I’m building Suri Oculus 4.0 — host behavior profiling and anomaly analysis on top of Suricata

I’ve been working on Suri Oculus 4.0, an open-source network monitoring and analysis platform built around Suricata, and I’d like to share the current state of the project with the community.

The basic idea behind Suri Oculus is simple: Suricata already provides a huge amount of useful network data through EVE JSON, but as the amount of traffic grows, investigating individual events becomes increasingly difficult.

Suri Oculus adds an additional processing and visualization layer on top of Suricata.

The current architecture looks roughly like this:

Network traffic | v Suricata | v EVE JSON | v daemonmove | v Redis | +-------------------+ | | v v Host Behavior Anomaly Analysis Fingerprinting | | +---------+---------+ | v C++ REST API | v Suri Oculus UI 

The backend is primarily written in C++ using Pistache, while Python/FastAPI is used for parts of the data analysis pipeline. Redis is used for event processing and aggregated host data. The frontend is implemented in HTML and plain JavaScript.

One of the main areas I have been working on for version 4.0 is HBF — Host Behavior Fingerprinting.

Instead of looking only at individual Suricata events, HBF gradually builds a behavioral profile for hosts observed on the network.

For each device, Suri Oculus can aggregate information such as:

• network flows
• DNS activity
• TLS connections and SNI
• destination ports
• TCP/UDP/ICMP activity
• Suricata alerts
• first and last observed activity
• general activity statistics

The idea is to provide another perspective on Suricata data.

Instead of asking only:

“What event occurred?”

we can also ask:

“How does this host normally behave on the network?”

For example, a workstation may normally communicate with a relatively stable set of services, use a predictable set of destination ports, and generate characteristic DNS and TLS activity. A significant change in that behavior does not automatically indicate an attack, but it can provide useful context for further investigation.

Suri Oculus also contains an anomaly-analysis layer. Suricata events are converted into numerical features and analyzed using Isolation Forest. This is not intended to replace Suricata signatures. The two approaches address different problems: Suricata detects traffic matching defined rules, while anomaly analysis can highlight activity that differs statistically from previously observed data.

Another goal for version 4.0 was to make the project easier to install and test.

Pre-built packages are now available for:

• Fedora 42, 43 and 44
• RHEL 9 and 10
• Debian 12 and 13
• Ubuntu 22.04 and 24.04

RPM and DEB packages are published together with SHA-256 checksums and GPG signatures.

The project currently consists of several components, including the C++ backend, web frontend, daemonmove event-processing service, supporting tools, and Pistache packages.

I’m particularly interested in feedback from people who already use Suricata in real networks.

Some questions I’m currently interested in:

• What host-level information would be most useful when investigating Suricata events?
• Which behavioral indicators would you expect to see in a host profile?
• Would historical HBF snapshots be useful for comparing device behavior over time?
• Which Suricata event types should receive more attention in behavioral analysis?

Project website and downloads:

https://suri-oculus.com/

Feedback, testing results, architecture suggestions, and criticism are welcome.