The OISF development team is proud to announce Suricata 1.0.0, the first stable release of Suricata, the Open Source Intrusion Detection and Prevention engine.

Get the new release here: http://www.openinfosecfoundation.org/download/suricata-1.0.0.tar.gz

Via OISF

Frankfort, N.Y. – February 19, 2010 – Everis Inc hired Mr. Wayne Pritchard as Network Administration Intern.

Mr. Pritchard brings with him his educational experience from the Herkimer County Community Colleges (HCCC) Computer Network Technician program which is designed to prepare students for careers in computer network technologies.

We at Everis Inc are pleased to support our local academic institutions in programs such as this, as Joseph McCoy, Everis President & CEO, stated “Working with the youth of our community is an important part of building local economic stability.”

Everis, Inc. has joined several other local and national technology companies in sponsoring the 2010 AFRL Challenge Competition hosted at the Griffiss Institute in Rome, NY, February 15th-19th 2010.

The Challenge Competition is designed for local high school students and intended to provide an opportunity for them to solve a real-life cyber-security issue facing the nation. The students spend a school-break week researching and learning about the problem and formulate a solution that is then presented to a judging panel. Corporate sponsors provide internships that are awarded as prizes to the winning student groups. Everis is pleased to have been a part of this unique opportunity for local students to learn more about high technology industries.

For more information on the Challenge Competition Please Visit http://griffissinstitute.org/ChallengeCompetition.aspx

Since the Hammerhead platform must analyze and manipulate this additional network data, the platform has been designed with a generous hardware specification allowing for speed, reliability, and efficiency. The system itself is comprised of 24 processor cores powering a multithreaded operating environment. The system has enough memory and processing capability to handle 40 Gbps in (as a monitoring system) or 2x 10 Gbps through (in and out, as a gateway).

It’s been about three years in the making, but the day has finally come! We have the first release of the Suricata Engine! The engine is an Open Source Next Generation Intrusion Detection and Prevention Tool, not intended to just replace or emulate the existing tools in the industry, but to bring new ideas and technologies to the field.

OISF is part of and funded by the Department of Homeland Security’s Directorate for Science and Technology HOST program (Homeland Open Security Technology), by the the Navy’s Space and Naval Warfare Systems Command (SPAWAR), as well as through the very generous support of the members of the OISF Consortium. More information about the Consortium is available, as well as a list of our current Consortium Members.

The Suricata Engine and the HTP Library are available to use under the GPLv2.

The HTP Library is an HTTP normalizer and parser written by Ivan Ristic of Mod Security fame for the OISF. This integrates and provides very advanced processing of HTTP streams for Suricata. The HTP library is required by the engine, but may also be used independently in a range of applications and tools.

This is considered a Beta Release as we are seeking feedback from the community. This release has many of the major new features we wanted to add to the industry, but certainly not all. We intend to get this base engine out and stable, and then continue to add new features. We expect several new releases in the month of January culminating in a production quality release before Spring 2010.

The engine and the HTP Library are available on the Suricata Download Page.

Please join the oisf-users mailing list to discuss and share feedback. The developers will be there ready to help you test.

As this is a first release we don’t really have a “what’s New” section because everything is new. But we do have a number of new ideas and new concepts to Intrusion Detection to note. Some of those are listed below:

Multi-Threading

Amazing that multi-threading is new to IDS, but it is, and we’ve got it!

Automatic Protocol Detection

The engine not only has keywords for IP, TCP, UDP and ICMP, but also has HTTP, TLS, FTP and SMB! A user can now write a rule to detect a match within an HTTP stream for example regardless of the port the stream occurs on. This is going to revolutionize malware detection and control. Detections for more layer 7 protocols are on the way.

Gzip Decompression

The HTP Parser will decode Gzip compressed streams, allowing much more detailed matching within the engine.

Independent HTP Library

The HTP Parser will be of great use to many other applications such as proxies, filters, etc. The parser is available as a library also under GPLv2 for easy integration ito other tools.

Standard Input Methods

You can use NFQueue, IPFRing, and the standard LibPcap to capture traffic. IPFW support coming shortly.

Unified2 Output

You can use your standard output tools and methods with the new engine, 100% compatible!

Flow Variables

It’s possible to capture information out of a stream and save that in a variable which can then be matched again later.

Fast IP Matching

The engine will automatically take rules that are IP matches only (such as the RBN and compromised IP lists at Emerging Threats) and put them into a special fast matching preprocessor.

HTTP Log Module

All HTTP requests can be automatically output into an apache-style log format file. Very useful for monitoring and logging activity completely independent of rulesets and matching. Should you need to do so you could use the engine only as an HTTP logging sniffer.

Coming Very Soon: (Within a few weeks)

Global Flow Variables

The ability to store more information from a stream or match (actual data, not just setting a bit), and storing that information for a period of time. This will make comparing values across many streams and time possible.

Graphics Card Acceleration

Using CUDA and OpenCL we will be able to make use of the massive processing power of even old graphics cards to accelerate your IDS. Offloading the very computationally intensive functions of the sensor will greatly enhance performance.

Windows Binaries

As soon as we have a reasonably stable body of code.

The list could go on and on. Please take a few minutes to download the engine and try it out and let us know what you think. We’re not comfortable calling it production ready at the moment until we get your feedback, and we have a few features to complete. So we really need your feedback and input. We intend to put out a series of small releases in the two to three weeks to come, and then a production ready major release shortly thereafter. Phase two of our development plan will then begin where we go after some major new features such as IP Reputation shortly.