Merge branch 'master' of github.com:D4-project/architecture

master
Alexandre Dulaunoy 2019-04-29 16:48:41 +02:00
commit fa82af7c9b
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
2 changed files with 21 additions and 12 deletions

View File

@ -139,7 +139,7 @@ Depends on libpcap.
\begin{frame}[fragile]
\frametitle{sensor-d4-tls-fingerprinting - d4 client}
\frametitle{sensor-d4-tls-fingerprinting | d4 client}
Required setting:
\begin{itemize}
\item type should be set to 2 or 254
@ -152,12 +152,19 @@ Depends on libpcap.
\begin{itemize}
\item describe every TLS Sessions,
\item marshal this description in JSON format
\item ship this description to D4 server
\item ship this description to the D4 server
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{sensor-d4-tls-fingerprinting - ja3-jl plugin}
\begin{center}
\includegraphics[scale=0.4]{d4-worker2-ja3-jl.pdf}
\end{center}
\end{frame}
\begin{frame}[fragile]
\frametitle{sensor-d4-tls-fingerprinting - d4 worker}
\frametitle{sensor-d4-tls-fingerprinting - ja3-jl worker}
\input{worker.tex}
\begin{itemize}
\item processes each reassembled JSON description,
@ -168,24 +175,26 @@ Depends on libpcap.
\end{frame}
\begin{frame}[fragile]
\frametitle{sensor-d4-tls-fingerprinting - d4 analyzer}
(Proof of Concept)
\frametitle{sensor-d4-tls-fingerprinting - ja3-jl analyzer}
(Work in Progress) \\
\vspace{.8cm}
Populates a database:
\begin{itemize}
\item LPOP a redis list populated by the worker
\item dumbly push JSON description into a postgres database
\item push JSON descriptions into a postgres database
\end{itemize}
\end{frame}
\begin{frame}[fragile]
\frametitle{sensor-d4-tls-fingerprinting - d4 passivessl API}
(Proof of Concept)
\frametitle{sensor-d4-tls-fingerprinting - passivessl API}
(Work in Progress) \\
\vspace{.8cm}
Exposes a REST API to query the collected data:
\begin{itemize}
\item /index : returns, the full DB :)
\item /ja3/ : returns, all TLS sessions with a given JA3 Signature
\item /ja3s/ : returns, all TLS sessions with a given JA3S Signature
\item /index : returns the full DB (PoC),
\item /ja3/ : returns all TLS sessions with a given JA3 Signature,
\item /ja3s/ : returns all TLS sessions with a given JA3S Signature,
\end{itemize}
\end{frame}

Binary file not shown.