Re: [mile] IODEF predicate logic

["Roman D. Danyliw" <[e-mail]>]

Hi Panos!

Could you describe a little more about what you had in mind with the predicate logic?  In your email below you used the terminology  "multiple indicators on one folder" which I hadn't read before.  Did you mean multiple indicators in a single IODEF document?

In seeking clarity in Section 4.4 of draft-ietf-mile-iodef-guidance-01 I had a few questions.  Citing this section ...

> [I-D.ietf-mile-rfc5070-bis] defines two new category attributes in
> the System Class.  These are watchlist-source and watchlist-
> destination and they serve for watchlist indicator groupings.  When
> an IODEF Node consists of two or more System Classes with various
> watchlist-source and watchlist-destination attributes (watchlist of
> Systems) 

Isn't that  reversed, "When an IODEF **System** consists of two or more **Node** classes with the category attribute set to watchlist-source or watchlist-destination ...", since Node sub-element of System?  However, this isn't consistent with the -00 draft since System can only contain exactly 1 node.

[snip]
    <xs:element name="System">
      <xs:complexType>
        <xs:sequence>
          <xs:element ref="iodef:Node" maxOccurs="unbounded"/>
...

> the System information should be ORed with the information
> in the Flow Class.  

Could you clarify what it means to be OR multiple Systems in the flow class?  For example, with a snippet as follows,

<EventData> ...
<Flow>
  <System category=" watchlist-source"> <Node><Address>IP1</Address>... </System>
  <System category=" watchlist-source"> <Node><Address>IP2</Address>... </System>  
  <System category=" watchlist-source"> <Node><Address>IP3</Address>... </System>
</Flow>
<Flow>
  <System category=" watchlist-source"> <Node><Address>IP4</Address>... </System>
  <System category=" watchlist-source"> <Node><Address>IP5</Address>... </System>  
  <System category=" watchlist-source"> <Node><Address>IP6</Address>... </System>
</Flow>
</EventData>

Is the watchlist defined as "(IP1 OR IP2 or IP3) AND (IP4 OR IP5 OR IP6)"?

> In other words, either System description should
> be considered as a watchlist indicator.  The rest of the content in
> the EventData Class the Node belongs to should be combined with the
> watchlist of Systems using AND logic.  

Is this AND logic applied across different Flow classes or any other indicator in the EventData class parent outside of the Flow parent of the given System class of interest?  

Roman

From: [e-mail] [mailto:[e-mail]] On Behalf Of Panos Kampanakis (pkampana)
Sent: Monday, July 15, 2013 4:02 PM
To: [e-mail]
Subject: [mile] IODEF predicate logic

Hello everyone,

In the past people have asked how IODEF can combine multiple indicators in one IODEF definition. For example a question can be, if there are more than two malicious addresses, how they can be added in one definition and what is the logic behind how they are combined?

draft-ietf-mile-rfc5070-bis-00 introduces some watchlist fields that allow for multiple indicators on one folder. In draft-ietf-mile-iodef-guidance-01 I have added section http://tools.ietf.org/html/draft-ietf-mile-iodef-guidance-01#section-4.4 that describes how the predicate logic works.

Comments and thoughts are welcome.

Rgs,
Panos