new: [ausCert] slide-deck
|
@ -0,0 +1,437 @@
|
|||
% Full instructions available at:
|
||||
% https://github.com/elauksap/focus-beamertheme
|
||||
|
||||
\documentclass{beamer}
|
||||
\usetheme[numbering=progressbar]{focus}
|
||||
\usepackage{tikz}
|
||||
\usetikzlibrary{positioning}
|
||||
\usetikzlibrary{shapes,arrows}
|
||||
\usepackage{transparent}
|
||||
\usepackage{fancyvrb}
|
||||
\usepackage{listings}
|
||||
\usepackage{tabularx}
|
||||
\usepackage{amsfonts}
|
||||
\usepackage{csquotes}
|
||||
\definecolor{main}{RGB}{47, 161, 219}
|
||||
\definecolor{background}{RGB}{240, 247, 255}
|
||||
\definecolor{textcolor}{RGB}{85, 87, 83}
|
||||
|
||||
\title{D4 Project}
|
||||
\subtitle{Open and collaborative network monitoring}
|
||||
\author{TEAM CIRCL}
|
||||
\titlegraphic{\includegraphics[scale=0.20]{../../logos/d4-logo.pdf}}
|
||||
\institute{Team CIRCL \\ \url{https://www.d4-project.org/}}
|
||||
\date{2019/06/03-04}
|
||||
|
||||
\begin{document}
|
||||
\begin{frame}
|
||||
\maketitle
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{Problem statement}
|
||||
\begin{itemize}
|
||||
\item CSIRTs (or private organisations) build their {\bf own honeypot, honeynet or blackhole monitoring network}
|
||||
\item Designing, managing and operating such infrastructure is a tedious and resource intensive task
|
||||
\item {\bf Automatic sharing} between monitoring networks from different organisations is missing
|
||||
\item Sensors and processing are often seen as blackbox or difficult to audit
|
||||
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{Objective}
|
||||
\begin{itemize}
|
||||
\item Based on our experience with
|
||||
MISP\footnote{\url{https://github.com/MISP/MISP}} where sharing
|
||||
played an important role, we transpose the model in D4 project
|
||||
\item Keeping the protocol and code base {\bf simple and minimal}
|
||||
\item Allowing every organisation to {\bf control and audit their own sensor network}
|
||||
\item Extending D4 or {\bf encapsulating legacy monitoring protocols} must be as simple as possible
|
||||
\item Ensuring that the sensor server has {\bf no control on the sensor} (unidirectional streaming)
|
||||
\item Don't force users to use dedicated sensors and allow {\bf flexibility of sensor support} (software, hardware, virtual)
|
||||
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{D4 Overview}
|
||||
\includegraphics[scale=0.38]{../../diagram/d4-overview.png}
|
||||
\end{frame}
|
||||
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{(short) History}
|
||||
\begin{itemize}
|
||||
\item D4 Project (co-funded under INEA CEF EU program) started - {\bf 1st November 2018}
|
||||
\item D4 encapsulation protocol version 1 published - {\bf 1st December 2018}
|
||||
\item v0.1 release of the D4 core\footnote{\url{https://www.github.com/D4-project/d4-core}} including a server and simple D4 C client - {\bf 21st January 2019}
|
||||
\item First version of a golang D4
|
||||
client\footnote{\url{https://www.github.com/D4-project/d4-goclient/}}
|
||||
running on ARM, MIPS, PPC and x86 - {\bf 14th February 2019}
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{(short) History}
|
||||
\begin{center}
|
||||
\begin{tabularx}{\linewidth}%
|
||||
{>{\setlength\hsize{0.6\hsize}\raggedright}X%
|
||||
>{\setlength\hsize{0.4\hsize}\raggedright}X}
|
||||
|
||||
\hline
|
||||
Release & Date \tabularnewline
|
||||
\hline
|
||||
analyzer-d4-passivedns-v0.1 & Apr. 5, 2019 \tabularnewline
|
||||
analyzer-d4-passivessl-0.1 & Apr. 25, 2019 \tabularnewline
|
||||
analyzer-d4-pibs-v0.1 & Apr. 8, 2019 \tabularnewline
|
||||
BGP-Ranking-1.0 & Apr. 25, 2019 \tabularnewline
|
||||
d4-core-v0.1 & Jan. 25, 2019 \tabularnewline
|
||||
d4-core-v0.2 & Feb. 14, 2019 \tabularnewline
|
||||
d4-core-v0.3 & Apr. 8, 2019 \tabularnewline
|
||||
d4-goclient-v0.1 & Feb. 14, 2019 \tabularnewline
|
||||
d4-goclient-v0.2 & Apr. 8, 2019 \tabularnewline
|
||||
d4-server-packer-0.1 & Apr. 25, 2019 \tabularnewline
|
||||
IPASN-History-1.0 & Apr. 25, 2019 \tabularnewline
|
||||
sensor-d4-tls-fingerprinting-0.1 & Apr. 25, 2019 \tabularnewline
|
||||
\hline
|
||||
|
||||
\end{tabularx}
|
||||
\end{center}
|
||||
|
||||
see \url{https://github.com/D4-Project}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{Roadmap - output}
|
||||
|
||||
CIRCL will host a server instance for organisations willing to
|
||||
contribute to a public dataset without running their own D4 server:
|
||||
\begin{itemize}
|
||||
\item [\checkmark] Blackhole DDoS
|
||||
\item [\checkmark] Passive DNS
|
||||
\item [\checkmark] Passive SSL
|
||||
\item BGP mapping
|
||||
\item egress filtering mapping
|
||||
\item Radio-Spectrum monitoring: 802.11, BLE, etc.
|
||||
\item ...
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{D4 encapsulation protocol}
|
||||
\includegraphics[scale=0.38]{../../diagram/d4-protocol-encapsulation.png}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{D4 Header}
|
||||
\begin{tabular}{|l|l|l|}
|
||||
\hline
|
||||
Name & bit size& Description\\
|
||||
\hline
|
||||
version & uint 8 & Version of the header \\
|
||||
type & uint 8 & Data encapsulated type\\
|
||||
uuid & uint 128 & Sensor UUID\\
|
||||
timestamp & uint 64 & Encapsulation time\\
|
||||
hmac & uint 256 & Authentication header (HMAC-SHA-256-128)\\
|
||||
size & uint 32 & Payload size\\
|
||||
\hline
|
||||
\end{tabular}
|
||||
\end{frame}
|
||||
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{D4 Header}
|
||||
\framesubtitle{Types}
|
||||
\begin{tabular}{|l|l|}
|
||||
\hline
|
||||
Type & Description\\
|
||||
\hline
|
||||
0 & Reserved\\
|
||||
1 & pcap (libpcap 2.4)\\
|
||||
2 & meta header (JSON)\\
|
||||
3 & generic log line\\
|
||||
4 & dnscap output\\
|
||||
5 & pcapng (diagnostic)\\
|
||||
6 & generic NDJSON or JSON Lines\\
|
||||
7 & generic YAF (Yet Another Flowmeter)\\
|
||||
8 & passivedns CSV stream\\
|
||||
254 & type defined by meta header (type 2)\\
|
||||
\hline
|
||||
\end{tabular}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{D4 meta header}
|
||||
\framesubtitle{Meta types}
|
||||
D4 header includes an easy way to {\bf extend the protocol} (via type 2) without altering the format. Within a D4 session, the initial D4 packet(s) type 2 defines
|
||||
the custom headers and then the following packets with type 254 is the custom data encapsulated.
|
||||
\small
|
||||
\input{meta.tex}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{D4 server}
|
||||
\begin{itemize}
|
||||
\item D4 core server\footnote{\url{https://github.com/D4-project/d4-core}} is a complete server to handle clients (sensors) including the decapsulation of the D4 protocol, control of sensor registrations, management of decoding protocols and dispatching to adequate decoders/analysers.
|
||||
\item D4 server is written in Python 3.6 and runs on standard GNU/Linux distribution.
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{D4 server - management interface}
|
||||
The D4 server provides a {\bf web interface} to manage D4 sensors, sessions and analyzer.
|
||||
\begin{itemize}
|
||||
\item Get Sensors status, errors and statistics
|
||||
\item Get all connected sensors
|
||||
\item Manage Sensors (stream size limit, secret key, ...)
|
||||
\item Manage Accepted types
|
||||
\item UUID/IP blocklist
|
||||
\item Create Analyzer Queues
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{D4 server - main interface}
|
||||
\includegraphics[width=\textwidth]{./d4-5.png}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{D4 server - server management}
|
||||
\includegraphics[width=\textwidth]{./d4-2.png}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{D4 server - server management}
|
||||
\includegraphics[width=\textwidth]{./d4-3.png}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{D4 server - sensor overview}
|
||||
\includegraphics[width=\textwidth]{./d4-1.png}
|
||||
\end{frame}
|
||||
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{D4 server - sensor management}
|
||||
\includegraphics[width=\textwidth]{./d4-4.png}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{}
|
||||
\begin{center}
|
||||
{\bf A distributed Network telescope to observe DDoS attacks}
|
||||
\end{center}
|
||||
\vspace{10pt}
|
||||
\begin{center}
|
||||
\includegraphics[width=.7\textwidth]{eventhorizon.png}
|
||||
\end{center}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{Motivation}
|
||||
DDoS Attacks produce an observable side-effect:
|
||||
\begin{center}
|
||||
\scalebox{0.8}{\input{bsvol.tex}}
|
||||
\end{center}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{What can be derived from backscatter traffic?}
|
||||
|
||||
\begin{itemize}
|
||||
\item External point of view on ongoing Denial of Service attacks:
|
||||
\begin{itemize}
|
||||
\item {\bf Confirm} if there is a DDoS attack
|
||||
\item {\bf Recover} time line of attacked targets
|
||||
\item {\bf Confirm} which services (DNS, webserver, $\dots$)
|
||||
\item {\bf Observe} Infrastructure changes
|
||||
\end{itemize}
|
||||
\item {\bf Assess the state of an infrastructure under denial of service attack}
|
||||
\begin{itemize}
|
||||
\item {\bf Detect} failure/addition of intermediate network equipments, firewalls, proxy servers etc
|
||||
\item {\bf Detect} DDoS mitigation devices
|
||||
\end{itemize}
|
||||
\item Create models of DoS/DDoS attacks
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{D4 in this setting}
|
||||
|
||||
|
||||
D4 - for data collection and processing:
|
||||
\begin{itemize}
|
||||
\item {\bf provide} various points of observation in non contiguous address space,
|
||||
\item {\bf aggregate} and {\bf mix} backscatter traffic collected from D4 sensors,
|
||||
\item {\bf perform} analysis on big amount of data.
|
||||
\end{itemize}
|
||||
|
||||
D4 - from a end-user perspective:
|
||||
\begin{itemize}
|
||||
\item {\bf provide} backscatter analysis results,
|
||||
\item {\bf provide} daily updates,
|
||||
\item {\bf provide} additional relevant (or pivotal) information (DNS, BGP, etc.),
|
||||
\item {\bf provide} an API and search capabilities.
|
||||
\end{itemize}
|
||||
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{First release}
|
||||
|
||||
\begin{itemize}
|
||||
\item[\checkmark]
|
||||
analyzer-d4-pibs\footnote{\url{https://github.com/D4-project/analyzer-d4-pibs}}, an analyzer for a D4 network sensor:
|
||||
|
||||
\begin{itemize}
|
||||
\item {\bf processes} data produced by D4 sensors (pcaps),
|
||||
\item {\bf displays} potential backscatter traffic on standard output,
|
||||
\item {\bf focuses} on TCP SYN flood in this first release.
|
||||
|
||||
\end{itemize}
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
\begin{frame}
|
||||
\begin{center}
|
||||
{\bf Passive DNS}
|
||||
\end{center}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{Problem statement}
|
||||
\begin{itemize}
|
||||
\item CIRCL (and other CSIRTs) have their own passive DNS\footnote{\url{https://www.circl.lu/services/passive-dns/}} collection mechanisms
|
||||
\item Current {\bf collection models} are affected with DoH\footnote{DNS over HTTPS} and centralised DNS services
|
||||
\item DNS answers collection is a tedious process
|
||||
\item {\bf Sharing Passive DNS stream} between organisation is challenging due to privacy
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{Potential Strategy}
|
||||
\begin{itemize}
|
||||
\item Improve {\bf Passive DNS collection diversity} by being closer to the source and limit impact of DoH (e.g. at the OS resolver level)
|
||||
\item Increasing diversity and {\bf mixing models} before sharing/storing Passive DNS records
|
||||
\item Simplify process and tools to install for {\bf Passive DNS collection by relying on D4 sensors} instead of custom mechanisms
|
||||
\item Provide a distributed infrastructure for mixing streams and filtering out the sharing to the validated partners
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{First release}
|
||||
|
||||
\begin{itemize}
|
||||
\item[\checkmark]
|
||||
analyzer-d4-passivedns\footnote{\url{https://github.com/D4-project/analyzer-d4-passivedns}}, an analyzer for a D4 network sensor:
|
||||
|
||||
\begin{itemize}
|
||||
\item {\bf processes} data produced by D4 sensors (in passivedns CSV format\footnote{\url{https://github.com/gamelinux/passivedns}}),
|
||||
|
||||
\item{\bf ingests} these into a {\bf Passive DNS server} which can be queried later to search for the Passive DNS records,
|
||||
|
||||
\item{\bf provides} a lookup server (using on
|
||||
redis-compatible backend) that is a Passive DNS REST server compliant to the Common Output Format\footnote{\url{https://tools.ietf.org/html/draft-dulaunoy-dnsop-passive-dns-cof-04}}.
|
||||
\end{itemize}
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\begin{center}
|
||||
{\bf Passive SSL revamping}
|
||||
\end{center}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{A passive SSL fingerprinter}
|
||||
CSIRT's rationale for collecting TLS handshakes:
|
||||
\begin{itemize}
|
||||
\item {\bf pivot} on additional data points,
|
||||
\item {\bf find} owners of IP addresses,
|
||||
\item {\bf detect} usage of CIDR blocks,
|
||||
\item {\bf detect} vulnerable systems,
|
||||
\item {\bf detect} compromised services,
|
||||
\item {\bf detect} key material reuse,
|
||||
\item {\bf detect} weak keys.
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{Objectives - TLS Fingerprinting}
|
||||
{\bf Keeping} a log of links between:
|
||||
\begin{itemize}
|
||||
\item x509 certificates,
|
||||
\item ports,
|
||||
\item IP address,
|
||||
\item client (ja3),
|
||||
\item server (ja3s),
|
||||
\end{itemize}
|
||||
\begin{displayquote}
|
||||
``JA3 is a method for creating SSL/TLS client fingerprints that should be easy to produce on any platform and can be easily shared for threat intelligence.''\footnote{https://github.com/salesforce/ja3}
|
||||
\end{displayquote}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{Objectives - Mind your Ps and Qs}
|
||||
{\bf Collect} and {\bf store} x509 certificates and TLS sessions:
|
||||
\begin{itemize}
|
||||
\item Public keys type and size,
|
||||
\item moduli and exponents,
|
||||
\item curves parameters.
|
||||
\end{itemize}
|
||||
{\bf Detect} anti patterns in crypto:
|
||||
\begin{itemize}
|
||||
\item Shared Public Keys,
|
||||
\item Moduli that share one prime factor,
|
||||
\item Moduli that share both prime factor,
|
||||
\item Small factors,
|
||||
\item Nonces reuse / common preffix or suffix, etc.
|
||||
\end{itemize}
|
||||
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{First release}
|
||||
\begin{itemize}
|
||||
\item[\checkmark] sensor-d4-tls-fingerprinting
|
||||
\footnote{\url{github.com/D4-project/sensor-d4-tls-fingerprinting}}:
|
||||
{\bf Extracts} and {\bf fingerprints} certificates, and {\bf computes} TLSH fuzzy hash.
|
||||
\item[\checkmark] analyzer-d4-passivessl
|
||||
\footnote{\url{github.com/D4-project/analyzer-d4-passivessl}}:
|
||||
{\bf Stores} Certificates / PK details in a PostgreSQL DB.
|
||||
\item lookup-d4-passivessl
|
||||
\footnote{\url{github.com/D4-project/lookup-d4-passivessl}}:
|
||||
{\bf Exposes} the DB through a public REST API.
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}{Future}
|
||||
\begin{itemize}
|
||||
\item {\bf Mixing models for passive collection streams} (for privacy) in next version of D4 core server
|
||||
\item {\bf Interconnecting private D4 sensor networks} with other D4 sensor networks (sharing to partners filtered stream)
|
||||
\item {\bf Previewing datasets} collected in D4 sensor network and providing {\bf open data stream} (if contributor agrees to share under specific conditions)
|
||||
\item {\bf Leverage MISP sharing communities} to augment Threat
|
||||
Intelligence, and provide accurate metrology.
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}
|
||||
\frametitle{Get in touch if you want to join the project, host a sensor or contribute}
|
||||
\begin{itemize}
|
||||
\item Collaboration can include research partnership, sharing of collected streams or improving the software.
|
||||
\item Contact: info@circl.lu
|
||||
\item \url{https://github.com/D4-Project}
|
||||
\item \url{https://twitter.com/d4_project}
|
||||
\item \url{https://d4-project.org}
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
|
||||
\end{document}
|
|
@ -0,0 +1,71 @@
|
|||
% Copyright (C) 2018 Pasquale Claudio Africa.
|
||||
% 2018 Sebastian Friedl.
|
||||
%
|
||||
% This file is part of beamerthemefocus.
|
||||
%
|
||||
% beamerthemefocus is free software: you can redistribute it and/or modify
|
||||
% it under the terms of the GNU General Public License as published by
|
||||
% the Free Software Foundation, either version 3 of the License, or
|
||||
% (at your option) any later version.
|
||||
%
|
||||
% beamerthemefocus is distributed in the hope that it will be useful,
|
||||
% but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
% GNU General Public License for more details.
|
||||
%
|
||||
% You should have received a copy of the GNU General Public License
|
||||
% along with beamerthemefocus. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
\mode<presentation>
|
||||
|
||||
|
||||
% DEFINE COLORS. ---------------------------------------------------------------
|
||||
\definecolor{main}{RGB}{64, 64, 64}
|
||||
\definecolor{background}{RGB}{239, 239, 239}
|
||||
|
||||
\definecolor{alert}{RGB}{180, 0, 0}
|
||||
\definecolor{example}{RGB}{0, 110, 0}
|
||||
|
||||
|
||||
% SET COLORS. ------------------------------------------------------------------
|
||||
\setbeamercolor{normal text}{fg=textcolor, bg=background}
|
||||
\setbeamercolor{alerted text}{fg=alert}
|
||||
\setbeamercolor{example text}{fg=example}
|
||||
|
||||
\setbeamercolor{titlelike}{fg=background, bg=main}
|
||||
\setbeamercolor{frametitle}{parent={titlelike}}
|
||||
|
||||
\setbeamercolor{footline}{fg=background, bg=main}
|
||||
|
||||
\setbeamercolor{block title}{bg=main!80!background, fg=background}
|
||||
\setbeamercolor{block body}{bg=main!10!background, fg=main}
|
||||
|
||||
\setbeamercolor{block title alerted}{bg=alert, fg=background}
|
||||
\setbeamercolor{block body alerted}{bg=alert!10!background, fg=main}
|
||||
|
||||
\setbeamercolor{block title example}{bg=example, fg=background}
|
||||
\setbeamercolor{block body example}{bg=example!10!background, fg=main}
|
||||
|
||||
\setbeamercolor{itemize item}{fg=main}
|
||||
\setbeamercolor{itemize subitem}{fg=main}
|
||||
|
||||
\setbeamercolor{enumerate item}{fg=main!70!black}
|
||||
\setbeamercolor{enumerate subitem}{fg=main!70!black}
|
||||
|
||||
\setbeamercolor{description item}{fg=main!70!black}
|
||||
\setbeamercolor{description subitem}{fg=main!70!black}
|
||||
|
||||
\setbeamercolor{caption name}{fg=textcolor}
|
||||
|
||||
\setbeamercolor{section in toc}{fg=textcolor}
|
||||
\setbeamercolor{subsection in toc}{fg=textcolor}
|
||||
\setbeamercolor{section number projected}{bg=textcolor}
|
||||
\setbeamercolor{subsection number projected}{bg=textcolor}
|
||||
|
||||
\setbeamercolor{bibliography item}{fg=main}
|
||||
\setbeamercolor{bibliography entry author}{fg=main!70!black}
|
||||
\setbeamercolor{bibliography entry title}{fg=main}
|
||||
\setbeamercolor{bibliography entry location}{fg=main}
|
||||
\setbeamercolor{bibliography entry note}{fg=main}
|
||||
|
||||
\mode<all>
|
|
@ -0,0 +1,47 @@
|
|||
% Copyright (C) 2018 Pasquale Claudio Africa.
|
||||
% 2018 Sebastian Friedl.
|
||||
%
|
||||
% This file is part of beamerthemefocus.
|
||||
%
|
||||
% beamerthemefocus is free software: you can redistribute it and/or modify
|
||||
% it under the terms of the GNU General Public License as published by
|
||||
% the Free Software Foundation, either version 3 of the License, or
|
||||
% (at your option) any later version.
|
||||
%
|
||||
% beamerthemefocus is distributed in the hope that it will be useful,
|
||||
% but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
% GNU General Public License for more details.
|
||||
%
|
||||
% You should have received a copy of the GNU General Public License
|
||||
% along with beamerthemefocus. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
\mode<presentation>
|
||||
|
||||
|
||||
% SET FONTS. -------------------------------------------------------------------
|
||||
\setbeamerfont{title}{size=\huge, shape=\bfseries}
|
||||
\setbeamerfont{subtitle}{size=\Large, parent=structure}
|
||||
\setbeamerfont{author}{size=\scriptsize}
|
||||
|
||||
\setbeamerfont{institute}{size=\normalsize}
|
||||
\setbeamerfont{date}{size=\scriptsize}
|
||||
|
||||
\setbeamerfont{sectiontitle}{size=\huge, series=\scshape\bfseries}
|
||||
\setbeamerfont{frametitle}{size=\Large, shape=\scshape}
|
||||
|
||||
\setbeamerfont{footline}{size=\scriptsize}
|
||||
|
||||
\setbeamerfont{focusframe}{size=\huge, shape=\scshape}
|
||||
|
||||
\setbeamerfont{description item}{shape=\bfseries}
|
||||
|
||||
\setbeamerfont{caption name}{shape=\bfseries}
|
||||
|
||||
\setbeamerfont{bibliography item}{size=\small, shape=\scshape}
|
||||
\setbeamerfont{bibliography entry author}{size=\small, shape=\scshape}
|
||||
\setbeamerfont{bibliography entry title}{size=\small, series=\scshape\bfseries}
|
||||
\setbeamerfont{bibliography entry location}{size=\small, shape=\scshape\normalfont}
|
||||
\setbeamerfont{bibliography entry note}{size=\small, shape=\scshape\normalfont}
|
||||
|
||||
\mode<all>
|
|
@ -0,0 +1,117 @@
|
|||
% Copyright (C) 2018 Pasquale Claudio Africa.
|
||||
% 2018 Sebastian Friedl.
|
||||
%
|
||||
% This file is part of beamerthemefocus.
|
||||
%
|
||||
% beamerthemefocus is free software: you can redistribute it and/or modify
|
||||
% it under the terms of the GNU General Public License as published by
|
||||
% the Free Software Foundation, either version 3 of the License, or
|
||||
% (at your option) any later version.
|
||||
%
|
||||
% beamerthemefocus is distributed in the hope that it will be useful,
|
||||
% but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
% GNU General Public License for more details.
|
||||
%
|
||||
% You should have received a copy of the GNU General Public License
|
||||
% along with beamerthemefocus. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
\mode<presentation>
|
||||
|
||||
\RequirePackage{tikz}
|
||||
|
||||
|
||||
% CUSTOMIZE STRUCTURE ELEMENTS. ------------------------------------------------
|
||||
\setbeamertemplate{blocks}[default]
|
||||
|
||||
\setbeamertemplate{section in toc}[square]
|
||||
\setbeamertemplate{subsection in toc}[square]
|
||||
|
||||
\setbeamertemplate{itemize items}[square]
|
||||
\setbeamertemplate{itemize subitem}[triangle]
|
||||
|
||||
|
||||
% STRUCTURE FRAME TEMPLATE DEFINITIONS. ----------------------------------------
|
||||
% Title page.
|
||||
\defbeamertemplate*{title page}{focus}{%
|
||||
{\usebeamercolor{frametitle}\colorlet{focus@@temp}{bg}%
|
||||
\begin{tikzpicture}[overlay, remember picture]
|
||||
\fill[color=focus@@temp] (current page.north west) rectangle ([shift = {(0, -0.45\paperheight)}] current page.north east);
|
||||
\end{tikzpicture}}
|
||||
|
||||
\vspace{-1.65\baselineskip}
|
||||
\begin{minipage}[b][0.35\paperheight]{\textwidth}
|
||||
\vspace{\baselineskip}
|
||||
\usebeamerfont{title}
|
||||
\usebeamercolor[fg]{frametitle}
|
||||
\inserttitle
|
||||
\end{minipage}
|
||||
|
||||
\begin{minipage}[t][0.1\paperheight]{\textwidth}
|
||||
\usebeamerfont{subtitle}
|
||||
\usebeamercolor[fg]{frametitle}
|
||||
\insertsubtitle
|
||||
\end{minipage}
|
||||
|
||||
% Set the title graphic in a zero-height box, so that
|
||||
% the position of other elements is not affected.
|
||||
{\vfuzz=9999pt\vbox to 0pt {
|
||||
\raggedleft
|
||||
\inserttitlegraphic
|
||||
}}
|
||||
|
||||
|
||||
\vspace*{\baselineskip}
|
||||
\begin{minipage}[t]{\textwidth}
|
||||
\usebeamerfont{institute}
|
||||
\insertinstitute
|
||||
\end{minipage}
|
||||
|
||||
\vspace*{\baselineskip}
|
||||
\begin{minipage}[t]{\textwidth}
|
||||
\usebeamerfont{date}{\insertdate}
|
||||
\end{minipage}
|
||||
|
||||
|
||||
\vspace*{\baselineskip}
|
||||
\vspace*{\baselineskip}
|
||||
\vspace*{\baselineskip}
|
||||
\vspace*{\baselineskip}
|
||||
\begin{minipage}[t]{\textwidth}
|
||||
\usebeamerfont{author}
|
||||
\insertauthor
|
||||
\end{minipage}
|
||||
|
||||
|
||||
\vspace*{5\baselineskip}
|
||||
|
||||
\addtocounter{framenumber}{-1}
|
||||
}
|
||||
|
||||
% Section page.
|
||||
\defbeamertemplate*{section page}{focus}{%
|
||||
{%
|
||||
\usebeamercolor{frametitle}\colorlet{focus@@temp}{bg}%
|
||||
\begin{tikzpicture}[overlay, remember picture]
|
||||
\fill[color=focus@@temp] (current page.north west) rectangle ([shift = {(0, -0.45\paperheight)}] current page.north east);
|
||||
\end{tikzpicture}%
|
||||
}
|
||||
|
||||
\vspace{-2\baselineskip}
|
||||
\begin{minipage}[b][0.45\paperheight]{\textwidth}
|
||||
\usebeamerfont{sectiontitle}
|
||||
\usebeamercolor[fg]{frametitle}
|
||||
\let\hyperlink\@secondoftwo\insertsection
|
||||
\end{minipage}
|
||||
|
||||
\begin{minipage}[t][0.55\paperheight]{\textwidth}
|
||||
\end{minipage}
|
||||
}
|
||||
|
||||
\AtBeginSection{%
|
||||
\begin{frame}[plain, noframenumbering]{}
|
||||
\sectionpage
|
||||
\end{frame}%
|
||||
}
|
||||
|
||||
\mode<all>
|
|
@ -0,0 +1,255 @@
|
|||
% Copyright (C) 2018 Pasquale Claudio Africa.
|
||||
% 2018 Sebastian Friedl.
|
||||
%
|
||||
% This file is part of beamerthemefocus.
|
||||
%
|
||||
% beamerthemefocus is free software: you can redistribute it and/or modify
|
||||
% it under the terms of the GNU General Public License as published by
|
||||
% the Free Software Foundation, either version 3 of the License, or
|
||||
% (at your option) any later version.
|
||||
%
|
||||
% beamerthemefocus is distributed in the hope that it will be useful,
|
||||
% but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
% GNU General Public License for more details.
|
||||
%
|
||||
% You should have received a copy of the GNU General Public License
|
||||
% along with beamerthemefocus. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
\mode<presentation>
|
||||
|
||||
\RequirePackage{appendixnumberbeamer}% Don't number appendix frames.
|
||||
\RequirePackage{etoolbox}% \BeforeBeginEnvironment
|
||||
\RequirePackage{tikz}
|
||||
|
||||
|
||||
% FRAMETITLE TEMPLATES. --------------------------------------------------------
|
||||
\defbeamertemplate*{frametitle}{focus}{%
|
||||
% If not title page.
|
||||
\ifnum\value{framenumber}>0%
|
||||
\vspace{-1pt}%
|
||||
\begin{beamercolorbox}[wd=\paperwidth,leftskip=0.55cm,rightskip=0.55cm,sep=0.2cm]{frametitle}%
|
||||
\strut\insertframetitle\strut%
|
||||
\end{beamercolorbox}%
|
||||
\fi%
|
||||
}
|
||||
|
||||
% Plain header.
|
||||
\defbeamertemplate{frametitle}{plain}{%
|
||||
% If not title page.
|
||||
\ifnum\value{framenumber}>0%
|
||||
\vspace{-1pt}%
|
||||
\begin{beamercolorbox}[wd=\paperwidth,leftskip=0.55cm,rightskip=0.55cm,sep=0.2cm,ignorebg]{frametitle}%
|
||||
\strut%
|
||||
\end{beamercolorbox}%
|
||||
\fi%
|
||||
}
|
||||
|
||||
|
||||
% FOOTLINE TEMPLATES. ----------------------------------------------------------
|
||||
% Lenghts for the progress bar footline.
|
||||
\newlength{\focus@pbar@height}% Progress bar height.
|
||||
\newlength{\focus@pbar@leftoffset}
|
||||
\newlength{\focus@pbar@rightoffset}
|
||||
|
||||
\defbeamertemplate*{footline}{progressbar}{%
|
||||
% If not appendix.
|
||||
\ifnum\mainend<0% From package appendixnumberbeamer.
|
||||
%
|
||||
\settowidth{\focus@pbar@leftoffset}{1}%
|
||||
\addtolength{\focus@pbar@leftoffset}{1.5em}%
|
||||
%
|
||||
\settowidth{\focus@pbar@rightoffset}{\inserttotalframenumber}%
|
||||
\addtolength{\focus@pbar@rightoffset}{1.5em}%
|
||||
%
|
||||
% If not title page.
|
||||
\ifnum\c@framenumber>0%
|
||||
\ifnum\c@framenumber<\inserttotalframenumber%
|
||||
\begin{tikzpicture}[inner xsep=0.5em, inner ysep=0.5ex]\usebeamerfont{footline}
|
||||
\pgfmathsetmacro{\focus@pbar@progress}%
|
||||
{(\paperwidth-\focus@pbar@leftoffset-\focus@pbar@rightoffset)*(\insertframenumber/\inserttotalframenumber)}
|
||||
|
||||
\clip (0,0) rectangle ++(\paperwidth,\the\focus@pbar@height);
|
||||
\fill[footline.bg] (0,0) rectangle ++(\the\focus@pbar@leftoffset,\the\focus@pbar@height);
|
||||
|
||||
\fill[footline.bg] (\the\focus@pbar@leftoffset,0) rectangle ++(\focus@pbar@progress pt,\the\focus@pbar@height)
|
||||
++(0,{-0.5*\the\focus@pbar@height}) node[anchor=east, text=footline.fg] {\strut\insertframenumber};
|
||||
|
||||
\fill[footline.bg] (\paperwidth,0) rectangle ++(-\the\focus@pbar@rightoffset,\the\focus@pbar@height)
|
||||
++(0,{-0.5*\the\focus@pbar@height}) node[anchor=west, text=footline.fg] {\strut\inserttotalframenumber};
|
||||
\end{tikzpicture}%
|
||||
\else%
|
||||
\begin{tikzpicture}[inner xsep=0.5em, inner ysep=0.5ex]
|
||||
\clip (0,0) rectangle ++(\paperwidth,\the\focus@pbar@height);
|
||||
\fill[footline.bg] (0,0) rectangle ++(\paperwidth,\the\focus@pbar@height);
|
||||
|
||||
\node[anchor=east, footline.fg] at ({\paperwidth-\the\focus@pbar@rightoffset},{0.5*\focus@pbar@height}) {\strut\insertframenumber};
|
||||
\node[footline.fg] at ({\paperwidth-\the\focus@pbar@rightoffset},{0.5*\focus@pbar@height}) {\strut/};
|
||||
\node[anchor=west, footline.fg] at ({\paperwidth-\the\focus@pbar@rightoffset},{0.5*\focus@pbar@height}) {\strut\inserttotalframenumber};
|
||||
\end{tikzpicture}%
|
||||
\fi%
|
||||
\fi%
|
||||
\fi%
|
||||
}
|
||||
|
||||
% Full bar footline.
|
||||
\defbeamertemplate{footline}{fullbar}{%
|
||||
% If not appendix.
|
||||
\ifnum\mainend<0% From package appendixnumberbeamer.
|
||||
%
|
||||
\settowidth{\focus@pbar@leftoffset}{1}%
|
||||
\addtolength{\focus@pbar@leftoffset}{1.5em}%
|
||||
%
|
||||
\settowidth{\focus@pbar@rightoffset}{\inserttotalframenumber}%
|
||||
\addtolength{\focus@pbar@rightoffset}{1.5em}%
|
||||
%
|
||||
% If not title page.
|
||||
\ifnum\c@framenumber>0%
|
||||
\begin{tikzpicture}[inner xsep=0.5em, inner ysep=0.5ex]
|
||||
\clip (0,0) rectangle ++(\paperwidth,\the\focus@pbar@height);
|
||||
\fill[footline.bg] (0,0) rectangle ++(\paperwidth,\the\focus@pbar@height);
|
||||
|
||||
\node[anchor=east, footline.fg] at ({\paperwidth-\the\focus@pbar@rightoffset},{0.5*\focus@pbar@height}) {\strut\insertframenumber};
|
||||
\node[footline.fg] at ({\paperwidth-\the\focus@pbar@rightoffset},{0.5*\focus@pbar@height}) {\strut/};
|
||||
\node[anchor=west, footline.fg] at ({\paperwidth-\the\focus@pbar@rightoffset},{0.5*\focus@pbar@height}) {\strut\inserttotalframenumber};
|
||||
\end{tikzpicture}%
|
||||
\fi%
|
||||
\fi%
|
||||
}
|
||||
|
||||
% Empty footline.
|
||||
\defbeamertemplate{footline}{none}{}
|
||||
|
||||
\DeclareOptionBeamer{numbering}{\def\beamer@focus@numbering{#1}}
|
||||
\ExecuteOptionsBeamer{numbering=progressbar}
|
||||
\ProcessOptionsBeamer
|
||||
|
||||
\def\beamer@focus@numberingprogressbar{progressbar}
|
||||
\def\beamer@focus@numberingfullbar{fullbar}
|
||||
\def\beamer@focus@numberingnone{none}
|
||||
|
||||
|
||||
% BACKGROUND CANVAS TEMPLATES. -------------------------------------------------
|
||||
\defbeamertemplate*{background canvas}{focus}{%
|
||||
\begin{tikzpicture}
|
||||
\clip (0,0) rectangle ++(\paperwidth,\paperheight);
|
||||
\fill[normal text.bg] (0,0) rectangle ++(\paperwidth,\paperheight);
|
||||
\end{tikzpicture}%
|
||||
}
|
||||
|
||||
\defbeamertemplate{background canvas}{focusplain}{%
|
||||
\begin{tikzpicture}
|
||||
\clip (0,0) rectangle ++(\paperwidth,\paperheight);
|
||||
\fill[normal text.bg] (0,0) rectangle ++(\paperwidth,\paperheight);
|
||||
\end{tikzpicture}%
|
||||
}
|
||||
|
||||
\defbeamertemplate{background canvas}{focusframe}{%
|
||||
\begin{tikzpicture}
|
||||
\clip (0,0) rectangle ++(\paperwidth,\paperheight);
|
||||
\fill[frametitle.bg] (0,0) rectangle ++(\paperwidth,\paperheight);
|
||||
\end{tikzpicture}%
|
||||
}
|
||||
|
||||
|
||||
% HOOKS FOR CREATING FRAMES. ---------------------------------------------------
|
||||
\BeforeBeginEnvironment{frame}{%
|
||||
\setbeamertemplate{background canvas}[focus]%
|
||||
\setbeamertemplate{frametitle}[focus]%
|
||||
%
|
||||
% Reset footline height and determine it for the current slide.
|
||||
\setlength{\focus@pbar@height}{0cm}%
|
||||
\focus@calculatefootheight%
|
||||
%
|
||||
% If not appendix.
|
||||
\ifnum\mainend<0 % From package appendixnumberbeamer.
|
||||
\settoheight{\focus@pbar@height}{\usebeamerfont{footline}1234567890/}%
|
||||
\addtolength{\focus@pbar@height}{6pt}%
|
||||
%
|
||||
\ifx\beamer@focus@numbering\beamer@focus@numberingprogressbar%
|
||||
\setbeamertemplate{footline}[progressbar]%
|
||||
\else%
|
||||
\ifx\beamer@focus@numbering\beamer@focus@numberingfullbar%
|
||||
\setbeamertemplate{footline}[fullbar]%
|
||||
\fi%
|
||||
\fi%
|
||||
%
|
||||
\focus@calculatefootheight%
|
||||
\fi%
|
||||
}
|
||||
|
||||
% Enable noframenumbering option.
|
||||
\define@key{beamerframe}{noframenumbering}[true]{%
|
||||
\setbeamertemplate{footline}[none]%
|
||||
\setlength{\focus@pbar@height}{0cm}%
|
||||
\focus@calculatefootheight%
|
||||
%
|
||||
\addtocounter{framenumber}{-1}%
|
||||
}
|
||||
|
||||
|
||||
% Enable plain option.
|
||||
\define@key{beamerframe}{plain}[true]{%
|
||||
\setbeamertemplate{background canvas}[focusplain]%
|
||||
\setbeamertemplate{frametitle}[plain]%
|
||||
%
|
||||
\setbeamertemplate{footline}[none]%
|
||||
}
|
||||
|
||||
|
||||
% Full vertical centering
|
||||
% (from https://tex.stackexchange.com/questions/247826/beamer-full-vertical-centering).
|
||||
\define@key{beamerframe}{c}[true]{%
|
||||
\beamer@frametopskip=0pt plus 1fill\relax%
|
||||
\beamer@framebottomskip=0pt plus 1fill\relax%
|
||||
\beamer@frametopskipautobreak=0pt plus 0.4\paperheight\relax%
|
||||
\beamer@framebottomskipautobreak=0pt plus 0.6\paperheight\relax%
|
||||
\def\beamer@initfirstlineunskip{}%
|
||||
}
|
||||
|
||||
|
||||
% Enable focus option.
|
||||
\providebool{focus@standout}
|
||||
\define@key{beamerframe}{focus}[true]{%
|
||||
\booltrue{focus@standout}%
|
||||
\begingroup%
|
||||
\setkeys{beamerframe}{noframenumbering}%
|
||||
\setbeamertemplate{background canvas}[focusframe]%
|
||||
\setbeamertemplate{frametitle}[plain]%
|
||||
%
|
||||
\setkeys{beamerframe}{c}%
|
||||
\centering%
|
||||
\usebeamerfont{focusframe}%
|
||||
\usebeamercolor[fg]{frametitle}%
|
||||
}
|
||||
|
||||
\apptocmd{\beamer@reseteecodes}
|
||||
{%
|
||||
\ifbool{focus@standout}%
|
||||
{%
|
||||
\endgroup%
|
||||
\boolfalse{focus@standout}%
|
||||
}{}%
|
||||
}{}{}
|
||||
|
||||
|
||||
% Recalculate the footline's size and refresh other parameters.
|
||||
% Partially copied from the definition of \beamer@calculateheadfoot.
|
||||
\def\focus@calculatefootheight{%
|
||||
\footheight=\focus@pbar@height%
|
||||
\advance\footheight by 4pt%
|
||||
\sidebarheight=\paperheight%
|
||||
\advance\sidebarheight by-\headheight%
|
||||
\advance\sidebarheight by\headdp%
|
||||
\advance\sidebarheight by-\footheight%
|
||||
\advance\sidebarheight by 4pt%
|
||||
\footskip=\footheight%
|
||||
\textheight=\paperheight%
|
||||
\advance\textheight by-\footheight%
|
||||
\advance\textheight by-\headheight%
|
||||
\@colht\textheight%
|
||||
\@colroom\textheight%
|
||||
\vsize\textheight%
|
||||
}
|
||||
|
||||
\mode<all>
|
|
@ -0,0 +1,60 @@
|
|||
% Copyright (C) 2018 Pasquale Claudio Africa.
|
||||
% 2018 Sebastian Friedl.
|
||||
%
|
||||
% This file is part of beamerthemefocus.
|
||||
%
|
||||
% beamerthemefocus is free software: you can redistribute it and/or modify
|
||||
% it under the terms of the GNU General Public License as published by
|
||||
% the Free Software Foundation, either version 3 of the License, or
|
||||
% (at your option) any later version.
|
||||
%
|
||||
% beamerthemefocus is distributed in the hope that it will be useful,
|
||||
% but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
% GNU General Public License for more details.
|
||||
%
|
||||
% You should have received a copy of the GNU General Public License
|
||||
% along with beamerthemefocus. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
\NeedsTeXFormat{LaTeX2e}
|
||||
\ProvidesPackage{beamerthemefocus}[2018/08/09 v2.2 Focus Beamer theme]
|
||||
|
||||
\mode<presentation>
|
||||
|
||||
|
||||
% THEME OPTIONS. ---------------------------------------------------------------
|
||||
\DeclareOptionBeamer{numbering}{%
|
||||
\PassOptionsToPackage{numbering=#1}{beamerouterthemefocus}
|
||||
}
|
||||
|
||||
\newif\if@focus@loadfirafonts
|
||||
\@focus@loadfirafontstrue
|
||||
|
||||
\DeclareOptionBeamer{nofirafonts}{\@focus@loadfirafontsfalse}
|
||||
\ProcessOptionsBeamer
|
||||
|
||||
|
||||
% LOAD EXTERNAL PACKAGES. ------------------------------------------------------
|
||||
\if@focus@loadfirafonts
|
||||
\RequirePackage[T1]{fontenc}
|
||||
|
||||
\PassOptionsToPackage{type1}{FiraSans}
|
||||
\PassOptionsToPackage{type1}{FiraMono}
|
||||
|
||||
\RequirePackage{FiraSans}
|
||||
\RequirePackage{FiraMono}
|
||||
\fi
|
||||
|
||||
\usecolortheme{focus}
|
||||
\usefonttheme{focus}
|
||||
\useinnertheme{focus}
|
||||
\useoutertheme{focus}
|
||||
|
||||
\setbeamertemplate{navigation symbols}{}
|
||||
|
||||
|
||||
% SET MARGINS. -----------------------------------------------------------------
|
||||
\setbeamersize{text margin left=0.75cm, text margin right=0.75cm}
|
||||
\setlength{\leftmargini}{0.75cm}
|
||||
|
||||
\mode<all>
|
After Width: | Height: | Size: 72 KiB |
After Width: | Height: | Size: 109 KiB |
After Width: | Height: | Size: 88 KiB |
After Width: | Height: | Size: 103 KiB |
After Width: | Height: | Size: 141 KiB |
|
@ -0,0 +1,3 @@
|
|||
\begin{lstlisting}
|
||||
tcpdump -n -s0 -w - | ./d4 -c ./conf | socat - OPENSSL-CONNECT:$D4-SERVER-IP-ADDRESS:$PORT,verify=1
|
||||
\end{lstlisting}
|
After Width: | Height: | Size: 146 KiB |
After Width: | Height: | Size: 105 KiB |
|
@ -0,0 +1,10 @@
|
|||
\begin{lstlisting}
|
||||
{
|
||||
"type": "ja3-jl",
|
||||
"encoding": "utf-8",
|
||||
"tags": [
|
||||
"tlp:white"
|
||||
],
|
||||
"misp:org": "5b642239-4db4-4580-adf4-4ebd950d210f"
|
||||
}
|
||||
\end{lstlisting}
|
|
@ -0,0 +1,3 @@
|
|||
\begin{lstlisting}
|
||||
./pibs -b -r pcap_file.cap
|
||||
\end{lstlisting}
|