20.500.12556/RUL-187389 Analiza privzetih pravil sistema Suricata: primer spletne aplikacije Analysis of Suricata’s Default Ruleset: A Web Application Case Study Platforma Security Onion ob namestitvi naloži Suricato z naborom pravil ET Open. Diplomsko delo preverja, ali ta privzeta pravila zadoščajo za zaznavo napada na ranljivo spletno aplikacijo. V izoliranem virtualnem okolju je bilo postavljeno testno omrežje s sistemom za zaznavanje vdorov in namensko ranljivo aplikacijo, napad pa izveden dvakrat, s privzetimi nastavitvami orodij in ob poznavanju naloženih pravil. Glasna izvedba je sprožila trideset unikatnih opozoril, prikrita ob enakem izidu nobenega. Vzroki so vezanost pravil na atribute pod nadzorom napadalca, obhod pragov, neskladje pri dekodiranju in opisovanje zapisa namesto vedenja. Poleg pomanjkljivosti v samem naboru je bilo ugotovljeno, da privzeta pravila brez prilagoditev konkretnemu okolju ne zagotavljajo ustrezne zaznave. Na tej podlagi je bil razvit nabor pravil, prilagojen sistemu, preverjena pa je bila tudi njihova učinkovitost z vidika zaznavanja napadov ter pojavljanja lažno pozitivnih rezultatov. Končni nabor zanesljivo zazna tudi prikriti napad in vse uporabljene tehnike izogibanja. Security Onion deploys Suricata with the Emerging Threats Open ruleset on installation. This thesis examines whether these default rules are sufficient to detect an attack on a vulnerable web application. A test network with an intrusion detection system and a purpose-built vulnerable application was set up in an isolated virtual environment, and the attack was carried out twice, once with the default tool settings and once with knowledge of the loaded rules. The noisy run triggered thirty unique alerts, while the covert run produced none despite reaching the same outcome. The causes lie in rules bound to attacker-controlled attributes, threshold evasion, decoding mismatches and the description of syntax rather than behaviour. In addition to shortcomings within the ruleset itself, it was determined that default rules do not provide good enough protection without adaptation to the specific environment. On this basis, a custom ruleset tailored to the system was developed, and its effectiveness was evaluated both in terms of attack detection and the generation of false positives. The final ruleset reliably detects covert attacks as well as all evasion techniques used. zaznavanje vdorov Suricata Security Onion spletne aplikacije izogibanje zaznavi intrusion detection Suricata Security Onion web applications evasion true false false Slovenski jezik Angleški jezik Diplomsko delo/naloga 2026-09-10 16:00:03 2026-09-10 16:00:13 2026-09-25 06:30:06 0000-00-00 00:00:00 2026 0 0 0000-00-00 NiDoloceno NiDoloceno NiDoloceno 0000-00-00 0000-00-00 0000-00-00 38994 292437507 Jelen_Blaz_-_Analiza_privzetih_pravil_sistema_Suricata_primer_spletne_aplikacije.pdf Jelen_Blaz_-_Analiza_privzetih_pravil_sistema_Suricata_primer_spletne_aplikacije.pdf 1 F3DCF259D5550E3282A9D661AF5136DF edb35d631d4abb0010385fcd4f5dec8c5ddf3a9f0d8452c8d80c236a4ecfe4bb f278631e-ad1f-11f1-8bc5-0050569b8976 https://repozitorij.uni-lj.si/Dokument.php?lang=slv&id=247017 Fakulteta za računalništvo in informatiko 0 0 0