借助 VPC Traffic Mirroring 构建网络入侵检测系统

##安装suricata package，会自动安装依赖包
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt-get update
sudo apt-get install Suricata -y

##安装Suricata之后，配置文件目录位于/etc/suricata/
/etc/suricata/
├── classification.config		##规则产生的告警分类以及等级的定义
├── reference.config		    ##规则库的来源参考
├── rules			            ##Suricata安装包自带的一些安全规则文件目录
├── suricata.yaml		        ##Suricata配置文件
└── threshold.config		    ##定义规则产生告警的频率阈值，避免不重要的规则产生过多的告警

##配置文件目录位于/etc/suricata/，大多情况使用默认配置即可。
## Step 1: inform Suricata about your network
vars:
  # more specific is better for alert accuracy and performance
  address-groups:
    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"  ##根据实际情况修改Local subnet
##
## Step 2: select outputs to enable
outputs:
  - eve-log:
      enabled: yes
      xff:
        enabled: no             ##修改为YES，以启动X-forwarded-for的支持，否则在CDN/ALB场景下无法记录真实源IP
##
## Step 4: configure common capture settings
# Linux high speed capture support
## Suricata支持两种高性能抓包引擎af_packet和pf_ring，默认采用af_packet，每个CPU启动一个抓包线程
af-packet:
  - interface: eth0   	        ##默认从eth0接收流量，注意需要与OS的ifconfig中的网卡名称对应
##
## Configure Suricata to load Suricata-Update managed rules.
default-rule-path: /var/lib/suricata/rules  	 ##指定Suricata规则所在目录默认该目录不存在，使用suricata-update可自动创建该目录，并获取最新的rule
rule-files:
  - suricata.rules		        ##默认Suricata使用的rule，如果有自定义的rule，需要在这里手动添加文件名

ubuntu@ip-172-31-1-10:~$ sudo suricata-update
14/6/2020 -- 04:32:11 - <Info> -- Using data-directory /var/lib/suricata.
14/6/2020 -- 04:32:11 - <Info> -- Using Suricata configuration /etc/suricata/suricata.yaml
14/6/2020 -- 04:32:11 - <Info> -- Using /etc/suricata/rules for Suricata provided rules.
……
14/6/2020 -- 04:32:15 - <Info> -- Loaded 27232 rules.
14/6/2020 -- 04:32:16 - <Info> -- Disabled 14 rules.
14/6/2020 -- 04:32:16 - <Info> -- Enabled 0 rules.
14/6/2020 -- 04:32:16 - <Info> -- Modified 0 rules.
14/6/2020 -- 04:32:16 - <Info> -- Dropped 0 rules.
14/6/2020 -- 04:32:16 - <Info> -- Enabled 141 rules for flowbit dependencies.
14/6/2020 -- 04:32:16 - <Info> -- Creating directory /var/lib/suricata/rules.
14/6/2020 -- 04:32:16 - <Info> -- Backing up current rules.
14/6/2020 -- 04:32:16 - <Info> -- Writing rules to /var/lib/suricata/rules/suricata.rules: total: 27232; enabled: 20394; added: 27232; removed 0; modified: 0

##Suricata规则格式
alert http $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE CommentCrew Possible APT crabdance backdoor base64 head"; flow:established,to_client; file_data; content:"MS4nJzJ4cHZyeQ=="; metadata: former_category MALWARE; classtype:targeted-activity; sid:2016485; rev:4; metadata:created_at 2013_02_22, updated_at 2013_02_22;)

sudo suricata-update
sudo suricatasc -c reload-rules

sudo service suricata restart

/var/log/suricata/
├── certs
├── core
├── eve.json		    ##以JSON格式产生的所有捕获的flow，alert，stats等日志，以及例如HTTP等协议的应用日志
├── fast.log		    ##检测分析产生的alert日志
├── files
├── stats.log		    ##捕获，处理数据包数量的详细统计
├── suricata.log		##服务运行时的详细日志
└── suricata-start.log	##服务启动时的详细日志

##eve.json格式
{
    "timestamp": "2009-11-24T21:27:09.534255",
    "event_type": "alert",
    "src_ip": "192.168.2.7",
    "src_port": 1041,
    "dest_ip": "x.x.250.50",
    "dest_port": 80,
    "proto": "TCP",
    "alert": {
        "action": "allowed",
        "gid": 1,
        "signature_id" :2001999,
        "rev": 9,
        "signature": "ET MALWARE BTGrab.com Spyware Downloading Ads",
        "category": "A Network Trojan was detected",
        "severity": 1
    }
}

##1. 从 https://github.com/awslabs/amazon-kinesis-agent 下载代理，安装Kinesis Agent需要先安装Java环境。
sudo apt-get install openjdk-8-jdk -y
sudo apt-get install git -y
git clone https://github.com/awslabs/amazon-kinesis-agent.git
##2. 导航到下载目录并运行以下命令来安装代理：
cd amazon-kinesis-agent
sudo ./setup --install

##将xxxxxxx替换为accountID，以ap-northeast-1为例
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "firehose:PutRecord",
                "firehose:PutRecordBatch"
            ],
            "Resource": [
                "arn:aws:firehose:ap-northeast-1:xxxxxxxxxx:deliverystream/*"
            ]
        },
        {
            "Action": [
                "cloudwatch:PutMetricData"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

ubuntu@ip-172-31-41-117:~$ sudo grep -rnw 'ET WEB_SERVER cmd.exe In URI - Possible Command Execution Attempt' /var/lib/suricata/rules/suricata.rules
9009:alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER cmd.exe In URI - Possible Command Execution Attempt"; flow:to_server,established; content:"/cmd.exe"; http_uri; nocase; reference:url,doc.emergingthreats.net/2009361; classtype:attempted-recon; sid:2009361; rev:7; metadata:created_at 2010_07_30, updated_at 2019_09_27;)