Suricata

This is to propose the integration with nDPI.

This would allow Suricata to
- augment exported alerts and netflow records with the layer-7 protocol and metadata extracted by nDPI
- add a new ndpi-protocol keyword to match traffic against hundreds of Layer-7 protocols (e.g. TLS.YouTube)
- add a new ndpi-risk keyword to match flow risks detected by nDPI (e.g. Binary Application Transfer, Malware Host Contacted, etc.)

There is already a pending PR #11671. With the proposed PR, nDPI can be optionally linked in Suricata
with configure flags (e.g. configure --enable-ndpi --with-ndpi=/home/user/nDPI).