summaryrefslogtreecommitdiff
path: root/detection/vpnservices/windscribevpn_servername.py
diff options
context:
space:
mode:
Diffstat (limited to 'detection/vpnservices/windscribevpn_servername.py')
-rw-r--r--detection/vpnservices/windscribevpn_servername.py65
1 files changed, 0 insertions, 65 deletions
diff --git a/detection/vpnservices/windscribevpn_servername.py b/detection/vpnservices/windscribevpn_servername.py
deleted file mode 100644
index fb90c5c..0000000
--- a/detection/vpnservices/windscribevpn_servername.py
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# @Time : 2024/1/24 15:08
-# @author : yinjinagyi
-# @File : windscribevpn_servername.py
-# @Function:
-
-from vpn_detector import VpnDetector
-import pandas as pd
-
-
-class WindscribevpnServername(VpnDetector):
- """
-
- This class is used to detect windscribevpn server name
- """
-
- def __init__(self, start_time, end_time):
- super().__init__(start_time, end_time)
- self.plugin_config = self.load_config()['windscribevpn_servername']
- self.plugin_id = self.plugin_config['plugin_id']
- self.plugin_name = self.plugin_config['plugin_name']
- self.object_type = self.plugin_config['object_type']
- self.vpn_service_name = self.plugin_config['vpn_service_name']
- self.confidence = self.plugin_config['confidence']
- self.output_file_name = self.plugin_name + '_' + str(self.start_time).replace(' ', '_').replace(':', '')[
- :13] + '.csv'
- self.start_time = start_time
- self.end_time = end_time
-
- self.sql = self.plugin_config['sql']
- self.domains = ["'" + i.strip() + "'" for i in self.plugin_config['domains'].split(',')]
-
- def find_server(self):
- """
- Get windscribevpn server name from session records
- :return: windscribevpn server name list
- """
- self.logger.info('Start to query windscribevpn server name from session records')
-
- # construct query sql
- TIME_FILTER_PATTERN = self.config['common']['time_filter_pattern'].replace('recv_time_columnname',
- self.config['common'][
- 'recv_time_columnname'])
- time_filter = TIME_FILTER_PATTERN.replace("{$start_time}", str(self.start_time)).replace("{$end_time}", str(
- self.end_time)).replace("{$time_zone}", self.time_zone)
- self.sql = self.sql.replace("{$db_name}", self.dbname).replace("{$table_name}", self.table_name)
- self.sql = self.sql.replace("{$time_filter}", time_filter)
- self.sql = self.sql.replace("{$domain_list}", ','.join(self.domains))
-
- self.logger.info("Sql for {}: {}".format(self.plugin_name, self.sql))
-
- # query data from clickhouse database
- try:
- windscribevpn_servername_df = pd.DataFrame(self.client.execute(self.sql))
- finally:
- self.client.disconnect()
-
- if windscribevpn_servername_df.empty:
- self.logger.info('No windscribevpn server name found from session records')
- return []
- windscribevpn_servername_list = windscribevpn_servername_df[0].drop_duplicates().tolist()
- self.logger.info('Query windscribevpn server name from session records successfully. {} items found'
- .format(len(windscribevpn_servername_list)))
- return windscribevpn_servername_list