This page describes currently proposed language for meta-descriptions. It may be updated frequently.

= Operators =
== Relational operators ==
Standard relational operators apply with same precedence as usual.
||'''Meaning     '''    || '''Operator '''||
||Less than       ||<         ||
||Less or equal   ||<=        ||
||Greater than    ||>         ||
||Greater or equal||>=        ||
||Equal           ||==        ||
||Different than  ||!=        ||

== Logical operators ==
Standard logical operators apply with same precedence as usual.
||'''Meaning''' || '''Operator '''||
||And	  || and      ||
||Or	  || or       ||
||Xor	  || xor      ||
||Not	  || not      ||

For events in the timeline of events, using '''and''' or '''or''' operators denotes that any ordering between these events is possible.

== Arithmetic operators ==
Standard arithmetic operators apply and parenthesis are used for non-obvious precedence

== Temporal operators ==
We want to be able to denote order and concurrency of events and state changes, and duration of events.
||'''Meaning	'''                   ||''' Operator and example '''|| Precedence ||
||A occurs after B                 || B -> A               || Highest for binary operators ||
||A and B occur concurrently       || A | | B              || Lowest for binary operators  ||           
||A lasts T time	           || A,,T,,               || Same as not                  || 
||A occurs T time after B	   || B ->,,T,, A          || Same as -> operator          ||

== Existential, cardinality and modal operators ==
We want to be able to denote how many objects or events of a given type must/may occur. This is usually specified in front of events/state change definitions.
||'''Meaning'''	                     || '''Operator and example''' || 
||Every object A	             || each A               ||
||Some objects A	             || some A               ||
||Some object A called a1            || some A a1            ||

Cardinality and modality of occurence:

||'''Meaning'''	                     || '''Operator and example''' || Precedence || 
||A must occur	                     || A                    || None, no explicit operator ||
||A may occur	                     || [A]                  || Same as parentheses        ||
||Exactly N objects/events of type A || |A|,,N,,             ||Same as parentheses        ||
||At least N objects/events of type A|| |A|,,>=N,,           ||Same as parentheses        ||
||At most N objects/events of type A || |A|,,<=N,,           || Same as parentheses        ||
== Conditions and loops ==
We want to be able to express that an event occurs under certain conditions.
||'''Meaning'''||'''Operator and example''' || Precedence || 
||if condition cond holds then A occurs else B occurs ||	if cond then A else B || Lowest ||
||Repeat some action while condition cond holds	      ||do A while cond || Same as if ||
||A such that cond || A | cond || Same as not ||

= Objects =
	
An object has a type, may have certain variables associated with it, and an initial state. Logical topology describes (each item is in separate section):
 * Object types, variables of interest and initial state. A variable is a new object.
 * Object aliases if needed: an object in a given state or whose variable(s) have some given value(s) can be assigned an alias for easier human manipulation such as a Vulnerable node that is in infected state is called Infected node.
 * Cardinality of objects using the notation specified above
 * Topological relationships between objects: one example is '''collocated''' function. Users can define other relationship functions such as A and B being on the same subnet, A being a leaf node, etc. All function definitions reside in the domain knowledge base.

|| '''Meaning''' ||	'''Operator and example''' ||
||A is of type X ||	A extends X          ||
||A’s initial state is Z ||	A := { state = Z} ||
||A has an object M of type Y and with initial value I ||	A := { Y M = I} ||
||A is an alias for B in state C	|| B := A{ state = C}||
||There are N objects of type A	|| |A|,,N,, ||
||A is different than B||	A != B||
||A and B reside on the same physical node	||collocated(A,B)||

= States and state changes =
State name may be just a symbolic name or it may be associated with an object variable holding some value. An object in a given state always responds in the same manner to the same stimuli.

State change names start with s followed by a number. They are defined within curly brackets by specifying the object and its new state, like this:

{{{s1 := {object.state = newstate}}}}

= Events =

Some events may lead to transitions between states, others occur but don’t change object state. Each event has the type, the origin and one or more destinations. These are specified within curly brackets. Event names start with e followed by a number. Each event may have multiple parameters. Example of an event definition:

{{{e1 := {type = TYPE, origin = object, destination = object, …}}}}

We should have a notion of events matching each other, like a reply matches a request. To support this there's a function '''match(event1, event2)''' which is defined in the domain knowledge base for each request/reply pair. In the timeline of events part of a meta-description if we want a reply to match a request we must explicitly say so using '''such that''' operator or have a condition on reply matching the request to proceed with the rest of the events in the sequence.