SnIPS Implementation and GUI 3 rd Presentation
description
Transcript of SnIPS Implementation and GUI 3 rd Presentation
1
SnIPS Implementation and GUI
3rd PresentationTsung-Hsi Wu, M.S.E.
Department of Computing and Information Science
Kansas State University
2
Outline
Action Item Final Software Production Demo Component Design Assessment Evaluation Project Evaluation
3
Outline
Action Item Final Software Production Demo Component Design Assessment Evaluation Project Evaluation
4
Action Item Item to be inspected (Previously…) :
UML Diagrams: package, component, deploy class, sequence diagrams
Item to be inspected Formal Requirement Specification: USE/OCL
5
Action Item
6
Outline
Action Item Final Software Production Demo Component Design Assessment Evaluation Project Evaluation
7
Final Software Production Demo What are the new features ?
Synchronous -> Asynchronous XSB Query Option
8
Outline
Action Item Final Software Production Demo Component Design Assessment Evaluation Project Evaluation
9
Component Design Component Diagram
10
Component Design Reactor Pattern Structure
11
Component Design Command Pattern Structure
12
Component Design Command Pattern Structure: Set Time Button
13
Component Design Command Pattern Structure: Start Snort Button
14
Component Design Command Pattern Structure: RadioBox
15
Component Design Parser:
16
Component Design Parser: Result.txt int(probeOtherMachine('192.168.10.80',external),c,range(1904834156,0)) strengthenedPf int(probeOtherMachine('192.168.10.80',external),l,range(1904834156,0)) summarizedFact skolem(0)
obsMap.P obsList(obsFacts(0),[oid_1299,oid_1405,oid_1442,oid_1476,oid_1488,oid_1520,oid_1790,oid_6851]).
obs.P obs(oid_1299, snort('1:1201', '192.168.10.80', '128.111.43.65', 1039206341)). obs(oid_1405, snort('1:1201', '192.168.10.80', '128.111.43.65', 1039206357)). obs(oid_1442, snort('1:1201', '192.168.10.80', '128.111.43.65', 1039206358)).
17
Outline
Action Item Final Software Production Demo Component Design Assessment Evaluation Project Evaluation
18
Assessment Evaluation Test Suite 1: Operating Snort
Test # SR # Description Expected Outcome Actual Outcome
TS1.1 SR2.1SR2.5
The user will click the Start Snort button to start Snort.
Snort status table will display “Snort Started”. The Start Snort button will change to Stop Snort button.
Same as Expected
TS1.2 SR2.2SR2.5
The user will click the Stop Snort button to stop Snort.
Snort status table will display “Snort Stopped”. The Stop Snort button will change to Start Snort button.
Same as Expected
19
Assessment Evaluation Test Suite 2: Operating SnIPS
Test # SR # Description Expected Outcome Actual Outcome
TS2.1 SR3.4SR3.7SR3.10SR4.2
The user will click the Set Time Frame button to set the start and end time for SnIPS and click Ok button after the start and end time is selected.
SnIPS status table will display the start and end time. Pre-processing and DoAll button is now enabled.
Same as Expected
TS2.2 SR3.4SR3.10SR4.2
The user can cancel setting the start and end time by clicking the Cancel button in the pop-up frame from Set Time Frame button
No Change Same as Expected
TS2.3 SR3.1 The user will click the Pre-processing button based on the time frame in TS2.1 for running SnIPS pre-processing.
A pop-up message box will show up displaying the “obs_xxx.P” file name is created. Summarization button is enabled at this time.
Same as Expected
20
Assessment Evaluation Test Suite 2: Operating SnIPS
Test # SR # Description Expected Outcome Actual Outcome
TS2.4 SR3.2 The user will click the Summarization button based on the time frame in TS2.1 for running SnIPS summarization.
A pop-up message box will show up displaying the “summ_xxx.P” file name is created. Trace button is enabled at this time.
Same as Expected
TS2.5 SR3.3 The user will click the Trace button based on the time frame in TS2.1 and select optional query for XSB engine for running SnIPS trace.
A pop-up message box will show up displaying the “result.txt” file name is created. Backtrack Output button is enabled at this time.
Pop-up message didn’t show up. Error Message: unexpected input.
Solved !
TS2.6 SR3.8SR4.1SR4.2
The user will click the Back Track button to show the SnIPS proof strengthening results.
The proof strengthening results are shown in web-based by the browser.
Same as Expected
TS2.7 SR3.5 The user will click the DoAll button to show the resunt SnIPS operation for SR3.1 ~ 3.3 and SR 3.8
The proof strengthening results are shown in web-based by the browser.
Same as Expected
21
Assessment Evaluation Test Suite 3: Trace Output Webpage
Test # SR # Description Expected Outcome Actual Outcome
TS3.1 SR5.1 The user will click the links provided in web-based proof strengthening result to show primitively summarized alerts.
Primitively summarized alerts for each proof strengthened result will be shown.
Same as Expected
TS3.2 SR6.1 The user will click the links next to the primitively summarized alerts provided in web-based proof strengthening result to show alert payload.
Payload for each alert will be shown.
Same as Expected
TS3.3 SR7.1 The user will click the links named with SID provided in web-based proof strengthening result to show triggered Snort rule.
The Snort rule triggered by the SID alert will be shown.
Same as Expected
TS3.4 SR7.2 The user will click the Snort rule description link provided in Snort rule webpage.
The Snort rule description will be shown with the same SID as in TS7.1
Same as Expected
22
Outline
Action Item Final Software Production Demo Component Design Assessment Evaluation Project Evaluation
23
Project Evaluation: SLOC
Actual SLOC: cloc-1.09
Program Language
File Blank Comment Code
Java 3 429 333 1765
PHP 5 177 54 455
JavaScript + Ajax 2 39 0 175
Total 10 645 387 2395 LOC
Project Plan 2.0 : Phase I : 1200 Phase II : 2020 (+ ~800 ) Phase III : 2700 (+ ~700 )
24
Project Evaluation: SLOC
25
Project Evaluation: Time Duration
Actual Duration
Programming Documentation Subtotal
Phase I 40 80 120
Phase II 80 107 187
Phase III 135 110 245
Total (hr): 550 255 hrs 295 hrs 550 hrs
Project Plan 2.0 :
Programming Document Meeting Reading Web Presentation Subtotal
Phase I (min) 2005 2240 480 295 405 120 92.42 hrs
Phase II (min) 3395 4925 375 0 70 195 149.33 hrs
Phase III (min) 2110 2455 180 0 50 120 81.92 hrs
Total (hr)323.66 hrs
7510 / 60 = 125.17
9620 / 60 = 160. 33
1035 / 60 = 17 .25
295 / 60 = 4.91
525 / 60 = 8.75
435 / 60 = 7.25323.66 hrs
26
Project Evaluation: Time Duration
27
Project Evaluation: Summarization Replace Linux Command to Simple Buttons
Convert Plain Text File to Webpage with Links Snort Rules & Description Payload
Current Users: System Administrators Researchers
28
Project Evaluation: Lesson Learnt Software Management and Software Engineering
Design
Flexibility of Architecture Design
Software Prototypes
29
Questions & Answers
SnIPS Implementation and GUI