From b8e5079b8a82740b2c9889cfb11381fecf800f31 Mon Sep 17 00:00:00 2001 From: Toby Date: Wed, 20 Mar 2024 18:37:43 -0700 Subject: [PATCH] fix: trojan analyzer heuristics --- analyzer/tcp/trojan.go | 17 ++++++++--------- docs/Analyzers.md | 2 +- 2 files changed, 9 insertions(+), 10 deletions(-) diff --git a/analyzer/tcp/trojan.go b/analyzer/tcp/trojan.go index 71694d7..cf8c307 100644 --- a/analyzer/tcp/trojan.go +++ b/analyzer/tcp/trojan.go @@ -14,7 +14,7 @@ var ccsPattern = []byte{20, 3, 3, 0, 1, 1} // TrojanAnalyzer uses length-based heuristics to detect Trojan traffic based on // its "TLS-in-TLS" nature. The heuristics are trained using a decision tree with // about 2000 samples. This is highly experimental and is known to have significant -// false positives (about 8% false positives & 2% false negatives). +// false positives (about 9% false positives & 3% false negatives). // We do NOT recommend directly blocking all positive connections, as this is likely // to break many normal TLS connections. type TrojanAnalyzer struct{} @@ -36,7 +36,7 @@ type trojanStream struct { first bool count bool rev bool - seq [4]int + seq [3]int seqIndex int } @@ -69,16 +69,15 @@ func (s *trojanStream) Feed(rev, start, end bool, skip int, data []byte) (u *ana if s.count { if rev == s.rev { // Same direction as last time, just update the number - s.seq[s.seqIndex] = len(data) + s.seq[s.seqIndex] += len(data) } else { // Different direction, bump the index s.seqIndex += 1 - if s.seqIndex == 4 { + if s.seqIndex == 3 { // Time to evaluate - yes := s.seq[0] >= 100 && - s.seq[1] >= 88 && - s.seq[2] >= 40 && - s.seq[3] >= 51 + yes := s.seq[0] >= 180 && + s.seq[1] <= 11000 && + s.seq[2] >= 40 return &analyzer.PropUpdate{ Type: analyzer.PropUpdateReplace, M: analyzer.PropMap{ @@ -87,7 +86,7 @@ func (s *trojanStream) Feed(rev, start, end bool, skip int, data []byte) (u *ana }, }, true } - s.seq[s.seqIndex] = len(data) + s.seq[s.seqIndex] += len(data) s.rev = rev } } diff --git a/docs/Analyzers.md b/docs/Analyzers.md index 17a4c0d..8f005e5 100644 --- a/docs/Analyzers.md +++ b/docs/Analyzers.md @@ -251,7 +251,7 @@ Check https://github.com/XTLS/Trojan-killer for more information. ```json { "trojan": { - "seq": [170, 282, 167, 470], + "seq": [680, 4514, 293], "yes": true } }