102 lines
2.1 KiB
Markdown
102 lines
2.1 KiB
Markdown
|
# 【M22项目】Panda VPN特征提取
|
|||
|
|
|
|||
|
|
| ID | Creation Date | Assignee | Status |
|
|||
|
|
|----|----------------|----------|--------|
|
|||
|
|
| OSS-286 | 2024-06-06T15:03:47.000+0800 | 曹山峰 | 完成 |
|
|||
|
|
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
1、Panda VPN特征提取
|
|||
|
|
|
|||
|
|
2、可以使用BJ环境进行特征提取
|
|||
|
|
|
|||
|
|
3、[https://docs.geedge.net/pages/viewpage.action?pageId=129101057]
|
|||
|
|
|
|||
|
|
4、[~caoshanfeng] 和[~liwen] 一起进行这个软件的特征提取
|
|||
|
|
**caoshanfeng** commented on *2024-06-11T17:50:46.523+0800*:
|
|||
|
|
|
|||
|
|
根据抓包观察，通过FQDN与ja3进行阻断，阻断并不完全还是会有穿透的数据流。穿透数据流根据观察没有明显的特征，只能通过server ip进行阻断
|
|||
|
|
|
|||
|
|
曹山峰： 进行抓包分析vpn的连接特征
|
|||
|
|
栗文： 完成免费节点的vpn server ip的提取（8个）
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
**caoshanfeng** commented on *2024-06-12T18:18:17.932+0800*:
|
|||
|
|
|
|||
|
|
曹山峰： 提取免费节点的vpn server ip的提取 （共39个）
|
|||
|
|
栗文： 完成vip部分节点的vpn server ip的提取（共87个）
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
**caoshanfeng** commented on *2024-06-13T19:23:19.135+0800*:
|
|||
|
|
|
|||
|
|
曹山峰： 提取免费节点的vpn server ip的提取 （共138个）
|
|||
|
|
栗文： 完成vip部分节点的vpn server ip的提取（共87个)
|
|||
|
|
共完成216个dst_ip特征提取，再BJ环境tsg系统观察无与其他应用冲突情况
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
**caoshanfeng** commented on *2024-06-14T10:16:39.185+0800*:
|
|||
|
|
|
|||
|
|
复测了 android、ios、windows三大平台无CT情况 附件为PandaVPN应用特征 [^PandaVPN_Patch01.json] ，请M的同事再M现场再次进行验证
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
**caoshanfeng** commented on *2024-06-14T16:12:45.399+0800*:
|
|||
|
|
|
|||
|
|
将所有VPN节点重新提取了一下，新增server ip 13个，附件为更新过的PandaVPN应用特征新增应用描述 [^PandaVPN_Patch01-2.json]
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
**caoshanfeng** commented on *2024-06-21T15:39:35.082+0800*:
|
|||
|
|
|
|||
|
|
[^PandaVPN-Pathch04.json]
|
|||
|
|
|
|||
|
|
最近更新的特征BJ环境与M环境观察无误封
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
## Attachments
|
|||
|
|
|
|||
|
|
**58931/63fecc8532160011d936e5a68b99d1b.png**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
**59083/PandaVPN_Patch01.json**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
**59112/PandaVPN_Patch01-1.json**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
**59115/PandaVPN_Patch01-2.json**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
**59249/PandaVPN-Pathch04.json**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
**59076/screenshot-1.png**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|