Use of Suricata, ElasticStack, Neo4j and Linkurious for network defence - IMT Atlantique Accéder directement au contenu
Poster De Conférence Année : 2019

Use of Suricata, ElasticStack, Neo4j and Linkurious for network defence

Résumé

Suricata is a powerful tool to detect network anomalies based on signatures. However, the data collected by the NIDS are also precious to generate graphs for network defense. During our PhD, we have used Suricata and the Vega tool of the ElasticStack to create parallel coordinates graphs. However, Suricata doesn't yet give information about the direction of the connection (to or from a client to or from a server). This lack leads to a mirror effect in the graph. The flow_direction feature to be shortly merged in Suricata now enables this feature for a proper - and real time - rendering of the network flow diagram. Finally, we have also used Neo4j and Linkurious tool to help for the search and visualization within the metadata stored in Elastic. The use of a graph database makes the requests fast and easy. Linkurious also helps to create easy to understand visualizations of the network flows between clients and servers. Those tools were presented to different SOCs operators with great success.
Fichier non déposé

Dates et versions

hal-02336548 , version 1 (29-10-2019)

Identifiants

  • HAL Id : hal-02336548 , version 1

Citer

Olivier Jacq, David Brosset, Jacques Simonin, Yvon Kermarrec. Use of Suricata, ElasticStack, Neo4j and Linkurious for network defence. SuriCon, Oct 2019, Amsterdam, Netherlands. ⟨hal-02336548⟩
185 Consultations
0 Téléchargements

Partager

Gmail Facebook X LinkedIn More