Subject: Data Model/DTD Questions (Message 2 of 4)

From: "David A. Curry" <[email-masked]>
Date: Wed, 03 Jan 2001 13:59:49 -0500

The following questions have come up during the process of revising the data
model and DTD, and need to be discussed as well.

1. The <CorrelationAlert> and <ToolAlert> elements each express relationships
   between multiple alerts.  But neither of them seem to "fit" well into the
   model where they are now (for example, do <Classification>, <Source>, and
   <Target> have any meaning in the context of a <CorrelationAlert> or a
   <ToolAlert>).

   Is there a common abstraction to replace these two elements?  For example:

   	<AlertAssociation>
	   <relationship>
	      "attack tool," "recon sweep," etc.
	   </relationship>
	   <data>
	      tool name, command, etc.
	   </data>
	   <alertid>
	      id of a related alert
	   </alertid>
	   <alertid>
	      id of another related alert
	   </alertid>
	   ...
	</AlertAssociation>

   Furthermore, should <Alert> be defined as an "either-or" sort of thing in
   which it's either a "plain" alert with <Classification>, <Source>, and
   <Target> or an "association" alert with <AlertAssociation>, like this:

   	<!ELEMENT Alert			(
	    Analyzer, CreateTime, DetectTime?, AnalyzerTime?,
	    (AlertAssociation | (Classification+, Source*, Target*),
	    AdditionalData*
	  )>

2. <OverflowAlert> doesn't seem to fit very well either, in that its very
   presence indicates the attack method.  Further, the attack method and
   the value of the <program> element can usually be determined indirectly
   through <Classification>, and are somewhat redundant.  The <size> and
   <buffer> elements provide more detail than is perhaps warranted, and
   since many analyzers have no way to obtain their values, they may make
   more sense relegated to <AdditionalData>.

3. <WebService> and <SNMPService> seem kind of "special-case-ish" as well.
   Is there some kind of generalized representation (like the above for
   alert associations) we can use for this kind of thing?

--- end of message ---