![](bg2.png)
The Node class has two attributes:
ident
(optional) - a unique identifier for the node;
category
(optional) - the “domain” from which the name
information was obtained, if relevant. The permitted
values for this attribute are showed in (Curry, 2002).
The default value is “unknown”. The Node class has
two simple aggregated classes that are defined here:
location (zero or one – STRING) - the location of
the equipment;
name (zero or one – STRING) - the
name of the equipment.
The Address class is used to represent the
network address for a node. This class is defined in
(Curry, 2002).
The Platform class is used to define the node
characteristics. This is useful because some attacks
are targeted only to some specific platforms. The
Platform class has three attributes:
name (required)
the platform name. Examples: Intel, Hp, Sun, etc.;
model (optional) - the platform model; manuf
(optional) - the manufacturer of the platform.
The OS class is used to define the operational
system installed in the platform. This is useful
because some attacks are targeted only to some
specific operational systems. The OS class has three
attributes:
name (required) - the OS name.
Examples: Unix, Linux, Windows, etc.);
version
(required) - the OS version;
manuf (optional) - the
manufacturer of the OS;
release (required) - the
current operational system release.
Node
STRING ident
ENUM category
location
0..1
name
0..1
Adress
Platform
Environment
STRING description
STRING location
STRING address
STRING netmask
Analyzer
1..*
Services
0..*
0..*
STRING name
STRING model
STRING manuf
OS
STRING name
STRING version
STRING manuf
STRING release
1..*
Service
STRING name
STRING port
STRING action
*..1
1..*
Classification
STRING first_group
STRING second_group
STRING third_group
STRING fourth_group
STRING action
1..*
Object
STRING name
STRING version
STRING action
Patch
STRING date
STRING patch
The Patch class is used to define the patch that
has been applied to the operational system. This is
useful because some attacks are targeted only to
some specific operational systems versions. Some
patches correct vulnerabilities, so it’s important to
know this information. The Patch class has two
attributes:
date (required) - the date on which the
patch was applied to the operational system;
patch
(required) - what is the patch that was applied -
version, name, number, etc.
2.3 The Service class
The Service class is used to define the service that is
being executed. This service can be associated to an
environment or to a single machine. The Service
class has three attributes:
name (required) - the
service name. Examples: Web, Ftp, Telnet, etc;
port
(required) - the tcp/udp port which is being used by
the service;
action (required) - what to do with the
alerts that are being received by this
machine/service, “accept” or “reject”.
The Classification class is used to define the
service classification. This is used to detail the
service. The Classification class has five attributes:
first_group (required) - the first classification.
Examples: for the service Web we can use Apache,
IIS, Netscape, etc. The service that does not have a
specific classification receive “general” for this
attribute;
second_group (optional) - the second
classification, if necessary. Examples: For the
service Web, first classification IIS we can use
FrontPage as a second classification;
third_group
(optional) - the third classification, if necessary;
fourth_group (optional) - the fourth classification, if
necessary;
action (required) - what to do with the
alerts that are being received by this
machine/service/classification, “accept” or “reject”.
Figure 1: The Environment Class.
The Object class is used to define the service
object. The Object class has three attributes:
name
(required) - the object name. Examples: for the
service Web we can use Apache for the first
classification and we can define the object httpd;
version (required) - the current object version; action
(required) - what to do with the alerts that are being
received by this machine/service/classification/
object, “accept” or “reject”.
ICEIS 2004 - INFORMATION SYSTEMS ANALYSIS AND SPECIFICATION
602