A Pakistan deployment (internally 'WMS-UTR'/'P19', sites including Karachi and Islamabad) ingests full RADIUS AAA and NAT-log traffic from four named mobile carriers -- Jazz, Zong, Ufone, and Telenor -- to correlate every monitored network session with the subscriber's phone number (RADIUS 'Calling Station ID'), in near-real-time (target latency <1s, degrading to ~1hr under 8x traffic growth). The correlation engine, internally called 'CyberNarrator' (网络叙事者), writes resolved identity objects directly into security-policy objects every ~10 seconds so blocking policy can reference specific subscribers by phone number. Base-station location data is also parsed from Radius traffic.
Client IP + Port -> SrcAddr (From CFLOW) SrcAddr -> Calling Station ID (From RADIUS)...采用网络叙事者进行Data Integration，定时（如10s）将CK中的CFLOW日志和RADIUS日志关联...Object Name: Calling Station ID xxxx
Defense implications
- This is subscriber-identity correlation, not protocol detection -- blocking/monitoring policy at this deployment can already be scoped to a specific person's phone number rather than just an IP.
- The pipeline depends on RADIUS/NAT-log visibility specific to how the ISP is intercepted, not something a client-side protocol change can defeat directly -- but confirms individualized, not just protocol-level, targeting risk in this deployment's coverage area.
Related findings
Geedge Networks' 2023 new-hire onboarding deck gives a corporate timeline: TSG's first international market win (with a codename "Nezha" launching the same month) in September 2018, "网络叙事者" (CyberNarrator) launching November 2020, a "South Asia" country project landing August 2021 (overseas market expansion), and Geedge winning a bid as overall solution provider for an "East Africa" country project in May 2022 — timing and regions consistent with this corpus's existing Pakistan (WMS-UTR/P19) and Ethiopia (E21) site attributions, though the deck itself does not name the countries.
Geedge's internal company timeline dates the launch of 网络叙事者 (CyberNarrator) to November 2020, and states the company won a 'South Asian country' project in May 2021 (consistent with Pakistan/WMS-UTR) and, as overall solution provider, an 'East Africa country' project in May 2022 (consistent with Ethiopia/HDM) -- corroborating the export timeline for those two customers from the company's own materials rather than site-side evidence alone.
An internal Python automation script authenticates to a TSG management API (/v1/user/login, /v1/policy/object/{id}/item?type=ip|fqdn&page_size=500000) and PUTs new IP entries into an existing policy object -- the concrete mechanism matching taxonomy's description of CyberNarrator's 'vpn-thwarting' pipeline pushing freshly-learned server IPs into a live blocklist object, and confirming policy objects are paged at up to 500,000 items.
The same GEEDGE employee handbook dates the launch of 网络叙事者 (CyberNarrator) to April 2021, and separately states the company's products serve 18 data centers and carriers worldwide processing over 20 Tbps of traffic — the first primary-source confirmation of CyberNarrator's launch date and a company-stated global deployment-scale figure.
The galaxy/tsg_olap/dll-multipoint-aggregation repo defines a Flume-based multi-site log-aggregation pipeline with five parallel categories -- "active_defence", "connection" (call-detail/通联日志), "proxy", "security", and "radius" -- the last explicitly ingesting RADIUS data, corroborating that the CyberNarrator subscriber-correlation capability's RADIUS feed sits inside this broader TSG OLAP log-aggregation architecture rather than as a standalone system.
A Postman API collection titled '银河api' (Galaxy API) documents production query endpoints against the tsg_galaxy analytics backend, including dedicated 'radius日志标准查询' / 'raduis日志clickhouse查询' (RADIUS log queries) and 'Traffic Top Intercept Policies By Hits/Bandwidth' endpoints -- showing RADIUS-based subscriber correlation and interception-policy analytics are standard, generally-available query features of TSG's management API rather than a one-off built solely for the Pakistan deployment.