Slides about the state monitoring API.

1. Module Configuring
MILS Monitoring System
State Monitoring
Kaspersky Lab UK Module Configuring - Module Configuring - State Monitoring 1

2.  First level text
 Second level text
● Third level text
 Fourth level text
 Fifth level text
Kaspersky Lab UK Module Configuring - Module Configuring - State Monitoring 2
Prerequisites

3. API for Configuring a
State Monitoring Application
Kaspersky Lab UK Module Configuring - Module Configuring - State Monitoring 3

4.  Generates a monitor for every FDIR
component
 A sensor is generated for every input
port of the component
 MonitoringProperty LTL formulas are
converted into KSS policies
 Final C monitor library is generated for
all the FDIR components
Kaspersky Lab UK Module Configuring - Module Configuring - State Monitoring 4
Monitoring Library Generator

5. Toolset architecture
Kaspersky Lab UK Module Configuring - Module Configuring - State Monitoring 5

6. ● void stmon_init(void);
Initialize monitoring library.
● void stmon_fini(void);
Finalize monitoring library.
● void stmon_reconfigure(void);
Poll for reconfiguration commands from
the configuration plane.
● void stmon_init_cmdline(int argc, char *argv[]);
Initialize monitoring library with
common command line arguments.
Kaspersky Lab UK Module Configuring - Module Configuring - State Monitoring 6
Generic API

7. ● void stmon_set_adaptation_engine(const char
*host, const char *port);
Set adaptation engine host address.
● void stmon_set_context_awareness(const char
*host, const char *port);
Set context awareness host address.
● void stmon_set_configuration_plane(const char
*host, const char *port);
Set configuration plane host address.
● int stmon_get_configuration_plane_fd(void);
Get configuration plane socket. May be used for
reconfiguration polling.
Kaspersky Lab UK Module Configuring - Module Configuring - State Monitoring 7
CITADEL API

8. ● void stmon_time_set(stmon_time_t time);
Set current model time. Time must be monotonically
increasing.
● stmon_time_t stmon_time_get(void);
Get current model time.
 STMON_TIME_MSEC(msec) — convert milliseconds to
internal time.
 STMON_TIME_SEC(sec) — convert seconds to internal
time.
 STMON_TIME_MIN(min) — convert minutes to internal
time.
 STMON_TIME_HOUR(hour) — convert hours to internal
time.
 STMON_TIME_DAY(day) — convert days to internal time.
Kaspersky Lab UK Module Configuring - Module Configuring - State Monitoring 8
Time API

9. ● void update_<PACKAGE>_<COMPONENT>_<SENSOR>(<SENSOR_TYPE> value);
Update sensor value.
 <PACKAGE> — SLIM package name.
 <COMPONENT> — FDIR component
name.
 <SENSOR> — input port name.
 <SENSOR_TYPE> — input port type.
Kaspersky Lab UK Module Configuring - Module Configuring - State Monitoring 9
Sensor API

10. ● <PACKAGE>_<COMPONENT>
*new_<PACKAGE>_<COMPONENT>(void);
Create an instance of a model.
● void
free_<PACKAGE>_<COMPONENT>(<PACKAGE>_<COMPONENT>
*model);
Free an instance of a model.
● void
check_<PACKAGE>_<COMPONENT>(<PACKAGE>_<COMPONENT>
*model);
Check all monitoring properties of a model, raising alarms if
any violated.
 <PACKAGE> — SLIM package name.
 <COMPONENT> — FDIR component name.
Kaspersky Lab UK Module Configuring - Module Configuring - State Monitoring 10
Model API

11. Example (SLIM model)
package Model public
system HeartbeatMonitor
features
heartbeat: in event port;
prop: out event port {
Alarm => true;
MonitoringProperty => “always (time_since(heartbeat) <= 1 sec”;
};
properties FDIR => true;
end HeartbeatMonitor;
11

12. Example (Initialization)
int main(int argc, char *argv[])
{
stmon_init_cmdline(argc, argv);
Model_HeartbeatMonitor *mon = new_Model_HeartbeatMonitor();
/* MONITORING LOOP */
free_Model_HeartbeatMonitor(mon);
return 0;
}
12

13. Example (Monitoring loop)
while (true) {
stmon_time_set(STMON_TIME_SEC(time(NULL)));
if (system_alive())
update_Model_HeartbeatMonitor_heartbeat();
check_Model_HeartbeatMonitor();
stmon_reconfigure();
}
13

14. Support sensor/alarm SLIM types
● boolean
● int
● real
● continuous
● clock
● enum(<NAME>...)
● (<TYPE>...)
14

15. ● Arithmetic (+, -, *, /, %)
● Comparison (>, <, >=, <=, =, !=)
● Logical (and, or, xor, xnor, not,
iff, imp, implies)
● Temporal (always, future, until,
next, then)
● Time (time_since)
● Data (last_data, data)
● Event triggers (rise, fall, change)
● Time suffixes (msec, sec, min, hour,
day)
Kaspersky Lab UK Module Configuring - Module Configuring - State Monitoring 15
Supported SLIM LTL operators

16. [1] CITADEL D4.4 MILS Monitoring System
[2] CITADEL D3.3 CITADEL Design Techniques to
Specify, Verify, and Synthesize Policies for Run-Time
Monitors
[3] CITADEL D4.5 Integrated and tested Adaptive
MILS Platform
[4] CITADEL. D4.3 MILS adaptation system
[5] Advanced Technical Module - State Monitoring.
D6.6 Training Materials for Electronic Delivery
Kaspersky Lab UK Module Configuring - Module Configuring - State Monitoring 16
Related reading