PSG Dump Analysis Service

psg.mitigator.ru is a service for analyzing network traffic dumps in order to identify patterns (PCAP Signature Generator). Additionally, the service analyzes lists of IP addresses and TLS fingerprints.

The service is designed to facilitate the study of attack traffic, extract the signature of legitimate traffic, check sender IP addresses against reputation lists, and can be used in retrospective analysis scenarios.

The service provides a set of specialized analysis mechanisms. Each of them solves a separate applied task or a combination thereof: from extracting signatures and checking IP addresses against reputation lists to generating filtering rules.

The tools differ in the type of input data, the depth of analysis, and the scope of application.

• Payload Analyzer — extracts traffic signatures based on the analysis of L4 payload from the uploaded dump. Accepts traffic dumps in PCAP or PCAPNG format as input.
• Multipurpose Analyzer — a universal mechanism for analyzing L3/L4 headers and L4 payload. Extracts signatures, provides statistics on TLS, DTLS, and DNS, checks IP addresses for inclusion in reputation lists. Accepts traffic dumps in PCAP or PCAPNG format as input.
• IP Analyzer — checks IPv4 addresses against reputation lists and GeoIP databases, providing a wide range of data for each address.
• TLS Analyzer — extracts TLS fingerprints from a PCAP and outputs statistical information about them.
• Service Analyzer — detects services in the protected network based on the uploaded dump. Helps with the initial configuration of protection.
• ACL Rules Generator — generates a set of ACL filtering rules by analyzing dumps of legitimate traffic and attack traffic. Works with the IP, TCP, UDP, and ICMP protocols.
• Log Analyzer — calculates statistics based on the analysis of web server logs in the access.log format. Allows you to identify anomalies and attacking addresses. Can be used when writing filtering rules in LOGAN.
• Log Format Analyzer — determines the format of logs in the uploaded file. Can be used when describing the log format in LOGAN or “Log Analyzer”. Accepts files in .log format containing web server logs as input.
• Logan Rules Generator — generates rules for LOGAN based on the uploaded file with web server logs.
• Goaccess Log Analyzer — analyzes web server logs. Can be used independently or together with “Log Analyzer” to obtain additional statistics.

Detailed information about working with the service, the list of available types of analysis, and how to use them is available in the built-in service help.

The service is available to MITIGATOR customers. Questions about access and suggestions for the development of the service can be sent by contacting support or a Telegram bot.