From 0e8c60df4c8eb3f0727c4ef0b224c909d783a707 Mon Sep 17 00:00:00 2001 From: Marek Wolan Date: Sun, 3 Mar 2024 16:53:18 +0000 Subject: [PATCH 1/4] Update actions --- .../config/_package_data/example_config.yaml | 244 ++++++++++++------ src/primaite/notebooks/uc2_demo.ipynb | 26 +- 2 files changed, 184 insertions(+), 86 deletions(-) diff --git a/src/primaite/config/_package_data/example_config.yaml b/src/primaite/config/_package_data/example_config.yaml index 478124a9..b906bba8 100644 --- a/src/primaite/config/_package_data/example_config.yaml +++ b/src/primaite/config/_package_data/example_config.yaml @@ -238,99 +238,196 @@ agents: 3: action: "NODE_SERVICE_START" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 4: action: "NODE_SERVICE_PAUSE" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 5: action: "NODE_SERVICE_RESUME" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 6: action: "NODE_SERVICE_RESTART" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 7: action: "NODE_SERVICE_DISABLE" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 8: action: "NODE_SERVICE_ENABLE" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 9: # check database.db file action: "NODE_FILE_SCAN" options: - node_id: 2 - folder_id: 0 - file_id: 0 + node_id: 2 + folder_id: 0 + file_id: 0 10: action: "NODE_FILE_CHECKHASH" options: - node_id: 2 - folder_id: 0 - file_id: 0 + node_id: 2 + folder_id: 0 + file_id: 0 11: action: "NODE_FILE_DELETE" options: - node_id: 2 - folder_id: 0 - file_id: 0 + node_id: 2 + folder_id: 0 + file_id: 0 12: action: "NODE_FILE_REPAIR" options: - node_id: 2 - folder_id: 0 - file_id: 0 + node_id: 2 + folder_id: 0 + file_id: 0 13: action: "NODE_SERVICE_PATCH" options: - node_id: 2 - service_id: 0 + node_id: 2 + service_id: 0 14: action: "NODE_FOLDER_SCAN" options: - node_id: 2 - folder_id: 0 + node_id: 2 + folder_id: 0 15: action: "NODE_FOLDER_CHECKHASH" options: - node_id: 2 - folder_id: 0 + node_id: 2 + folder_id: 0 16: action: "NODE_FOLDER_REPAIR" options: - node_id: 2 - folder_id: 0 + node_id: 2 + folder_id: 0 17: action: "NODE_FOLDER_RESTORE" options: - node_id: 2 - folder_id: 0 + node_id: 2 + folder_id: 0 18: action: "NODE_OS_SCAN" options: - node_id: 2 - 19: # shutdown client 1 + node_id: 0 + 19: action: "NODE_SHUTDOWN" options: - node_id: 5 + node_id: 0 20: - action: "NODE_STARTUP" + action: NODE_STARTUP options: - node_id: 5 + node_id: 0 21: - action: "NODE_RESET" + action: NODE_RESET options: - node_id: 5 - 22: # "ACL: ADDRULE - Block outgoing traffic from client 1" + node_id: 0 + 22: + action: "NODE_OS_SCAN" + options: + node_id: 1 + 23: + action: "NODE_SHUTDOWN" + options: + node_id: 1 + 24: + action: NODE_STARTUP + options: + node_id: 1 + 25: + action: NODE_RESET + options: + node_id: 1 + 26: # old action num: 18 + action: "NODE_OS_SCAN" + options: + node_id: 2 + 27: + action: "NODE_SHUTDOWN" + options: + node_id: 2 + 28: + action: NODE_STARTUP + options: + node_id: 2 + 29: + action: NODE_RESET + options: + node_id: 2 + 30: + action: "NODE_OS_SCAN" + options: + node_id: 3 + 31: + action: "NODE_SHUTDOWN" + options: + node_id: 3 + 32: + action: NODE_STARTUP + options: + node_id: 3 + 33: + action: NODE_RESET + options: + node_id: 3 + 34: + action: "NODE_OS_SCAN" + options: + node_id: 4 + 35: + action: "NODE_SHUTDOWN" + options: + node_id: 4 + 36: + action: NODE_STARTUP + options: + node_id: 4 + 37: + action: NODE_RESET + options: + node_id: 4 + 38: + action: "NODE_OS_SCAN" + options: + node_id: 5 + 39: # old action num: 19 # shutdown client 1 + action: "NODE_SHUTDOWN" + options: + node_id: 5 + 40: # old action num: 20 + action: NODE_STARTUP + options: + node_id: 5 + 41: # old action num: 21 + action: NODE_RESET + options: + node_id: 5 + 42: + action: "NODE_OS_SCAN" + options: + node_id: 6 + 43: + action: "NODE_SHUTDOWN" + options: + node_id: 6 + 44: + action: NODE_STARTUP + options: + node_id: 6 + 45: + action: NODE_RESET + options: + node_id: 6 + + 46: # old action num: 22 # "ACL: ADDRULE - Block outgoing traffic from client 1" action: "NETWORK_ACL_ADDRULE" options: position: 1 @@ -340,7 +437,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 1 - 23: # "ACL: ADDRULE - Block outgoing traffic from client 2" + 47: # old action num: 23 # "ACL: ADDRULE - Block outgoing traffic from client 2" action: "NETWORK_ACL_ADDRULE" options: position: 2 @@ -350,7 +447,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 1 - 24: # block tcp traffic from client 1 to web app + 48: # old action num: 24 # block tcp traffic from client 1 to web app action: "NETWORK_ACL_ADDRULE" options: position: 3 @@ -360,7 +457,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 3 - 25: # block tcp traffic from client 2 to web app + 49: # old action num: 25 # block tcp traffic from client 2 to web app action: "NETWORK_ACL_ADDRULE" options: position: 4 @@ -370,7 +467,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 3 - 26: + 50: # old action num: 26 action: "NETWORK_ACL_ADDRULE" options: position: 5 @@ -380,7 +477,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 3 - 27: + 51: # old action num: 27 action: "NETWORK_ACL_ADDRULE" options: position: 6 @@ -390,128 +487,129 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 3 - 28: + 52: # old action num: 28 action: "NETWORK_ACL_REMOVERULE" options: position: 0 - 29: + 53: # old action num: 29 action: "NETWORK_ACL_REMOVERULE" options: position: 1 - 30: + 54: # old action num: 30 action: "NETWORK_ACL_REMOVERULE" options: position: 2 - 31: + 55: # old action num: 31 action: "NETWORK_ACL_REMOVERULE" options: position: 3 - 32: + 56: # old action num: 32 action: "NETWORK_ACL_REMOVERULE" options: position: 4 - 33: + 57: # old action num: 33 action: "NETWORK_ACL_REMOVERULE" options: position: 5 - 34: + 58: # old action num: 34 action: "NETWORK_ACL_REMOVERULE" options: position: 6 - 35: + 59: # old action num: 35 action: "NETWORK_ACL_REMOVERULE" options: position: 7 - 36: + 60: # old action num: 36 action: "NETWORK_ACL_REMOVERULE" options: position: 8 - 37: + 61: # old action num: 37 action: "NETWORK_ACL_REMOVERULE" options: position: 9 - 38: + 62: # old action num: 38 action: "NETWORK_NIC_DISABLE" options: node_id: 0 nic_id: 0 - 39: + 63: # old action num: 39 action: "NETWORK_NIC_ENABLE" options: node_id: 0 nic_id: 0 - 40: + 64: # old action num: 40 action: "NETWORK_NIC_DISABLE" options: node_id: 1 nic_id: 0 - 41: + 65: # old action num: 41 action: "NETWORK_NIC_ENABLE" options: node_id: 1 nic_id: 0 - 42: + 66: # old action num: 42 action: "NETWORK_NIC_DISABLE" options: node_id: 2 nic_id: 0 - 43: + 67: # old action num: 43 action: "NETWORK_NIC_ENABLE" options: node_id: 2 nic_id: 0 - 44: + 68: # old action num: 44 action: "NETWORK_NIC_DISABLE" options: node_id: 3 nic_id: 0 - 45: + 69: # old action num: 45 action: "NETWORK_NIC_ENABLE" options: node_id: 3 nic_id: 0 - 46: + 70: # old action num: 46 action: "NETWORK_NIC_DISABLE" options: node_id: 4 nic_id: 0 - 47: + 71: # old action num: 47 action: "NETWORK_NIC_ENABLE" options: node_id: 4 nic_id: 0 - 48: + 72: # old action num: 48 action: "NETWORK_NIC_DISABLE" options: node_id: 4 nic_id: 1 - 49: + 73: # old action num: 49 action: "NETWORK_NIC_ENABLE" options: node_id: 4 nic_id: 1 - 50: + 74: # old action num: 50 action: "NETWORK_NIC_DISABLE" options: node_id: 5 nic_id: 0 - 51: + 75: # old action num: 51 action: "NETWORK_NIC_ENABLE" options: node_id: 5 nic_id: 0 - 52: + 76: # old action num: 52 action: "NETWORK_NIC_DISABLE" options: node_id: 6 nic_id: 0 - 53: + 77: # old action num: 53 action: "NETWORK_NIC_ENABLE" options: node_id: 6 nic_id: 0 + options: nodes: - node_name: domain_controller diff --git a/src/primaite/notebooks/uc2_demo.ipynb b/src/primaite/notebooks/uc2_demo.ipynb index c8f2595b..ca06ea8a 100644 --- a/src/primaite/notebooks/uc2_demo.ipynb +++ b/src/primaite/notebooks/uc2_demo.ipynb @@ -301,17 +301,17 @@ "- `1`: Scan the web service - this refreshes the health status in the observation space\n", "- `9`: Scan the database file - this refreshes the health status of the database file\n", "- `13`: Patch the database service - This triggers the database to restore data from the backup server\n", - "- `19`: Shut down client 1\n", - "- `20`: Start up client 1\n", - "- `22`: Block outgoing traffic from client 1\n", - "- `23`: Block outgoing traffic from client 2\n", - "- `26`: Block TCP traffic from client 1 to the database node\n", - "- `27`: Block TCP traffic from client 2 to the database node\n", - "- `28-37`: Remove ACL rules 1-10\n", - "- `42`: Disconnect client 1 from the network\n", - "- `43`: Reconnect client 1 to the network\n", - "- `44`: Disconnect client 2 from the network\n", - "- `45`: Reconnect client 2 to the network\n", + "- `39`: Shut down client 1\n", + "- `40`: Start up client 1\n", + "- `46`: Block outgoing traffic from client 1\n", + "- `47`: Block outgoing traffic from client 2\n", + "- `50`: Block TCP traffic from client 1 to the database node\n", + "- `51`: Block TCP traffic from client 2 to the database node\n", + "- `52-61`: Remove ACL rules 1-10\n", + "- `66`: Disconnect client 1 from the network\n", + "- `67`: Reconnect client 1 to the network\n", + "- `68`: Disconnect client 2 from the network\n", + "- `69`: Reconnect client 2 to the network\n", "\n", "The other actions will either have no effect or will negatively impact the network, so the blue agent should avoid taking them." ] @@ -541,10 +541,10 @@ "env.step(13) # Patch the database\n", "print(f\"step: {env.game.step_counter}, Red action: {info['agent_actions']['data_manipulation_attacker'][0]}, Blue reward:{reward}\" )\n", "\n", - "env.step(26) # Block client 1\n", + "env.step(50) # Block client 1\n", "print(f\"step: {env.game.step_counter}, Red action: {info['agent_actions']['data_manipulation_attacker'][0]}, Blue reward:{reward}\" )\n", "\n", - "env.step(27) # Block client 2\n", + "env.step(51) # Block client 2\n", "print(f\"step: {env.game.step_counter}, Red action: {info['agent_actions']['data_manipulation_attacker'][0]}, Blue reward:{reward}\" )\n", "\n", "for step in range(30):\n", From afc3635bfe3cac06fdc4949bca0262c89cc5a1d1 Mon Sep 17 00:00:00 2001 From: Marek Wolan Date: Sun, 3 Mar 2024 16:56:52 +0000 Subject: [PATCH 2/4] Update changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d54af980..5416bb9d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -111,6 +111,7 @@ SessionManager. - **ACLRule Wildcard Masking**: Updated the `ACLRule` class to support IP ranges using wildcard masking. This enhancement allows for more flexible and granular control over traffic filtering, enabling the specification of broader or more specific IP address ranges in ACL rules. - Updated `NetworkInterface` documentation to reflect the new NMNE capturing features and how to use them. - Integration of NMNE capturing functionality within the `NicObservation` class. +- Changed blue action set to enable applying node scan, reset, start, and shutdown to every host in data manipulation scenario ### Removed - Removed legacy simulation modules: `acl`, `common`, `environment`, `links`, `nodes`, `pol` From a4c723858b0d02430ebebeef4f6393707f508d2d Mon Sep 17 00:00:00 2001 From: Marek Wolan Date: Sun, 3 Mar 2024 16:57:53 +0000 Subject: [PATCH 3/4] Update action map in second --- .../example_config_2_rl_agents.yaml | 487 ++++++++++++------ 1 file changed, 341 insertions(+), 146 deletions(-) diff --git a/src/primaite/config/_package_data/example_config_2_rl_agents.yaml b/src/primaite/config/_package_data/example_config_2_rl_agents.yaml index b6b07afa..fd5a3092 100644 --- a/src/primaite/config/_package_data/example_config_2_rl_agents.yaml +++ b/src/primaite/config/_package_data/example_config_2_rl_agents.yaml @@ -240,99 +240,196 @@ agents: 3: action: "NODE_SERVICE_START" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 4: action: "NODE_SERVICE_PAUSE" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 5: action: "NODE_SERVICE_RESUME" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 6: action: "NODE_SERVICE_RESTART" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 7: action: "NODE_SERVICE_DISABLE" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 8: action: "NODE_SERVICE_ENABLE" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 9: # check database.db file action: "NODE_FILE_SCAN" options: - node_id: 2 - folder_id: 0 - file_id: 0 + node_id: 2 + folder_id: 0 + file_id: 0 10: action: "NODE_FILE_CHECKHASH" options: - node_id: 2 - folder_id: 0 - file_id: 0 + node_id: 2 + folder_id: 0 + file_id: 0 11: action: "NODE_FILE_DELETE" options: - node_id: 2 - folder_id: 0 - file_id: 0 + node_id: 2 + folder_id: 0 + file_id: 0 12: action: "NODE_FILE_REPAIR" options: - node_id: 2 - folder_id: 0 - file_id: 0 + node_id: 2 + folder_id: 0 + file_id: 0 13: action: "NODE_SERVICE_PATCH" options: - node_id: 2 - service_id: 0 + node_id: 2 + service_id: 0 14: action: "NODE_FOLDER_SCAN" options: - node_id: 2 - folder_id: 0 + node_id: 2 + folder_id: 0 15: action: "NODE_FOLDER_CHECKHASH" options: - node_id: 2 - folder_id: 0 + node_id: 2 + folder_id: 0 16: action: "NODE_FOLDER_REPAIR" options: - node_id: 2 - folder_id: 0 + node_id: 2 + folder_id: 0 17: action: "NODE_FOLDER_RESTORE" options: - node_id: 2 - folder_id: 0 + node_id: 2 + folder_id: 0 18: action: "NODE_OS_SCAN" options: - node_id: 2 - 19: # shutdown client 1 + node_id: 0 + 19: action: "NODE_SHUTDOWN" options: - node_id: 5 + node_id: 0 20: - action: "NODE_STARTUP" + action: NODE_STARTUP options: - node_id: 5 + node_id: 0 21: - action: "NODE_RESET" + action: NODE_RESET options: - node_id: 5 - 22: # "ACL: ADDRULE - Block outgoing traffic from client 1" + node_id: 0 + 22: + action: "NODE_OS_SCAN" + options: + node_id: 1 + 23: + action: "NODE_SHUTDOWN" + options: + node_id: 1 + 24: + action: NODE_STARTUP + options: + node_id: 1 + 25: + action: NODE_RESET + options: + node_id: 1 + 26: # old action num: 18 + action: "NODE_OS_SCAN" + options: + node_id: 2 + 27: + action: "NODE_SHUTDOWN" + options: + node_id: 2 + 28: + action: NODE_STARTUP + options: + node_id: 2 + 29: + action: NODE_RESET + options: + node_id: 2 + 30: + action: "NODE_OS_SCAN" + options: + node_id: 3 + 31: + action: "NODE_SHUTDOWN" + options: + node_id: 3 + 32: + action: NODE_STARTUP + options: + node_id: 3 + 33: + action: NODE_RESET + options: + node_id: 3 + 34: + action: "NODE_OS_SCAN" + options: + node_id: 4 + 35: + action: "NODE_SHUTDOWN" + options: + node_id: 4 + 36: + action: NODE_STARTUP + options: + node_id: 4 + 37: + action: NODE_RESET + options: + node_id: 4 + 38: + action: "NODE_OS_SCAN" + options: + node_id: 5 + 39: # old action num: 19 # shutdown client 1 + action: "NODE_SHUTDOWN" + options: + node_id: 5 + 40: # old action num: 20 + action: NODE_STARTUP + options: + node_id: 5 + 41: # old action num: 21 + action: NODE_RESET + options: + node_id: 5 + 42: + action: "NODE_OS_SCAN" + options: + node_id: 6 + 43: + action: "NODE_SHUTDOWN" + options: + node_id: 6 + 44: + action: NODE_STARTUP + options: + node_id: 6 + 45: + action: NODE_RESET + options: + node_id: 6 + + 46: # old action num: 22 # "ACL: ADDRULE - Block outgoing traffic from client 1" action: "NETWORK_ACL_ADDRULE" options: position: 1 @@ -342,7 +439,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 1 - 23: # "ACL: ADDRULE - Block outgoing traffic from client 2" + 47: # old action num: 23 # "ACL: ADDRULE - Block outgoing traffic from client 2" action: "NETWORK_ACL_ADDRULE" options: position: 2 @@ -352,7 +449,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 1 - 24: # block tcp traffic from client 1 to web app + 48: # old action num: 24 # block tcp traffic from client 1 to web app action: "NETWORK_ACL_ADDRULE" options: position: 3 @@ -362,7 +459,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 3 - 25: # block tcp traffic from client 2 to web app + 49: # old action num: 25 # block tcp traffic from client 2 to web app action: "NETWORK_ACL_ADDRULE" options: position: 4 @@ -372,7 +469,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 3 - 26: + 50: # old action num: 26 action: "NETWORK_ACL_ADDRULE" options: position: 5 @@ -382,7 +479,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 3 - 27: + 51: # old action num: 27 action: "NETWORK_ACL_ADDRULE" options: position: 6 @@ -392,122 +489,122 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 3 - 28: + 52: # old action num: 28 action: "NETWORK_ACL_REMOVERULE" options: position: 0 - 29: + 53: # old action num: 29 action: "NETWORK_ACL_REMOVERULE" options: position: 1 - 30: + 54: # old action num: 30 action: "NETWORK_ACL_REMOVERULE" options: position: 2 - 31: + 55: # old action num: 31 action: "NETWORK_ACL_REMOVERULE" options: position: 3 - 32: + 56: # old action num: 32 action: "NETWORK_ACL_REMOVERULE" options: position: 4 - 33: + 57: # old action num: 33 action: "NETWORK_ACL_REMOVERULE" options: position: 5 - 34: + 58: # old action num: 34 action: "NETWORK_ACL_REMOVERULE" options: position: 6 - 35: + 59: # old action num: 35 action: "NETWORK_ACL_REMOVERULE" options: position: 7 - 36: + 60: # old action num: 36 action: "NETWORK_ACL_REMOVERULE" options: position: 8 - 37: + 61: # old action num: 37 action: "NETWORK_ACL_REMOVERULE" options: position: 9 - 38: + 62: # old action num: 38 action: "NETWORK_NIC_DISABLE" options: node_id: 0 nic_id: 0 - 39: + 63: # old action num: 39 action: "NETWORK_NIC_ENABLE" options: node_id: 0 nic_id: 0 - 40: + 64: # old action num: 40 action: "NETWORK_NIC_DISABLE" options: node_id: 1 nic_id: 0 - 41: + 65: # old action num: 41 action: "NETWORK_NIC_ENABLE" options: node_id: 1 nic_id: 0 - 42: + 66: # old action num: 42 action: "NETWORK_NIC_DISABLE" options: node_id: 2 nic_id: 0 - 43: + 67: # old action num: 43 action: "NETWORK_NIC_ENABLE" options: node_id: 2 nic_id: 0 - 44: + 68: # old action num: 44 action: "NETWORK_NIC_DISABLE" options: node_id: 3 nic_id: 0 - 45: + 69: # old action num: 45 action: "NETWORK_NIC_ENABLE" options: node_id: 3 nic_id: 0 - 46: + 70: # old action num: 46 action: "NETWORK_NIC_DISABLE" options: node_id: 4 nic_id: 0 - 47: + 71: # old action num: 47 action: "NETWORK_NIC_ENABLE" options: node_id: 4 nic_id: 0 - 48: + 72: # old action num: 48 action: "NETWORK_NIC_DISABLE" options: node_id: 4 nic_id: 1 - 49: + 73: # old action num: 49 action: "NETWORK_NIC_ENABLE" options: node_id: 4 nic_id: 1 - 50: + 74: # old action num: 50 action: "NETWORK_NIC_DISABLE" options: node_id: 5 nic_id: 0 - 51: + 75: # old action num: 51 action: "NETWORK_NIC_ENABLE" options: node_id: 5 nic_id: 0 - 52: + 76: # old action num: 52 action: "NETWORK_NIC_DISABLE" options: node_id: 6 nic_id: 0 - 53: + 77: # old action num: 53 action: "NETWORK_NIC_ENABLE" options: node_id: 6 @@ -694,99 +791,196 @@ agents: 3: action: "NODE_SERVICE_START" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 4: action: "NODE_SERVICE_PAUSE" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 5: action: "NODE_SERVICE_RESUME" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 6: action: "NODE_SERVICE_RESTART" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 7: action: "NODE_SERVICE_DISABLE" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 8: action: "NODE_SERVICE_ENABLE" options: - node_id: 1 - service_id: 0 + node_id: 1 + service_id: 0 9: # check database.db file action: "NODE_FILE_SCAN" options: - node_id: 2 - folder_id: 0 - file_id: 0 + node_id: 2 + folder_id: 0 + file_id: 0 10: action: "NODE_FILE_CHECKHASH" options: - node_id: 2 - folder_id: 0 - file_id: 0 + node_id: 2 + folder_id: 0 + file_id: 0 11: action: "NODE_FILE_DELETE" options: - node_id: 2 - folder_id: 0 - file_id: 0 + node_id: 2 + folder_id: 0 + file_id: 0 12: action: "NODE_FILE_REPAIR" options: - node_id: 2 - folder_id: 0 - file_id: 0 + node_id: 2 + folder_id: 0 + file_id: 0 13: action: "NODE_SERVICE_PATCH" options: - node_id: 2 - service_id: 0 + node_id: 2 + service_id: 0 14: action: "NODE_FOLDER_SCAN" options: - node_id: 2 - folder_id: 0 + node_id: 2 + folder_id: 0 15: action: "NODE_FOLDER_CHECKHASH" options: - node_id: 2 - folder_id: 0 + node_id: 2 + folder_id: 0 16: action: "NODE_FOLDER_REPAIR" options: - node_id: 2 - folder_id: 0 + node_id: 2 + folder_id: 0 17: action: "NODE_FOLDER_RESTORE" options: - node_id: 2 - folder_id: 0 + node_id: 2 + folder_id: 0 18: action: "NODE_OS_SCAN" options: - node_id: 2 - 19: # shutdown client 1 + node_id: 0 + 19: action: "NODE_SHUTDOWN" options: - node_id: 5 + node_id: 0 20: - action: "NODE_STARTUP" + action: NODE_STARTUP options: - node_id: 5 + node_id: 0 21: - action: "NODE_RESET" + action: NODE_RESET options: - node_id: 5 - 22: # "ACL: ADDRULE - Block outgoing traffic from client 1" + node_id: 0 + 22: + action: "NODE_OS_SCAN" + options: + node_id: 1 + 23: + action: "NODE_SHUTDOWN" + options: + node_id: 1 + 24: + action: NODE_STARTUP + options: + node_id: 1 + 25: + action: NODE_RESET + options: + node_id: 1 + 26: # old action num: 18 + action: "NODE_OS_SCAN" + options: + node_id: 2 + 27: + action: "NODE_SHUTDOWN" + options: + node_id: 2 + 28: + action: NODE_STARTUP + options: + node_id: 2 + 29: + action: NODE_RESET + options: + node_id: 2 + 30: + action: "NODE_OS_SCAN" + options: + node_id: 3 + 31: + action: "NODE_SHUTDOWN" + options: + node_id: 3 + 32: + action: NODE_STARTUP + options: + node_id: 3 + 33: + action: NODE_RESET + options: + node_id: 3 + 34: + action: "NODE_OS_SCAN" + options: + node_id: 4 + 35: + action: "NODE_SHUTDOWN" + options: + node_id: 4 + 36: + action: NODE_STARTUP + options: + node_id: 4 + 37: + action: NODE_RESET + options: + node_id: 4 + 38: + action: "NODE_OS_SCAN" + options: + node_id: 5 + 39: # old action num: 19 # shutdown client 1 + action: "NODE_SHUTDOWN" + options: + node_id: 5 + 40: # old action num: 20 + action: NODE_STARTUP + options: + node_id: 5 + 41: # old action num: 21 + action: NODE_RESET + options: + node_id: 5 + 42: + action: "NODE_OS_SCAN" + options: + node_id: 6 + 43: + action: "NODE_SHUTDOWN" + options: + node_id: 6 + 44: + action: NODE_STARTUP + options: + node_id: 6 + 45: + action: NODE_RESET + options: + node_id: 6 + + 46: # old action num: 22 # "ACL: ADDRULE - Block outgoing traffic from client 1" action: "NETWORK_ACL_ADDRULE" options: position: 1 @@ -796,7 +990,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 1 - 23: # "ACL: ADDRULE - Block outgoing traffic from client 2" + 47: # old action num: 23 # "ACL: ADDRULE - Block outgoing traffic from client 2" action: "NETWORK_ACL_ADDRULE" options: position: 2 @@ -806,7 +1000,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 1 - 24: # block tcp traffic from client 1 to web app + 48: # old action num: 24 # block tcp traffic from client 1 to web app action: "NETWORK_ACL_ADDRULE" options: position: 3 @@ -816,7 +1010,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 3 - 25: # block tcp traffic from client 2 to web app + 49: # old action num: 25 # block tcp traffic from client 2 to web app action: "NETWORK_ACL_ADDRULE" options: position: 4 @@ -826,7 +1020,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 3 - 26: + 50: # old action num: 26 action: "NETWORK_ACL_ADDRULE" options: position: 5 @@ -836,7 +1030,7 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 3 - 27: + 51: # old action num: 27 action: "NETWORK_ACL_ADDRULE" options: position: 6 @@ -846,128 +1040,129 @@ agents: source_port_id: 1 dest_port_id: 1 protocol_id: 3 - 28: + 52: # old action num: 28 action: "NETWORK_ACL_REMOVERULE" options: position: 0 - 29: + 53: # old action num: 29 action: "NETWORK_ACL_REMOVERULE" options: position: 1 - 30: + 54: # old action num: 30 action: "NETWORK_ACL_REMOVERULE" options: position: 2 - 31: + 55: # old action num: 31 action: "NETWORK_ACL_REMOVERULE" options: position: 3 - 32: + 56: # old action num: 32 action: "NETWORK_ACL_REMOVERULE" options: position: 4 - 33: + 57: # old action num: 33 action: "NETWORK_ACL_REMOVERULE" options: position: 5 - 34: + 58: # old action num: 34 action: "NETWORK_ACL_REMOVERULE" options: position: 6 - 35: + 59: # old action num: 35 action: "NETWORK_ACL_REMOVERULE" options: position: 7 - 36: + 60: # old action num: 36 action: "NETWORK_ACL_REMOVERULE" options: position: 8 - 37: + 61: # old action num: 37 action: "NETWORK_ACL_REMOVERULE" options: position: 9 - 38: + 62: # old action num: 38 action: "NETWORK_NIC_DISABLE" options: node_id: 0 nic_id: 0 - 39: + 63: # old action num: 39 action: "NETWORK_NIC_ENABLE" options: node_id: 0 nic_id: 0 - 40: + 64: # old action num: 40 action: "NETWORK_NIC_DISABLE" options: node_id: 1 nic_id: 0 - 41: + 65: # old action num: 41 action: "NETWORK_NIC_ENABLE" options: node_id: 1 nic_id: 0 - 42: + 66: # old action num: 42 action: "NETWORK_NIC_DISABLE" options: node_id: 2 nic_id: 0 - 43: + 67: # old action num: 43 action: "NETWORK_NIC_ENABLE" options: node_id: 2 nic_id: 0 - 44: + 68: # old action num: 44 action: "NETWORK_NIC_DISABLE" options: node_id: 3 nic_id: 0 - 45: + 69: # old action num: 45 action: "NETWORK_NIC_ENABLE" options: node_id: 3 nic_id: 0 - 46: + 70: # old action num: 46 action: "NETWORK_NIC_DISABLE" options: node_id: 4 nic_id: 0 - 47: + 71: # old action num: 47 action: "NETWORK_NIC_ENABLE" options: node_id: 4 nic_id: 0 - 48: + 72: # old action num: 48 action: "NETWORK_NIC_DISABLE" options: node_id: 4 nic_id: 1 - 49: + 73: # old action num: 49 action: "NETWORK_NIC_ENABLE" options: node_id: 4 nic_id: 1 - 50: + 74: # old action num: 50 action: "NETWORK_NIC_DISABLE" options: node_id: 5 nic_id: 0 - 51: + 75: # old action num: 51 action: "NETWORK_NIC_ENABLE" options: node_id: 5 nic_id: 0 - 52: + 76: # old action num: 52 action: "NETWORK_NIC_DISABLE" options: node_id: 6 nic_id: 0 - 53: + 77: # old action num: 53 action: "NETWORK_NIC_ENABLE" options: node_id: 6 nic_id: 0 + options: nodes: - node_name: domain_controller From 0d490d618cb70b9a194c041af09c2f8643d023f9 Mon Sep 17 00:00:00 2001 From: Marek Wolan Date: Sun, 3 Mar 2024 16:59:14 +0000 Subject: [PATCH 4/4] Update MARL config --- .../example_config_2_rl_agents.yaml | 96 +++++++++++++++---- 1 file changed, 78 insertions(+), 18 deletions(-) diff --git a/src/primaite/config/_package_data/example_config_2_rl_agents.yaml b/src/primaite/config/_package_data/example_config_2_rl_agents.yaml index fd5a3092..e8f271df 100644 --- a/src/primaite/config/_package_data/example_config_2_rl_agents.yaml +++ b/src/primaite/config/_package_data/example_config_2_rl_agents.yaml @@ -36,6 +36,11 @@ agents: - ref: client_2_green_user team: GREEN type: probabilistic_agent + agent_settings: + action_probabilities: + 0: 0.3 + 1: 0.6 + 2: 0.1 observation_space: type: UC2GreenObservation action_space: @@ -47,24 +52,38 @@ agents: - node_name: client_2 applications: - application_name: WebBrowser + - application_name: DatabaseClient max_folders_per_node: 1 max_files_per_folder: 1 max_services_per_node: 1 - max_applications_per_node: 1 + max_applications_per_node: 2 + action_map: + 0: + action: DONOTHING + options: {} + 1: + action: NODE_APPLICATION_EXECUTE + options: + node_id: 0 + application_id: 0 + 2: + action: NODE_APPLICATION_EXECUTE + options: + node_id: 0 + application_id: 1 reward_function: reward_components: - type: DUMMY - agent_settings: - start_settings: - start_step: 5 - frequency: 4 - variance: 3 - - ref: client_1_green_user team: GREEN type: probabilistic_agent + agent_settings: + action_probabilities: + 0: 0.3 + 1: 0.6 + 2: 0.1 observation_space: type: UC2GreenObservation action_space: @@ -76,10 +95,26 @@ agents: - node_name: client_1 applications: - application_name: WebBrowser + - application_name: DatabaseClient max_folders_per_node: 1 max_files_per_folder: 1 max_services_per_node: 1 - max_applications_per_node: 1 + max_applications_per_node: 2 + action_map: + 0: + action: DONOTHING + options: {} + 1: + action: NODE_APPLICATION_EXECUTE + options: + node_id: 0 + application_id: 0 + 2: + action: NODE_APPLICATION_EXECUTE + options: + node_id: 0 + application_id: 1 + reward_function: reward_components: - type: DUMMY @@ -87,6 +122,7 @@ agents: + - ref: data_manipulation_attacker team: RED type: RedDatabaseCorruptingAgent @@ -671,6 +707,14 @@ agents: weight: 0.33 options: node_hostname: client_2 + - type: GREEN_ADMIN_DATABASE_UNREACHABLE_PENALTY + weight: 0.1 + options: + node_hostname: client_1 + - type: GREEN_ADMIN_DATABASE_UNREACHABLE_PENALTY + weight: 0.1 + options: + node_hostname: client_2 agent_settings: @@ -1223,6 +1267,14 @@ agents: weight: 0.33 options: node_hostname: client_2 + - type: GREEN_ADMIN_DATABASE_UNREACHABLE_PENALTY + weight: 0.1 + options: + node_hostname: client_1 + - type: GREEN_ADMIN_DATABASE_UNREACHABLE_PENALTY + weight: 0.1 + options: + node_hostname: client_2 agent_settings: @@ -1241,8 +1293,8 @@ simulation: nodes: - ref: router_1 - type: router hostname: router_1 + type: router num_ports: 5 ports: 1: @@ -1277,18 +1329,18 @@ simulation: protocol: ICMP - ref: switch_1 - type: switch hostname: switch_1 + type: switch num_ports: 8 - ref: switch_2 - type: switch hostname: switch_2 + type: switch num_ports: 8 - ref: domain_controller - type: server hostname: domain_controller + type: server ip_address: 192.168.1.10 subnet_mask: 255.255.255.0 default_gateway: 192.168.1.1 @@ -1300,8 +1352,8 @@ simulation: arcd.com: 192.168.1.12 # web server - ref: web_server - type: server hostname: web_server + type: server ip_address: 192.168.1.12 subnet_mask: 255.255.255.0 default_gateway: 192.168.1.1 @@ -1317,8 +1369,8 @@ simulation: - ref: database_server - type: server hostname: database_server + type: server ip_address: 192.168.1.14 subnet_mask: 255.255.255.0 default_gateway: 192.168.1.1 @@ -1332,8 +1384,8 @@ simulation: type: FTPClient - ref: backup_server - type: server hostname: backup_server + type: server ip_address: 192.168.1.16 subnet_mask: 255.255.255.0 default_gateway: 192.168.1.1 @@ -1343,8 +1395,8 @@ simulation: type: FTPServer - ref: security_suite - type: server hostname: security_suite + type: server ip_address: 192.168.1.110 subnet_mask: 255.255.255.0 default_gateway: 192.168.1.1 @@ -1355,8 +1407,8 @@ simulation: subnet_mask: 255.255.255.0 - ref: client_1 - type: computer hostname: client_1 + type: computer ip_address: 192.168.10.21 subnet_mask: 255.255.255.0 default_gateway: 192.168.10.1 @@ -1373,13 +1425,17 @@ simulation: type: WebBrowser options: target_url: http://arcd.com/users/ + - ref: client_1_database_client + type: DatabaseClient + options: + db_server_ip: 192.168.1.14 services: - ref: client_1_dns_client type: DNSClient - ref: client_2 - type: computer hostname: client_2 + type: computer ip_address: 192.168.10.22 subnet_mask: 255.255.255.0 default_gateway: 192.168.10.1 @@ -1396,6 +1452,10 @@ simulation: data_manipulation_p_of_success: 0.8 payload: "DELETE" server_ip: 192.168.1.14 + - ref: client_2_database_client + type: DatabaseClient + options: + db_server_ip: 192.168.1.14 services: - ref: client_2_dns_client type: DNSClient