Commit 282c5bab authored by yorn's avatar yorn

Turned in

parent 3dad55b6
\pagestyle{empty}
\begin{abstract}
\noindent Anomaly detection in internet traffic is currently largely based on quantifying traffic data.
\noindent Anomaly detection in internet traffic today is largely based on quantifying traffic data.
This thesis proposes a new algorithm SpreadRank,
which detects spreading of traffic on the internet.
Spreading can be used as an additional metric for traffic anomaly detection, and can be observed from large scale traffic logs from core routers.
Studying spreading is a useful tool in determining the role of an end-host and identifying malicious behaviour.
SpreadRank uses large scale graph processing to calculate spreading from multiple gigabytes of traffic data.
which detects spreading of internet traffic as an additional metric for traffic anomaly detection.
SpreadRank uses large scale graph processing to calculate spreading from multiple gigabytes of NetFlow data obtained from core routers.
Studying spreading is a useful tool in determining the role of an end-host and in identifying malicious behaviour.
\end{abstract}
\pagestyle{empty}
\renewcommand{\abstractname}{Sammendrag}
\begin{abstract}
\noindent NORWEGIANABSTRACT
\noindent Anomalideteksjon i nettrafikk i dag er stortsett basert på mengder trafikk.
Denne avhandlingen introduserer en ny algoritme SpreadRank,
som vil detektere spredning i nettrafikk som et ekstra målepunkt for anomalideteksjon.
SpreadRank vil bruke flere gigabytes i NetFlow logg fra core-rutere i storskala grafprosessering for å beregne spredning.
Spredning er et nyttig verktøy for å undersøke hva slags rolle en datamaskin på nettet har og for å finne skadelig oppførsel.
\end{abstract}
\ No newline at end of file
This diff is collapsed.
......@@ -7,13 +7,13 @@ This appendix will show the commands used to convert NetFlow to \gls{csv},
start SpreaRank with these \gls{csv} files,
and filter the results.
\newpage
\section{Convert NetFlow to CSV}
NetFlow can be converted to a \gls{csv} file, with non-UDP and non-TCP flows filtered out, as well as flows between port numbers that are both over 1024.
This conversion is done using FlowConvert.sh, but in order to generate separate \gls{csv} files, FlowConvert must be run for each timeframe that a \gls{csv} file should span.
This conversion is done using FlowConvert.sh, though in order to generate separate \gls{csv} files, FlowConvert must be run for each time frame that a \gls{csv} file should span.
This snippet of \gls{bash} code will run FlowConvert.sh 31 times, for every day of the month.
The end result will be a directory named \verb"trd_gw1_12_filtered.csv" with 31 files.
\subsection{NetflowCSVEdgeInputFormat.java}
\begin{verbatim}
seq 1 9 | while read nr
do
......@@ -25,10 +25,14 @@ The end result will be a directory named \verb"trd_gw1_12_filtered.csv" with 31
done
\end{verbatim}
\newpage
\section{Execute SpreadRank}
In order to execute SpreadRank on YARN,
YARN must be started with the SpreadRank jarfile,
and the full qualified class-name of the computation class.
the application must be submitted to the YARN manager,
so that it can deploy the SpreadRank jar file to all workers.
The command takes as arguments the path of the jar file,
and the fully qualified class-name of both Giraph.
Giraph takes the fully qualified class-name of the SpreadRank computation class.
Additionally, a format for reading the graph at the start, and writing the graph at the end must be provided.
In this case, we use a directory to store the graph data.
The directory contains chunks of the full graph.
......@@ -47,4 +51,42 @@ The directory contains chunks of the full graph.
\end{verbatim}
\newpage
\section{Filter results}
The raw results from SpreadRank, even though outputted by a custom \verb"OutputFormat", contain a lot of information that is not relevant.
This simple \gls{bash} script will remove all vertices with a \gls{depth} of 1 or less, and all vertices with no spreading or no clients.
The program is built using these components:
\begin{itemize}[label={$\bullet$}]
\item \verb"cat": concatenate all parts of the output
\item \verb"grep": filter out all values equal to 0 or 1
\item \verb"sort": make sure that the highest spreading is returned first
\item \verb"sed": anonymize the results by removing IP addresses though keeping port numbers
\item \verb"less": easier reading of the results in a terminal
\end{itemize}
Components can taken out if desired, to change the results.
Total execution time of this command on one month worth of NetFlow data took about 10\~15~seconds on UNINETT's server cluster.
\begin{verbatim}
cat rank-out/IPSpreadRank_gw1_12/part-m-* | egrep -vw '[01]' | sort -hrk 3 | sed 's/^.*://' | less
\end{verbatim}
\newpage
\section{Aggregate}
This \gls{bash} script can be used to determine how often a protocol engages in spreading.
It will output two numbers per line, the second being the protocol number, the first being the amount of services observed.
The program is built using these components:
\begin{itemize}[label={$\bullet$}]
\item \verb"cat": concatenate all parts of the output
\item \verb"grep": filter out all values equal to 0 or 1
\item \verb"sed": remove IP addresses, otherwise the list would show all IP addresses with count 1
\item \verb"cut": remove all but the first value (port number)
\item \verb"sort": set the port numbers in order, required for \verb"uniq".
\item \verb"uniq": aggregate the port numbers, and show count
\end{itemize}
Total execution time of this command on one month worth of NetFlow data took about 10\~15~seconds on UNINETT's server cluster.
\begin{verbatim}
cat rank-out/IPSpreadRank_gw1_12/part-m-* | egrep -vw '[01]' | sed 's/^.*://' | cut -f1 | sort | uniq -c
\end{verbatim}
\end{landscape}
......@@ -5,7 +5,7 @@ This thesis has stated the current practices in traffic anomaly detection.
Current traffic anomaly detection is based on aggregating flows,
or by identifying high-intensity traffic.
The thesis defines the concept of spreading,
which describes the phenomenon of an end-host initiating the same kind of connections it receives,
which describes the phenomenon of a host initiating the same kind of connections it receives,
where same-kind refers to usage of the same TCP/UDP ports.
It is argued that spreading is uncommon for most protocols on the internet today, which makes it an anomaly.
......@@ -21,28 +21,29 @@ Every service is scored on its longest path towards another service (\gls{depth}
and on how far it spreads its traffic (\gls{spreading}).
An analysis of the results shows that only five percent of all \emph{\gls{service}s} participate in \emph{\gls{spreading}},
and that for most end-hosts their role can be determined by simply looking at their spreading.
A spreading of zero typically indicates a server, one typically indicates a client (its traffic reaches to the servers) and a spreading of two often indicates a hybrid, but it can also indicate a simple proxy server.
and that for many hosts, their role can be determined by simply looking at their spreading.
A spreading of zero typically indicates a server, one typically indicates a client (its traffic reaches to the servers) and a spreading of two often indicates a combination of both, though it can also indicate a simple proxy server.
Some protocols have natural spreading, for example \gls{BGP}, \gls{DNS} and \gls{SMTP};
implementations of these protocols are often both server and client.
\Gls{SSH} and \gls{HTTP} are popular protocols which do not have natural spreading,
but do exhibit spreading nevertheless.
implementations of these protocols behave often both as server and client.
\Gls{SSH} and \gls{HTTP} are popular protocols which do not have natural spreading;
however, these protocols exhibit spreading nevertheless.
\Gls{HTTP} has a high \gls{spreading} due to it being a protocol that is used for multiple purposes.
An \gls{HTTP} \gls{service} may itself use \gls{HTTP} to connect to another \gls{service}.
\Gls{SSH} allows users to ``hop'' from one SSH server to another.
Additionally, many home servers will listen on these ports.
SpreadRank has been successful in identifying spreading, and in doing so can be successfully used to find DNS resolvers,
BGP routers and mail servers on the network.
It has also been successful in finding hosts that participated in a botnet.
It does so based on NetFlow data from core routers, without sending data into the network itself.
\section{Future work}
\subsection{Automation}
The current implementation of SpreadRank requires the analyst to provide many manual steps.
A better EdgeInputReader would reduce the amount of conversions needed,
The current implementation of SpreadRank requires the analyst to execute many manual steps.
A better \verb"EdgeInputFormat" would reduce the amount of conversions needed,
and speed up the overall process.
The output could be parsed to automatically find outliers.
The output could then be parsed to automatically find outliers.
\subsection{Test-data}
It was not known beforehand which attacks were present in the test-data.
......@@ -56,7 +57,7 @@ For a real-life application, real-time monitoring is required,
In order to work with real-time data, a sliding window is required,
in which flows are added to the graph as they are observed,
and old flows are removed.
Giraph does not currently support this, but systems that support this do exist, for example GraphX.
Giraph does not currently support this; however, systems that support this do exist, for example GraphX.
\subsection{IPv6}
The NetFlow data provided by UNINETT contains only flows between IPv4 hosts.
......@@ -67,6 +68,6 @@ Where many home servers currently share their public IPv4 address with clients d
IPv6 makes it possible to run the server and client on different IPv6 addresses.
Additionally, the use of privacy extensions in IPv6 (a technology that lets clients randomise their IP address for anonymity) will prove to be both a challenge and an advantage for SpreadRank.
It is a challenge because it will lead to more vertices; in the current model every observed IP address + port number is a vertex, which means that a new vertex is created every time a client switches IP address.
It is a challenge because it will lead to more vertices; in the current model, every observed IP address + port number pair is a vertex, which means that a new vertex is created every time a client switches IP address.
Randomised IP addresses are also an advantage, because it is not feasible to run a server on a randomised IP address.
This may make it easier to designate vertices as clients at a very early stage, which reduces computation time.
\begin{landscape}
\chapter{Diagrams}
\section{SpreadRank results}
\begin{figure}[h!]
\chapter{SpreadRank results}
\label{chp:diagrams}
This appendix contains diagrams of SpreadRank being executed on NetFlow logs from one of UNINETT's core routers.
These diagrams are made using different periods of NetFlow logs from the same core router.
\begin{figure}[h]
\caption{Vertices scored with SpreadRank using one day of flows}
\label{fig:1day}
\centering
\includegraphics[width=1.3\textwidth]{1day}
\includegraphics[width=1.4\textwidth]{1day}
\end{figure}
\begin{figure}[h!]
\begin{figure}[h]
\caption{Vertices scored with SpreadRank using one week of flows}
\label{fig:7day}
\centering
\includegraphics[width=1.3\textwidth]{7day}
\includegraphics[width=1.4\textwidth]{7day}
\end{figure}
\begin{figure}[h!]
\begin{figure}[h]
\caption{Vertices scored with SpreadRank using two weeks of flows}
\label{fig:14day}
\centering
\includegraphics[width=1.3\textwidth]{14day}
\includegraphics[width=1.4\textwidth]{14day}
\end{figure}
\begin{figure}[h!]
\begin{figure}[h]
\caption{Vertices scored with SpreadRank using one month of flows}
\label{fig:31day}
\centering
\includegraphics[width=1.3\textwidth]{31day}
\includegraphics[width=1.4\textwidth]{31day}
\end{figure}
\end{landscape}
......@@ -3,11 +3,11 @@
To test Giraph, two simple algorithms, DOSRank and ReverseDOSRank are created, which count the amount of respectively incoming and outgoing edges from or to a vertex.
This proof of concept will count the amount of flows per \gls{service}.
It can be used to detect if a machine is executing or suffering from a DoS attack,
It can be used to detect if a machine is executing or suffering from a \gls{DoS} attack,
as these are typically identified by a large number of flows.
These two algorithms will count respectively the amount of outgoing and the amount of incoming edges.
DOSRank (equation~\ref{eq:dosrank}, algorithm~\ref{alg:dosrank}), which will calculate outgoing edges (incoming connections) is trivial; it will set its value during the first superstep and vote to halt.
ReverseDOSRank (equation~\ref{eq:reversedosrank}, algorithm~\ref{alg:reversedosrank}) is a bit more complex;
DOSRank~(\ref{eq:dosrank}), which will calculate outgoing edges (incoming connections) is trivial; it will set its value during the first superstep and then vote to halt.
ReverseDOSRank~(\ref{eq:reversedosrank}) is a bit more complex;
since incoming edges are not visible in Giraph, the first superstep is used to send a message over every edge.
During the second superstep, every vertex will receive an amount of messages that is equal to its amount of incoming edges.
......@@ -21,17 +21,17 @@ During the second superstep, every vertex will receive an amount of messages tha
f(y) = N^{+}(y).
\end{equation}
\begin{algorithm}[H]
\label{alg:dosrank}
\begin{algorithm}[h]
\caption{DOSRank}
\label{alg:dosrank}
\begin{verbatim}
result = vertex.getNumEdges();
vertex.voteToHalt();
\end{verbatim}
\end{algorithm}
\begin{algorithm}[H]
\label{alg:reversedosrank}
\begin{algorithm}[h]
\caption{ReverseDOSRank}
\label{alg:reversedosrank}
\begin{verbatim}
if superstep = 0 then
begin
......@@ -55,15 +55,15 @@ The algorithm will find IP addresses that are associated with large amounts of f
Opening a large amount of flows is different from sending large amounts of data,
as sending a large amount of data is often a completely legitimate thing to do:
For example, sharing files via peer-to-peer protocols or serving large files over HTTP.
A large amount of flows, however, may be an indication that something is amiss.
It can indicate port scanning, or even targeted attacks like SYN flooding.
However, a large amount of flows can also simply indicate a very active or popular host.
A large amount of flows; however, may be an indication that something is amiss.
It can indicate port scanning, or even targeted attacks like SYN flooding;
however, a large amount of flows can also simply indicate a very active or popular host.
\section{Purpose}
These algorithms are just a proof-of-concept to show that graph systems can be used for traffic analysis.
The algorithm itself is most likely easier to implement using other systems.
A simple MapReduce algorithm could probably yield the same results a smaller amount of time~\cite{Morken352472}.
However, this algorithm does show that Giraph can be used for traffic analysis,
A simple MapReduce algorithm could probably yield the same results a smaller amount of time~\cite{Morken352472};
however, this algorithm does show that Giraph can be used for traffic analysis,
and it opens the door for more complex algorithms, like SpreadRank.
No preview for this file type
No preview for this file type
No preview for this file type
No preview for this file type
No preview for this file type
No preview for this file type
No preview for this file type
......@@ -138,11 +138,11 @@
borderlayer="false"
showborder="true"
objecttolerance="20"
inkscape:window-width="1855"
inkscape:window-width="1853"
inkscape:window-height="1156"
inkscape:window-x="65"
inkscape:window-x="67"
inkscape:window-y="0"
inkscape:window-maximized="1">
inkscape:window-maximized="0">
<inkscape:grid
type="xygrid"
id="grid3128"
......@@ -168,6 +168,17 @@
inkscape:groupmode="layer"
id="layer1"
transform="translate(0,-308.2677)">
<path
style="opacity:1;fill:none;stroke:#aaaaaa;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 80,452.36218 0,40 280,0 0,200 280,0 0,80 280,0"
id="path3015"
inkscape:connector-curvature="0" />
<path
style="opacity:1;fill:none;stroke:#bfbfbf;stroke-width:6;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0;marker-end:url(#Arrow2Mend)"
d="m 80,612.36218 270,0"
id="path6784"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cc" />
<path
sodipodi:type="arc"
id="path3130"
......@@ -180,7 +191,7 @@
style="fill:#ffffff;fill-opacity:1;stroke:#000000;stroke-width:6;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none" />
<path
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 80,1012.3622 0,-560.00004 0,0 0,0"
d="m 80,832.36218 0,-380.00002 0,0 0,0"
id="path3136"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cccc" />
......@@ -197,7 +208,7 @@
<path
inkscape:connector-curvature="0"
id="path4020"
d="m 360,1012.3622 0,-560.00002 0,0 0,0"
d="m 360,832.36218 0,-380 0,0 0,0"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
sodipodi:nodetypes="cccc" />
<path
......@@ -213,7 +224,7 @@
<path
sodipodi:nodetypes="cccc"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 640,1012.3622 0,-560.00002 0,0 0,0"
d="m 640,832.36218 0,-380 0,0 0,0"
id="path4024"
inkscape:connector-curvature="0" />
<path
......@@ -222,12 +233,6 @@
id="path4026"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cc" />
<path
style="opacity:0.25;fill:none;stroke:#000000;stroke-width:6;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0;marker-end:url(#Arrow2Mend)"
d="m 80,612.36218 270,0"
id="path6784"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cc" />
<path
sodipodi:nodetypes="cc"
inkscape:connector-curvature="0"
......@@ -247,7 +252,7 @@
<path
inkscape:connector-curvature="0"
id="path6857"
d="m 920,1012.3622 0,-560.00002 0,0 0,0"
d="m 920,832.36218 0,-380 0,0 0,0"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
sodipodi:nodetypes="cccc" />
<path
......@@ -256,10 +261,5 @@
id="path6859"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cc" />
<path
style="opacity:0.33000003999999999;fill:none;stroke:#000000;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;"
d="m 80,452.36218 0,40 280,0 0,200 280,0 0,80 280,0"
id="path3015"
inkscape:connector-curvature="0" />
</g>
</svg>
......@@ -168,6 +168,23 @@
inkscape:groupmode="layer"
id="layer1"
transform="translate(0,-308.2677)">
<path
style="opacity:1;fill:none;stroke:#aaaaaa;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 80,452.36218 0,40 280,0 0,200 280,0"
id="path3057"
inkscape:connector-curvature="0" />
<path
style="opacity:1;fill:none;stroke:#bfbfbf;stroke-width:6;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0;marker-end:url(#Arrow2Mend)"
d="m 80,612.36218 270,0"
id="path6784"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cc" />
<path
sodipodi:nodetypes="cc"
inkscape:connector-curvature="0"
id="path3055"
d="m 640,772.36218 270,0"
style="opacity:1;fill:none;stroke:#bfbfbf;stroke-width:6;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0;marker-end:url(#Arrow2Mend)" />
<path
sodipodi:type="arc"
id="path3130"
......@@ -180,7 +197,7 @@
style="fill:#ffffff;fill-opacity:1;stroke:#000000;stroke-width:6;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none" />
<path
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 80,1012.3622 0,-560.00004 0,0 0,0"
d="m 80,832.36218 0,-380.00002 0,0 0,0"
id="path3136"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cccc" />
......@@ -197,7 +214,7 @@
<path
inkscape:connector-curvature="0"
id="path4020"
d="m 360,1012.3622 0,-560.00002 0,0 0,0"
d="m 360,832.36218 0,-380 0,0 0,0"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
sodipodi:nodetypes="cccc" />
<path
......@@ -213,7 +230,7 @@
<path
sodipodi:nodetypes="cccc"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 640,1012.3622 0,-560.00002 0,0 0,0"
d="m 640,832.36218 0,-380 0,0 0,0"
id="path4024"
inkscape:connector-curvature="0" />
<path
......@@ -222,12 +239,6 @@
id="path4026"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cc" />
<path
style="opacity:0.25;fill:none;stroke:#000000;stroke-width:6;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0;marker-end:url(#Arrow2Mend)"
d="m 80,612.36218 270,0"
id="path6784"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cc" />
<path
sodipodi:nodetypes="cc"
inkscape:connector-curvature="0"
......@@ -247,7 +258,7 @@
<path
inkscape:connector-curvature="0"
id="path6857"
d="m 920,1012.3622 0,-560.00002 0,0 0,0"
d="m 920,832.36218 0,-380 0,0 0,0"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
sodipodi:nodetypes="cccc" />
<path
......@@ -256,16 +267,5 @@
id="path3051"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cc" />
<path
sodipodi:nodetypes="cc"
inkscape:connector-curvature="0"
id="path3055"
d="m 640,772.36218 270,0"
style="opacity:0.25;fill:none;stroke:#000000;stroke-width:6;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0;marker-end:url(#Arrow2Mend)" />
<path
style="opacity:0.33000003999999999;fill:none;stroke:#000000;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;"
d="m 80,452.36218 0,40 280,0 0,200 280,0"
id="path3057"
inkscape:connector-curvature="0" />
</g>
</svg>
......@@ -168,6 +168,18 @@
inkscape:groupmode="layer"
id="layer1"
transform="translate(0,-308.2677)">
<path
style="fill:none;stroke:#aaaaaa;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;opacity:1"
d="m 360,144.09448 0,30 280,0 0,190 280,0"
id="path3879"
inkscape:connector-curvature="0"
transform="translate(0,308.2677)" />
<path
style="fill:none;stroke:#aaaaaa;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;opacity:1"
d="m 240,144.09448 0,130 400,0 0,90 280,0"
id="path3885"
inkscape:connector-curvature="0"
transform="translate(0,308.2677)" />
<path
sodipodi:type="arc"
id="path3130"
......@@ -180,7 +192,7 @@
style="fill:#ffffff;fill-opacity:1;stroke:#000000;stroke-width:6;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none" />
<path
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 240,1012.3622 0,-560.00002 0,0 0,0"
d="m 240,772.36218 0,-320 0,0 0,0"
id="path3136"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cccc" />
......@@ -197,7 +209,7 @@
<path
inkscape:connector-curvature="0"
id="path4020"
d="m 360,1012.3622 0,-560.00002 0,0 0,0"
d="m 360,772.36218 0,-320 0,0 0,0"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
sodipodi:nodetypes="cccc" />
<path
......@@ -213,7 +225,7 @@
<path
sodipodi:nodetypes="cccc"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 640,1012.3622 0,-560.00002 0,0 0,0"
d="m 640,772.36218 0,-320 0,0 0,0"
id="path4024"
inkscape:connector-curvature="0" />
<path
......@@ -235,7 +247,7 @@
<path
inkscape:connector-curvature="0"
id="path6857"
d="m 920,1012.3622 0,-560.00002 0,0 0,0"
d="m 920,772.36218 0,-320 0,0 0,0"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
sodipodi:nodetypes="cccc" />
<path
......@@ -250,17 +262,5 @@
id="path3055"
d="m 640,672.36218 270,0"
style="opacity:1;fill:none;stroke:#000000;stroke-width:6;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0;marker-end:url(#Arrow2Mend)" />
<path
style="fill:none;stroke:#000000;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;opacity:0.33000000000000002;"
d="m 360,144.09448 0,30 280,0 0,190 280,0"
id="path3879"
inkscape:connector-curvature="0"
transform="translate(0,308.2677)" />
<path
style="fill:none;stroke:#000000;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;opacity:0.33000000000000002;"
d="m 240,144.09448 0,130 400,0 0,90 280,0"
id="path3885"
inkscape:connector-curvature="0"
transform="translate(0,308.2677)" />
</g>
</svg>
......@@ -194,6 +194,24 @@
inkscape:groupmode="layer"
id="layer1"
transform="translate(0,-308.2677)">
<path
style="opacity:1;fill:none;stroke:#bfbfbf;stroke-width:6;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0;marker-end:url(#Arrow2Mend)"
d="m 640,532.36218 270,0"
id="path3912"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cc" />
<path
style="fill:none;stroke:#aaaaaa;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;opacity:1"
d="m 240,144.09448 0,270 400,0 0,90 280,0"
id="path3935"
inkscape:connector-curvature="0"
transform="translate(0,308.2677)" />
<path
style="fill:none;stroke:#aaaaaa;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;opacity:1"
d="m 360,144.09448 0,170 280,0 0,190 280,0"
id="path3941"
inkscape:connector-curvature="0"
transform="translate(0,308.2677)" />
<path
sodipodi:type="arc"
id="path3130"
......@@ -206,7 +224,7 @@
style="fill:#ffffff;fill-opacity:1;stroke:#000000;stroke-width:6;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none" />
<path
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 240,1012.3622 0,-560.00002 0,0 0,0"
d="m 240,912.36218 0,-460 0,0 0,0"
id="path3136"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cccc" />
......@@ -223,7 +241,7 @@
<path
inkscape:connector-curvature="0"
id="path4020"
d="m 360,1012.3622 0,-560.00002 0,0 0,0"
d="m 360,912.36218 0,-460 0,0 0,0"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
sodipodi:nodetypes="cccc" />
<path
......@@ -239,7 +257,7 @@
<path
sodipodi:nodetypes="cccc"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 640,1012.3622 0,-560.00002 0,0 0,0"
d="m 640,912.36218 0,-460 0,0 0,0"
id="path4024"
inkscape:connector-curvature="0" />
<path
......@@ -261,7 +279,7 @@
<path
inkscape:connector-curvature="0"
id="path6857"
d="m 920,1012.3622 0,-560.00002 0,0 0,0"
d="m 920,912.36218 0,-460 0,0 0,0"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
sodipodi:nodetypes="cccc" />
<path
......@@ -276,29 +294,11 @@
id="path3055"
d="m 640,812.36218 270,0"
style="fill:none;stroke:#000000;stroke-width:6;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0;marker-end:url(#Arrow2Mend)" />
<path
style="opacity:0.25;fill:none;stroke:#000000;stroke-width:6;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0;marker-end:url(#Arrow2Mend)"
d="m 640,532.36218 270,0"
id="path3912"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cc" />
<path
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:8, 16;stroke-dashoffset:0"
d="m 990,572.36218 -850,0"
id="path3914"
inkscape:connector-curvature="0" />
<path
style="fill:none;stroke:#000000;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;opacity:0.33000000000000002;"
d="m 240,144.09448 0,270 400,0 0,90 280,0"
id="path3935"
inkscape:connector-curvature="0"
transform="translate(0,308.2677)" />
<path
style="fill:none;stroke:#000000;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;opacity:0.33000000000000002;"
d="m 360,144.09448 0,170 280,0 0,190 280,0"
id="path3941"
inkscape:connector-curvature="0"
transform="translate(0,308.2677)" />
<path
style="fill:none;stroke:#000000;stroke-width:2;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;marker-start:url(#Arrow1Mstart);marker-end:url(#Arrow2Mend)"
d="m 780,234.09448 0,260"
......@@ -318,5 +318,16 @@
id="tspan4999"
x="622.36218"
y="-790">regular interval</tspan></text>
<text
xml:space="preserve"
style="font-size:20px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;letter-spacing:0px;word-spacing:0px;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;font-family:Sans;-inkscape-font-specification:Sans"
x="470"
y="562.36218"
id="text3021"
sodipodi:linespacing="125%"><tspan
sodipodi:role="line"
id="tspan3023"
x="470"
y="562.36218">log start</tspan></text>
</g>
</svg>
......@@ -168,6 +168,22 @@
inkscape:groupmode="layer"
id="layer1"
transform="translate(0,-308.2677)">
<path
style="opacity:1;fill:none;stroke:#aaaaaa;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 240,452.36216 0,30 280,0 0,190 280,0"
id="path3879"
inkscape:connector-curvature="0" />
<path
style="opacity:1;fill:none;stroke:#aaaaaa;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 120,452.36216 0,130 400,0 0,90 280,0"
id="path3885"
inkscape:connector-curvature="0" />
<path
style="opacity:1;fill:none;stroke:#aaaaaa;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 520,522.36216 400,0"
id="path3022"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cc" />
<path
sodipodi:type="arc"
id="path3130"
......@@ -180,7 +196,7 @@
style="fill:#ffffff;fill-opacity:1;stroke:#000000;stroke-width:6;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none" />
<path
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 120,1012.3622 0,-560.00004 0,0 0,0"
d="m 120,772.36218 0,-320.00002 0,0 0,0"
id="path3136"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cccc" />
......@@ -197,7 +213,7 @@
<path
inkscape:connector-curvature="0"
id="path4020"
d="m 240,1012.3622 0,-560.00004 0,0 0,0"
d="m 240,772.36218 0,-320.00002 0,0 0,0"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
sodipodi:nodetypes="cccc" />
<path
......@@ -213,7 +229,7 @@
<path
sodipodi:nodetypes="cccc"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 520,1012.3622 0,-560.00004 0,0 0,0"
d="m 520,772.36218 0,-320.00002 0,0 0,0"
id="path4024"
inkscape:connector-curvature="0" />
<path
......@@ -235,7 +251,7 @@
<path
inkscape:connector-curvature="0"
id="path6857"
d="m 800,1012.3622 0,-560.00004 0,0 0,0"
d="m 800,772.36218 0,-320.00002 0,0 0,0"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
sodipodi:nodetypes="cccc" />
<path
......@@ -250,16 +266,6 @@
id="path3055"
d="m 520,672.36216 270,0"
style="fill:none;stroke:#000000;stroke-width:6;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0;marker-end:url(#Arrow2Mend)" />
<path
style="opacity:0.33000004;fill:none;stroke:#000000;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 240,452.36216 0,30 280,0 0,190 280,0"
id="path3879"
inkscape:connector-curvature="0" />
<path
style="opacity:0.33000004;fill:none;stroke:#000000;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 120,452.36216 0,130 400,0 0,90 280,0"
id="path3885"
inkscape:connector-curvature="0" />
<path
sodipodi:type="arc"
id="path3016"
......@@ -273,7 +279,7 @@
<path
sodipodi:nodetypes="cccc"
style="fill:none;stroke:#000000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 920,1012.3622 0,-560.00006 0,0 0,0"
d="m 920,772.36218 0,-320.00004 0,0 0,0"
id="path3018"
inkscape:connector-curvature="0" />
<path
......@@ -282,11 +288,5 @@
id="path3020"
d="m 520,522.36216 390,0"
style="fill:none;stroke:#000000;stroke-width:6;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:0;stroke-opacity:1;stroke-dasharray:none;marker-end:url(#Arrow2Mend)" />
<path
style="opacity:0.33000003999999999;fill:none;stroke:#000000;stroke-width:32;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
d="m 520,522.36216 400,0"
id="path3022"
inkscape:connector-curvature="0"
sodipodi:nodetypes="cc" />
</g>
</svg>
......@@ -3,34 +3,35 @@
%\newglossaryentry{A_B^C}{type=main,name={\ensuremath{A_B^C}},sort=A,
%description={A dummy symbol }}
\newglossaryentry{depth}{type=main,name={depth},description={The longest path between end-hosts that copy each others behaviour}}
\newglossaryentry{spreading}{type=main,name={spreading},description={Score for an end-host indicating how far traffic sent from said host spreads}}
\newglossaryentry{depth}{type=main,name={depth},description={The longest path between hosts that copy each others behaviour}}
\newglossaryentry{spreading}{type=main,name={spreading},description={Score for a host indicating how far traffic sent from said host spreads}}
\newglossaryentry{natural spreading}{type=main,name={natural spreading},description={Spreading is the intended behaviour of the protocol}}
\newglossaryentry{service}{type=main,name={service},description={An IP address and port number pair}}
\newglossaryentry{client}{type=main,name={client},description={An entity on the network that initiates connections}}
\newglossaryentry{server}{type=main,name={server},description={An entity on the network that answers connections}}
\newglossaryentry{end-host}{type=main,name={<