Changes between Version 8 and Version 9 of BotnetExample


Ignore:
Timestamp:
Nov 4, 2010 4:55:58 PM (13 years ago)
Author:
sunshine
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • BotnetExample

    v8 v9  
    3131 * '''Timeline of events: '''
    3232
    33    Definitions:
     33   '''Definitions:'''
    3434     
    3535     each Inode i, some VNode v:
    … …  
    3939       s1 := {v.state = Infected}
    4040
    41    Timeline:
     41   '''Timeline:'''
    4242 
    43        e1 → if (e1.vulnerability == v.vulnerability) then s1
     43       e1 -> if (e1.vulnerability == v.vulnerability) then s1
    4444
    4545
    46  * '''Invariants:''' There are some in definition of topology and timeline above. No additional ones are needed here.
     46 * '''Invariants:''' No additional ones are needed here.
    4747
    4848=== P2P w leader and C&C traffic metadescription ===
    … …  
    5050* '''Logical topology:'''
    5151
    52    [[Image(peerobj.jpg)]]
     52  Objects:
    5353
    54    (in English: There must be two sets of hosts, at least two  peers and at least one leader. Nothing is said about relationship between sets so it's possible that there's an intersection between those that is non-empty. All objects here are of type Nodes.)
     54    Peer extends Node
     55
     56    Peer := {Peer[] peers = {}, Leader leader = none }
     57
     58    Leader extends Peer
     59
     60    Leader := {Peer[] slaves = {}  }
     61
     62  Cardinality:
     63
     64    |Peer|,,>=2,,
     65
     66    |Leader|,,>=1,,
     67
     68  Relationships:
     69
     70
    5571 * '''Timeline of events: '''
    5672
    57    [[Image(peerwf.jpg, 60%)]]
     73  Definitions:
    5874
    59    (in English: Each  peer contacts some other peer asking them to peer with it - the contacted peer may reply with a "yes". In parallel with this a peer somehow learns about a leader. If a leader object is known to a given peer, the peer will send it a "hello" message. The leader will then send commands to the peers it knows and may get reports from them back.).
     75    each Peer peer1, some Peer peer2:
     76 
     77      e1 := {type = WANNAPEER, origin = peer1, destination = peer2}
    6078
    61    Note that I haven't defined what wannapeer, yespeer, leader, hello, cmd and report events are and I should define it in the common domain knowledge base.
     79      e2 := {type = YESPEER, origin = peer2, destination = peer1}
    6280
    63  * '''Invariants:''' There are some in definition of topology and timeline above. No additional ones are needed here.
     81      s1 := {peer2.peers += peer1}
     82
     83      s2 := {peer2.peers += peer1}
     84 
     85   each Peer x:
     86     
     87      e3 := {type = LEADERIS, origin = p in x.peers, destination = x, Leader yourleader = leader}
     88
     89      s3 := {x.leader = leader}
     90
     91      e4 := {type = HELLO, origin = x, destination = x.leader}
     92
     93      e5 := {type = CMD, origin = x.leader, destination = x, String cmd = c}
     94
     95      e6 := {type = REPORT, origin = x, destination = x, String report = r}
     96
     97  Timeline:
     98
     99      e1 -> [s1 and e2 -> s2] || e3 -> s3 -> e4 -> e5 -> [e6]
     100
     101
     102 * '''Invariants:''' No additional ones are needed here.
    64103
    65104=== Experiment design ===
    … …  
    67106Now I'm a user who wants to design my experiment. I need to combine two metadescriptions and somehow tie them down to generator choices. To combine I need to specify how outputs of worm metadescription match inputs of P2P metadescription. I'll do something like this:
    68107
    69    [[Image(wp2pcomb.jpg)]]
     108  Worm w, P2P p2p
     109 
     110    p2p.Peer := w.Infected
     111
     112    w || p2p
     113
    70114
    71115i.e. each infected host becomes a peer.
    72116
    73 The system now needs to offer me several generators:
    74 
    75  * It should offer a topology generator and map the initial infected set, vulnerable set and leader set to the topology that gets generated.
    76  * It should offer event generator for each of the events: scan, yespeer, wannapeer, leaderis, hello, cmd and report. Specifically for scan, yespeer, wannapeer, hello, cmd and report it should offer traffic generators.  For leaderis it could either offer a traffic generator or an option to hardcode the leader ID into the peer software.
    77  * It should offer a malware generator for vulnerability x
    78 
    79 User either chooses each generator or agrees to use a default one for each choice. User can then manipulate the generators (their parameters) and the workflow. For example the user may add "patched" state after the "infected" one with the "patch" event to make the transition.
    80