Enhancing Suricata Performance with a DPI Engine

Presented at SuriCon 2022 by Sébastien Synold
Whether used for active threat blocking or passive threat detection, Suricata’s functional performance can be improved by integrating it with open source or commercial DPI software. This talk will provide examples of how such an integration can enable Suricata to:
1) detect threats cloaked by evasive techniques such as tunneling, encryption, and spoofing
2) improve white- and blacklisting through expanded application and protocol recognition (even for encrypted traffic)
3) reduce false positives and false negatives through more detailed and accurate classification
4) improve threat hunting and forensics through contextual metadata.