Use of Suricata, ElasticStack, Neo4j and Linkurious for network defence - Archive ouverte HAL Access content directly
Poster Communications Year : 2019

Use of Suricata, ElasticStack, Neo4j and Linkurious for network defence

Abstract

Suricata is a powerful tool to detect network anomalies based on signatures. However, the data collected by the NIDS are also precious to generate graphs for network defense. During our PhD, we have used Suricata and the Vega tool of the ElasticStack to create parallel coordinates graphs. However, Suricata doesn't yet give information about the direction of the connection (to or from a client to or from a server). This lack leads to a mirror effect in the graph. The flow_direction feature to be shortly merged in Suricata now enables this feature for a proper - and real time - rendering of the network flow diagram. Finally, we have also used Neo4j and Linkurious tool to help for the search and visualization within the metadata stored in Elastic. The use of a graph database makes the requests fast and easy. Linkurious also helps to create easy to understand visualizations of the network flows between clients and servers. Those tools were presented to different SOCs operators with great success.
No file

Dates and versions

hal-02336548 , version 1 (29-10-2019)

Identifiers

  • HAL Id : hal-02336548 , version 1

Cite

Olivier Jacq, David Brosset, Jacques Simonin, Yvon Kermarrec. Use of Suricata, ElasticStack, Neo4j and Linkurious for network defence. SuriCon, Oct 2019, Amsterdam, Netherlands. ⟨hal-02336548⟩
185 View
0 Download

Share

Gmail Facebook X LinkedIn More