Nadogradnja funkcionalnosti programskog alata Suricata

master's thesis

• Title (english): Adding Functionality to Software Tool Suricata
• Author: Nikola Ugarković
• Mentor: Tomislav Hrkać (mentor)
• Committee member: Tomislav Hrkać (predsjednik povjerenstva)
• Committee member: Zoran Kalafatić (član povjerenstva)
• Committee member: Stjepan Groš (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2020-07-13, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Suricata je besplatni, brzi i robusni mrežni mehanizam za otkrivanje prijetnji. Dostupna je u obliku programa otvorenog koda koji održava zaklada OISF. U okviru rada, istražene su i opisane postojeće mogućnosti Suricate za snimanje prometa te je implementirana njezina nadogradnja. Nadograđena verzija Suricate za svaki primljeni paket s upozorenjem zapisuje na disk promet stigao prije i nakon upozorenja. Mrežni podatci zapisuju se u obliku dnevničkih datoteka s pcap ekstenzijom. Veličina datoteka je konfigurabilna. U svrhu testiranja i verificiranja rezultata, proveden je testni scenarij koji pokazuje obradu prometa generiranog korištenjem Internet preglednika Mozilla Firefox i web stranice YouTube, kao i naredbe curl za generiranje prometa s upozorenjem. Testni scenarij prikazan je u demonstracijskom videu priloženom uz rad.

Abstract (english)

Suricata is a free, fast and robust network threat detection mechanism. It is available in the form of an open-source software system maintained by the OISF Foundation. As part of the paper, the existing possibilities of Suricata for traffic recording were researched and described, and its upgrade was implemented. The upgraded version of Suricata records the traffic arrived before and after the alert. Network data is written in the form of pcap log files. File size is configurable. For the purpose of testing and verifying the results, a test scenario was performed showing the processing of traffic generated using the Mozilla Firefox Internet browser and the YouTube webpage, as well as the curl command to generate an alert. The test scenario is shown in the demonstration video attached to the paper.

• Keywords: Suricata; mrežni promet; vatrozid; računalna sigurnost
• Keywords (english): Suricata; network traffic; firewall; computer security
• Language: croatian
• URN:NBN: urn:nbn:hr:168:490491
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-01-13 10:51:17