implementing-network-intrusion-prevention-with-suricata

使用 Suricata 实施网络入侵防御

概述

Suricata 是由开放信息安全基金会（OISF）开发的一款高性能、开源网络威胁检测引擎。它可作为 IDS（入侵检测系统）、IPS（入侵防御系统）和网络安全监控工具使用。Suricata 利用大量规则集、协议分析和文件提取功能执行深度数据包检测。在 IPS 模式下，Suricata 以内联方式检查数据包，并可以主动阻断恶意流量。本技能涵盖在 IPS 模式下部署 Suricata、配置规则集、编写自定义规则、性能调优以及与日志基础设施的集成。

何时使用

• 在您的环境中部署或配置使用 Suricata 实施网络入侵防御的能力时
• 建立符合合规要求的安全控制措施时
• 为该领域构建或改进安全架构时
• 执行需要此实施的安全评估时

先决条件

• Linux 服务器（Ubuntu 22.04+ 或 CentOS 8+），具有 4 个以上 CPU 核心和 8GB 以上内存
• 已安装 Suricata 7.0+
• 用于内联部署的网络位置（桥接模式或 NFQUEUE）
• Emerging Threats Open 或 ET Pro 规则集订阅
• 用于规则管理的 Suricata-update 工具
• 日志基础设施（ELK Stack、Splunk 或 Wazuh）

核心概念

运行模式

模式	功能	网络位置
IDS (AF_PACKET)	被动监控，仅告警	TAP/SPAN 镜像
IPS (NFQUEUE)	通过 netfilter 进行内联阻断	流量路径中
IPS (AF_PACKET)	通过 AF_PACKET 进行内联阻断	接口之间的桥接
Offline (PCAP)	分析捕获的流量文件	不适用

规则结构

Suricata 规则遵循结构化格式：

action protocol src_ip src_port -> dst_ip dst_port (rule_options;)

• 动作：alert、pass、drop、reject、rejectsrc、rejectdst、rejectboth
• 协议：tcp、udp、icmp、ip、http、tls、dns、smtp、ftp
• 方向：->（单向）、<>（双向）

规则类别

• Emerging Threats Open - 社区维护的免费规则集，覆盖范围广泛
• ET Pro - 来自 Proofpoint 的商业规则集，覆盖范围增强
• Suricata Traffic ID - 应用程序识别规则
• 自定义规则 - 组织特定的检测

工作流

步骤 1：安装 Suricata

# Add Suricata PPA (Ubuntu)
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt-get update
sudo apt-get install -y suricata suricata-update

# Verify installation
suricata --build-info
suricata -V

步骤 2：为 IPS 模式配置 Suricata

编辑 /etc/suricata/suricata.yaml：

%YAML 1.1
---

vars:
  address-groups:
    HOME_NET: "[10.0.0.0/8,172.16.0.0/12,192.168.0.0/16]"
    EXTERNAL_NET: "!$HOME_NET"
    HTTP_SERVERS: "$HOME_NET"
    DNS_SERVERS: "[10.0.1.10/32,10.0.1.11/32]"
    SMTP_SERVERS: "$HOME_NET"

  port-groups:
    HTTP_PORTS: "80"
    SHELLCODE_PORTS: "!80"
    SSH_PORTS: "22"
    DNS_PORTS: "53"

# IPS mode with NFQUEUE
nfq:
  mode: accept
  repeat-mark: 1
  repeat-mask: 1
  route-queue: 2
  fail-open: yes

# Threading configuration
threading:
  set-cpu-affinity: yes
  cpu-affinity:
    - management-cpu-set:
        cpu: [0]
    - receive-cpu-set:
        cpu: [1,2]
    - worker-cpu-set:
        cpu: [3,4,5,6,7]
        mode: exclusive

# Detection engine
detect-engine:
  - profile: high
  - custom-values:
      toclient-groups: 50
      toserver-groups: 50
  - sgh-mpm-context: auto
  - inspection-recursion-limit: 3000

# Stream engine
stream:
  memcap: 512mb
  checksum-validation: yes
  inline: auto
  reassembly:
    memcap: 1gb
    depth: 1mb
    toserver-chunk-size: 2560
    toclient-chunk-size: 2560

# Logging configuration
outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/eve.json
      types:
        - alert:
            payload: yes
            payload-buffer-size: 4kb
            payload-printable: yes
            packet: yes
            metadata: yes
            tagged-packets: yes
        - http:
            extended: yes
        - dns:
            query: yes
            answer: yes
        - tls:
            extended: yes
        - files:
            force-magic: yes
            force-hash: [md5, sha256]
        - flow
        - netflow
        - stats:
            totals: yes
            threads: no
            deltas: yes

  - fast:
      enabled: yes
      filename: /var/log/suricata/fast.log

  - stats:
      enabled: yes
      filename: /var/log/suricata/stats.log
      interval: 30

# Rule files
default-rule-path: /var/lib/suricata/rules
rule-files:
  - suricata.rules

步骤 3：为内联 IPS 配置 NFQUEUE

设置 iptables 将流量重定向通过 Suricata：

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# Redirect FORWARD chain to NFQUEUE
sudo iptables -I FORWARD -j NFQUEUE --queue-num 0 --queue-bypass

# For multi-queue (better performance)
sudo iptables -I FORWARD -j NFQUEUE --queue-balance 0:3 --queue-bypass

# Save iptables rules
sudo iptables-save > /etc/iptables/rules.v4

替代方案：两个接口之间的 AF_PACKET 内联模式：

# In suricata.yaml
af-packet:
  - interface: eth0
    cluster-id: 98
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    copy-mode: ips
    copy-iface: eth1
  - interface: eth1
    cluster-id: 97
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    copy-mode: ips
    copy-iface: eth0

步骤 4：使用 Suricata-Update 管理规则

# Update rules from default sources (ET Open)
sudo suricata-update

# List available rule sources
sudo suricata-update list-sources

# Enable ET Pro (requires license key)
sudo suricata-update enable-source et/pro secret-code=YOUR_OINKCODE

# Enable additional sources
sudo suricata-update enable-source oisf/trafficid
sudo suricata-update enable-source ptresearch/attackdetection
sudo suricata-update enable-source sslbl/ssl-fp-blacklist

# Disable specific rules that generate false positives
echo "2100498" >> /etc/suricata/disable.conf
echo "group:emerging-policy.rules" >> /etc/suricata/disable.conf

# Modify rule actions (change alert to drop)
echo 're:ET MALWARE' >> /etc/suricata/modify.conf

# Apply updates
sudo suricata-update --reload-command="suricatasc -c reload-rules"

步骤 5：编写自定义规则

创建 /var/lib/suricata/rules/local.rules：

# Detect potential reverse shell over TCP
drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"LOCAL Potential Reverse Shell - /bin/bash in payload"; flow:to_server,established; content:"/bin/bash"; content:"-i"; within:20; classtype:trojan-activity; sid:1000001; rev:1;)

# Block known malicious user agent
drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"LOCAL Malicious User-Agent - Cobalt Strike"; http.user_agent; content:"Mozilla/5.0 (compatible|3b| MSIE 9.0|3b| Windows NT 6.1|3b| WOW64|3b| Trident/5.0)"; classtype:trojan-activity; sid:1000002; rev:1;)

# Detect DNS query for known DGA domain pattern
alert dns $HOME_NET any -> any 53 (msg:"LOCAL Suspicious DGA Domain Query"; dns.query; content:".top"; pcre:"/^[a-z0-9]{12,30}\.(top|xyz|club|online|site)$/"; classtype:bad-unknown; sid:1000003; rev:1;)

# Detect large DNS TXT response (potential C2)
alert dns any 53 -> $HOME_NET any (msg:"LOCAL Large DNS TXT Response - Potential C2"; dns.opcode:0; content:"|00 10|"; byte_test:2,>,500,0,relative; classtype:bad-unknown; sid:1000004; rev:1;)

# Block outbound traffic to Tor exit nodes
drop tcp $HOME_NET any -> [100.2.18.10,104.244.76.13,109.70.100.1] any (msg:"LOCAL Outbound Connection to Known Tor Exit Node"; classtype:policy-violation; sid:1000005; rev:1;)

# Detect SMB lateral movement attempts
alert tcp $HOME_NET any -> $HOME_NET 445 (msg:"LOCAL Internal SMB Connection - Possible Lateral Movement"; flow:to_server,established; content:"|ff|SMB"; offset:4; depth:4; threshold:type both,track by_src,count 5,seconds 60; classtype:attempted-admin; sid:1000006; rev:1;)

# Detect PowerShell download cradle
drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"LOCAL PowerShell Download Cradle Detected"; http.user_agent; content:"PowerShell"; nocase; http.method; content:"GET"; classtype:trojan-activity; sid:1000007; rev:1;)

# Detect ICMP tunneling (large ICMP packets)
alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"LOCAL Oversized ICMP Packet - Possible Tunneling"; dsize:>800; threshold:type both,track by_src,count 10,seconds 60; classtype:bad-unknown; sid:1000008; rev:1;)

步骤 6：在 IPS 模式下启动 Suricata

# Test configuration
sudo suricata -T -c /etc/suricata/suricata.yaml

# Start in NFQUEUE IPS mode
sudo suricata -c /etc/suricata/suricata.yaml -q 0

# Start with AF_PACKET inline mode
sudo suricata -c /etc/suricata/suricata.yaml --af-packet

# Start as systemd service
sudo systemctl enable suricata
sudo systemctl start suricata

# Monitor performance stats
tail -f /var/log/suricata/stats.log

# Reload rules without restart
sudo suricatasc -c reload-rules

监控与调优

性能指标

# Check kernel drops
sudo suricatasc -c dump-counters | grep -E "capture.kernel_drops|decoder.pkts"

# Monitor EVE JSON alerts
tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'

# Check rule loading
grep -c "rules loaded" /var/log/suricata/suricata.log

# Memory usage
sudo suricatasc -c dump-counters | grep memuse

针对误报的调优

# Identify noisy rules
cat /var/log/suricata/eve.json | jq -r 'select(.event_type=="alert") | .alert.signature_id' | sort | uniq -c | sort -rn | head -20

# Suppress specific rules per source
echo "suppress gen_id 1, sig_id 2100498, track by_src, ip 10.0.5.0/24" >> /etc/suricata/threshold.config

# Rate-limit alerts
echo "rate_filter gen_id 1, sig_id 2100366, track by_src, count 10, seconds 60, new_action alert, timeout 300" >> /etc/suricata/threshold.config

最佳实践

• 从 IDS 模式开始 - 首先以 IDS（仅告警）模式部署，调优 2-4 周，然后切换到 IPS
• 故障开放 - 配置故障开放模式，以便在 Suricata 崩溃时网络流量继续传输
• 规则调优 - 在启用阻断动作之前，使用阈值和抑制指令减少误报
• CPU 亲和性 - 将 Suricata 工作线程固定到专用 CPU 核心，以获得稳定的性能
• 可信流量绕过 - 对已知良好的流量使用 pass 规则以减少处理负载
• 定期更新 - 通过 cron 每天运行 suricata-update 以保持签名最新
• 监控丢包 - 跟踪内核数据包丢弃情况，必要时增加环形缓冲区大小

References

• Suricata Documentation
• Suricata Rules Format
• Emerging Threats Rulesets
• OISF Suricata GitHub
• Suricata-Update Documentation