions?
When we are talking about performance, let's say, what are the capacity of our CPU that you need?
Let's say for one gig of it traffic. I know it's a very general question, but can you give us
a general estimation of capacity in scaling of traffic? For your willing, you mean?
Yeah, so for ideas, Raspberry Pi is enough for one gig. For IPS on a failure world,
I don't have a number. I think we need to, it's a bit fresh when you're sorry for that, but we need to
do some evaluation. Any other questions?
I just want to mention one more thing, I'm not right to the question, but in general, because we are,
if there are no more questions, we could, in general, because we are an open source.
Community, we usually listen to everything that the community has to say,
and super thankful that we can actually be here, folks. We also have something called Suricon,
where we gather all the inputs from the security, from the security, for the community.
And all that, so model welcome for any feedback is appreciated. But one person that actually consistently
makes that, and also make sure that a bunch of gigs can run coherently, is our president,
of the open information skills foundation, Kelly Misatluciting, right here.
Big thank you to her as well. So please make sure you bring your app as well, something is there.
Okay, well, very much for, thank you for that talk.