This page describes currently proposed language for meta-descriptions. It may be updated frequently.

Operators

Relational operators

Standard relational operators apply

Meaning	Operator
Less than	<
Less or equal	<=
Greater than	>
Greater or equal	>=
Equal	=
Different than	!=

Logical operators

Standard logical operators apply

Meaning	Operator
And	and
Or	or
Xor	xor
Not	not

For events in the timeline of events, using and or or operators denotes that any ordering between these events is possible.

Arithmetic operators

Standard arithmetic operators apply and parenthesis are used for non-obvious precedence

Temporal operators

We want to be able to denote order and concurrency of events and state changes, and duration of events.

Meaning	Operator and example
A occurs after B	B -> A
A and B occur concurrently	A | | B
A lasts T time	AT
A occurs T time after B	B ->T A

Existential, cardinality and modal operators

We want to be able to denote how many objects or events of a given type must/may occur.

Meaning	Operator and example
Every object A	each A
Some objects A	some A
Some object A called a1	some A a1
A must occur	A
A may occur	[A]
Exactly N objects/events of type A	|A|N
At least N objects/events of type A	|A|>=N
At most N objects/events of type A	|A|<=N

Conditions and loops

We want to be able to express that an event occurs under certain conditions.

Meaning	Operator and example
if condition cond holds then A occurs else B occurs	if cond then A else B
Repeat some action while condition cond holds	do A while cond
A such that cond	A | cond

Objects

An object has a type, may have certain variables associated with it, and an initial state. Logical topology describes (each item is in separate section):

• Object types, variables of interest and initial state. A variable is a new object.
• Object aliases if needed: an object in a given state or whose variable(s) have some given value(s) can be assigned an alias for easier human manipulation such as a Vulnerable node that is in infected state is called Infected node.
• Cardinality of objects using the notation specified above
• Topological relationships between objects: one example is collocated function. Users can define other relationship functions such as A and B being on the same subnet, A being a leaf node, etc. All function definitions reside in the domain knowledge base.

Meaning	Operator and example
A is of type X	A extends X
A’s initial state is Z	A := { state = Z}
A has an object M of type Y and with initial value I	A := { Y M = I}
A is an alias for B in state C	B := A{ state = C}
There are N objects of type A	|A|N
A is different than B	A != B
A and B reside on the same physical node	collocated(A,B)

States and state changes

State name may be just a symbolic name or it may be associated with an object variable holding some value. An object in a given state always responds in the same manner to the same stimuli.

State change names start with s followed by a number. They are defined within curly brackets by specifying the object and its new state, like this:

s1 := {object.state = newstate}

Events

Some events may lead to transitions between states, others occur but don’t change object state. Each event has the type, the origin and one or more destinations. These are specified within curly brackets. Event names start with e followed by a number. Each event may have multiple parameters. Example of an event definition:

e1 := {type = TYPE, origin = object, destination = object, …}

We should have a notion of events matching each other, like a reply matches a request. To support this there's a function match(event1, event2) which is defined in the domain knowledge base for each request/reply pair. In the timeline of events part of a meta-description if we want a reply to match a request we must explicitly say so using such that operator or have a condition on reply matching the request to proceed with the rest of the events in the sequence.