report - (continued)

e.g.

concept RSH_Connection_Spoofing

requires

Trusted_Partner: TP #- subscribed report

Network_DOS: ND #- subscribed report

SeqNumProbe: SNP #- subscribed report

SpoofedPacketSend: SPS #- subscribed report

…

report

Remote_Execution

(dest <- SPS.target) #- host we can execute on

(source <- SPS.source)

(true_src <- SPS.true_src) #- where remote code must

(start_time <- SPS.time) #- come from

(end_time <- SPS.time)