Lead Image © sarah maher, 123RF.com

OPNids: Suricata with built-in machine learning

Packet Checker

Article from ADMIN 56/2020

By Martin Loschwitz

Does OPNids combine the Suricata IDS with machine learning to detect attack threats automatically, as advertised?

Intrusion detection systems (IDSs) and intrusion prevention systems (IPSs) are some of the classic tools in the administrator's toolbox to counter sophisticated attacks. One popular Linux candidate is the highly functional Suricata [1] (Figure 1).

Figure 1: Suricata is a comprehensive tool for detecting digital attacks. © Linux Screenshots (USA)

Various databases house online attack signatures for Suricata, which the tool uses to examine the data traffic and detect attacks. Much like antivirus programs, however, Suricata can only detect attacks with identified signatures. With the progress made in machine learning over the past few years, efforts have been made to generate new signatures automatically with artificial intelligence (AI) and to enter them into Suricata.

In this article, I first look into Suricata in detail and then introduce the Dragonfly machine learning engine (MLE) [2] specifically designed for Suricata. Finally, I look at OPNids [3], a fork of the OPNsense firewall and routing software that integrates Suricata and Dragonfly.

...

Use Express-Checkout link below to read the full article (PDF).