Package jline.examples.java.advanced

Class PassageTimeExample

java.lang.Object
jline.examples.java.advanced.PassageTimeExample
public class PassageTimeExample extends Object
First passage times in a Markov chain, and the exact cycle time along an overtake-free path of a closed tree-like product-form network.

Reference: P. G. Harrison and W. J. Knottenbelt, "Passage Time Distributions in Large Markov Chains", 2002.

State and node indices are 0-based here and 1-based in the MATLAB reference.

  • Constructor Details

    • PassageTimeExample

      public PassageTimeExample()

  • Method Details

    • passage_firstpassage

      public static void passage_firstpassage()
      First passage times, semi-Markov passage times and an overtake-free cycle time (passage_firstpassage.m).

    • passage_attackgraph

      public static void passage_attackgraph()
      Security questions asked as first passages with a TABOO set (passage_attackgraph.m): the passage into a target set B counts only if the chain does not enter the taboo set C first. In the CSL notation of Baier, Haverkort, Hermanns and Katoen (IEEE TSE 2003) this is the time-bounded until P=?[ !C U<=t B ].

      Part 1 is a timed attack graph. Its state is the set of security conditions the attacker holds; the attacker starts with a foothold on the web server. Two exploits race to a database account (an OR), phishing yields a credential, and privilege escalation needs BOTH the account and the credential (an AND) to reach root. An intrusion detection system (IDS) raises the alarm at a constant rate. Conditions are never lost, so the reachable state space is the lattice of condition sets and is built here directly.

      Part 2 asks the same kind of question of a queueing model: a flooding attack leaves a backlog in a finite buffer, and the question is whether the buffer overflows before the server clears the backlog. Here the state sets are named by predicates over the model's aggregated state, and SolverCTMC answers directly.

    • passage_attackgraph_redundancy

      public static void passage_attackgraph_redundancy()
      The attack model of J. Soikkeli, G. Casale, L. Munoz-Gonzalez, E. C. Lupu, "Redundancy Planning for Cost Efficient Resilience to Cyber Attacks", IEEE TDSC 2023, Sec. 5.2-5.4, solved as first passages with a TABOO set (passage_attackgraph_redundancy.m).

      Each attack scenario is a fixed plan of exploits. Step k takes an exponential time of mean tau (24 h for a first exploit, 6 h when the vulnerability was already used elsewhere, 4 h to repeat a privilege on another server of the same type) and is detected with probability pd, which SPLITS its rate: (1-pd)/tau onward, pd/tau into "contained after k-1 steps". The first step, launched from outside, is never detected; in Case 1 neither are the repeats on identical servers. Scenarios have weight 1/3, and on a diversified allocation the attacker can exploit the regular servers, the alternative ones or both, again 1/3 each. Both enter through the initial distribution.

      Every end state of the chain is an attack OUTCOME. Its weight w_M is the probability of reaching it before any other end state (the others are the taboo set), and the conditional mean passage time is the time at which the attacker launches the disruption. The weights do not depend on tau, so they must equal the paper's (1-pd)^(m-1)*pd products, which is checked below.

      Allocation x = [SA, SAA, SD, DB]: regular and alternative application servers, database servers, databases. Privileges: P1/P2 user/admin WebLogic, P3 user LAN, P4 server admin, P5/P6 user/admin OS of an application server, P7 DB admin, P8/P9 user/admin OS of a database server, P11 admin Oracle; an A suffix marks the alternative server type. Disruptive privileges: P2, P6 (SA), P2A, P6A (SAA), P9 (SD), P11 (DB).

    • main

      public static void main(String[] args)