Formal Technical Inspection. Using CLIPS to Detect Network Intrusions - (CLIPNIDS)

Transcription

1 Formal Technical Inspection Using CLIPS to Detect Network Intrusions - (CLIPNIDS) Submitted in partial fulfillment of the requirements of the degree of MSE Sripriya Marry CIS 895 MSE Project Computing and Information Sciences Kansas State University Committee Members Dr. David Gustafson (Major Professor) Dr. Rodney Howell Dr. Mitchell Neilsen 1

2 Change Log Version # Changed By Release Date Change Description Version 1.0 Sripriya Marry 04/03/2012 Initial Release 2

3 Table of Contents 1. Introduction Items to be Inspected Formal Inspectors Formal Inspection List

4 1. Introduction This document provides a checklist to be used in the technical inspection of Clipnids project. It lays out broad guidelines for the technical inspectors to ensure that the Architectural Design Document and the USE formal specification model are complete, correct and consistent. 2. Items to be inspected Technical inspectors refer Vision Document and Clipnids paper published by the author for technical inspection. 1. System Architecture Design a) Architecture Design section 2.2 b) Interface definitions and descriptions in section 2.3, Table 1, Table 1, Table 3. c) Components Architecture in section 3.1, section 3.2, section 3.3, Table 4 and Table 5 b) Data Model Diagram section 5 c) Sequence Diagrams section 4 2. Formal Specification Section 6 3. Formal Inspectors Tristan Baruth (tristan.baruth@gmail.com) Petrit Duraku (petrit.duraku@gmail.edu) 4. Formal Inspection List Inspection Item /Fail Comment The architecture of the project explained clearly by identifying the design pattern applicable to it along with the supporting reasons. 1. Consider reworking Diagram 2.1 into a UML Deployment Diagram. 2. Be sure labels on components match names used in headers/paragraphs of Section 2. Component Architecture of DQA Library describes its interaction with other components and the interface it implements to offer its service (Section 3.1) Component Architecture of Packet Decoder describes its interaction with other components and the interface it implements to offer its service (Section 3.2) 4 1. UML model shows inheritance. This should show realization. 2. Use appropriate UML 2.0 parameter specifications (IE daq_find_module(type : string) : DAQ_Mode, not daq_find_module(string type) : DAQ_Mode) in methods. 1. Be sure to proofread. I m noticing errors like ehternet that can be caught by spell checkers.

5 Component Architecture of Packet Preprocessor describes its interaction with other components and the interface it implements to offer its service (Section 3.3) Component Architecture of Clips detection engine describes its interaction with other components and the interface it implements to offer its service and it s functionality in Table 4. Component Architecture of Alerting at console describes its interaction along with its functionality in Table 5. DAQ interface is explained sufficiently in Table 1. Decoder interface is explained sufficiently in Table 2. Preprocessor interface is explained sufficiently in Table 3. Data model for the project identified correctly in Section 5. Fail 2. UML model shows association and inheritance instead of realization and uses. 1. Ensure screenshots don t flow onto the margins of the page. 1. Fix screenshot flowing into margin; also sharpen it (it s difficult to read/blurry) 2. For clarity purposes: You ve switched from describing interfaces (Section ) to describing components (Section 3.4 and 3.5). This is an abrupt and subtle change in the document that left me confused. The MSE requirements state that we must document at the interface level. Make this change in writing process more apparent to the reader (for instance, split the table into two, one describing the interface, one describing the remaining component methods), or add methods to the interfaces in Section 3.4 and 3.5 if that s actually necessary. 1. This is obviously a diagram of a packet, and CLIPNIDS captures packets, but you may want to provide a more thorough textual 5

6 Do the symbols used in class diagram conform to UML 2.0? Does the sequence diagram for Clipnids initialization is unambiguous and understandable (it adheres to the architecture of Clipnids) in Section 4.1 Does the sequence diagram for Clipnids packet is unambiguous and understandable (it adheres to the architecture of Clipnids) in section 4.2. Do the symbols used in sequence diagram conform to UML 2.0? Formal specification of Clipnids was done in accordance with its architecture in Figure 5. All the multiplicities and associations in the OCL model have been depicted in the class diagram Figure 5. Fail description of the data model(s) used by CLIPNIDS for clarity purposes. 2. The description specifically states that only one kind of header is possible. This UML diagram allows multiple kinds of headers. You need to utilize inheritance of a header and compose that header or use some UML xor association constraints (the former option is probably preferable). 1. I ve noted a number of errors in the UML models in other comments. You need to go back and correct these before your presentation. 2. UX: The blue lookand-feel of the Visual Paradigm UML diagrams won t print cleanly. Make it more printer-friendly (such as white/black). However, I do not see these methods inside of your component diagram or tables. What does the initialization step do? Word wrapping on some of the lifeline heads makes these difficult to read. Also, flowing into margins again. Easy fix. 1. It might be clearer to specify lifelines having the same headers as the components in the sequence diagrams. 6

7 General Comments: 1. UML diagrams need work to conform to standards before the architectural description document can be acceptable. 2. The portfolio requirements on the CIS MSE website ( states that reuse of commercial, or pre-existing components will be documented. While you have mentioned that this project builds upon pre-existing work, I do not know what you wrote and what composes the pre-existing material from the CLIPNIDS project. Consult with your major professor on how much documentation is needed on this topic. 3. Provide more textual plain English documentation of the architecture if possible. For instance, how is the data model used? Are certain fields on a packet useful for CLIPNIDS? Also, section 3 is confusing how it switches from interface descriptions to component descriptions between Section 3.3 and Section 3.4 (Tables 1-3 vs Table 4 and 5). The table of contents and the headers of each section suggests that you are describing components. Either describe components or describe interfaces in this section. 4. Please proofread and correct the formatting issues within the architectural description. 7