Mirai_blacknet_1.0.xml

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE nta PUBLIC '-//Uppaal Team//DTD Flat System 1.1//EN' 'http://www.it.uu.se/research/group/darts/uppaal/flat-1_2.dtd'>
<nta>
	<declaration>//***********************************************************
//Variables
//***********************************************************
urgent broadcast chan activate_first, new_victim, activate_new, activated, report, start_loader;
broadcast chan setup;

const int total_devices =11;                      //the number of devices in the network
const int timeout = 10;                           //the maximum amount of time to wait for a login response

int[0, total_devices] current_number_bots = 0;    //the number of infected devices at any given time

typedef int[1, total_devices] bot_id_t;           //possible values for bot ids (akin to ip addresses)
typedef int[1, total_devices-1] bot_ip_t;
typedef int[101, 162] credentials_t;              //possible values for credentials (akin to username/password combination)

urgent broadcast chan dictionary_attack[total_devices];    //a channel for each device representing the attempted login on that device
urgent broadcast chan login_success[total_devices];        //a channel for each device representing the a successful login response to the attacking bot
broadcast chan load_binary[total_devices];                 //a channel for each device representing the command to begin secondary infection

bot_id_t victim_id;                               //the id of the bot currently being infected
bool in_botnet[total_devices];                    //the list of currently infected bot IDs (the index value is the device id and the value indicates if the device is in the botnet)

credentials_t credential_attempt[total_devices];  //a list to represent passing credentials from attacking bot to device under attack

const int LIMIT = 32000;
typedef int[0, LIMIT] int_t;

clock total_time;



//***********************************************************
//Functions
//***********************************************************
bool MATCH(int id){
    return in_botnet[id];
}

void ADD_RECORD(bot_id_t id){
    in_botnet[id] := true;
    current_number_bots += 1;
}

/* bot_id_t CHOOSE_IP(){
    bot_id_t i = 1; 
    for (i; i&lt;=total_devices; i++){
        if (!MATCH(i)){
            total_scans += 1;
            return i;
        }            
    }
    return i;
}
*/


/******** Start a new cycle for messages, scans, and attack attempts whenever they exceed a certain LIMIT *********/


//***********************************************************
//Gantt Color Codes
//***********************************************************
const int Color_Blue = 2;
const int Color_LBlue = 18;
const int Color_Cyan = 9;

const int Color_Purple = 3;
const int Color_DPurple = 20;

const int Color_Green = 8;
const int Color_LGreen = 24;

const int Color_Red = 0;
const int Color_Pink = 12;

const int Color_Orange = 5;
const int Color_LOrange = 14;
const int Color_Yellow = 6;</declaration>
	<template>
		<name>Mirai_Blacknet</name>
		<location id="id0" x="-1080" y="-323">
			<name x="-1090" y="-357">Idle</name>
		</location>
		<location id="id1" x="-884" y="-323">
			<name x="-935" y="-314">Listening_Mode</name>
		</location>
		<location id="id2" x="-731" y="-323">
			<name x="-773" y="-357">Victim_Found</name>
			<committed/>
		</location>
		<init ref="id0"/>
		<transition>
			<source ref="id0"/>
			<target ref="id1"/>
			<label kind="synchronisation" x="-1028" y="-348">activate_first!</label>
		</transition>
		<transition>
			<source ref="id2"/>
			<target ref="id1"/>
			<label kind="guard" x="-876" y="-459">!in_botnet[victim_id]</label>
			<label kind="synchronisation" x="-884" y="-442">load_binary[victim_id]!</label>
			<label kind="assignment" x="-892" y="-425">ADD_RECORD(victim_id)</label>
			<nail x="-757" y="-399"/>
			<nail x="-859" y="-399"/>
		</transition>
		<transition>
			<source ref="id2"/>
			<target ref="id1"/>
			<label kind="guard" x="-876" y="-246">in_botnet[victim_id]</label>
			<nail x="-757" y="-246"/>
			<nail x="-859" y="-246"/>
		</transition>
		<transition>
			<source ref="id1"/>
			<target ref="id2"/>
			<label kind="synchronisation" x="-833" y="-323">report?</label>
		</transition>
	</template>
	<template>
		<name>Bot_Default</name>
		<parameter>const int ip, const credentials_t credentials</parameter>
		<declaration>clock x1;
int[0, 10] attack_attempts;
bot_ip_t target_ip;
credentials_t target_cd;

void exploit_credential(credentials_t target_cd){
    attack_attempts += 1;
    credential_attempt[target_ip] = target_cd;
}</declaration>
		<location id="id3" x="533" y="68">
			<name x="474" y="85">Attack_Successful</name>
			<committed/>
		</location>
		<location id="id4" x="533" y="-119">
			<name x="490" y="-154">Victim_Found</name>
			<committed/>
		</location>
		<location id="id5" x="253" y="-119">
			<name x="194" y="-153">Telnet_Port_Scan</name>
			<label kind="invariant" x="204" y="-110">x1&lt;=1</label>
		</location>
		<location id="id6" x="51" y="-119">
			<name x="17" y="-153">Inactive</name>
		</location>
		<location id="id7" x="788" y="-119">
			<name x="737" y="-102">Attack_Attempted</name>
			<label kind="invariant" x="797" y="-85">x1&lt;=1</label>
		</location>
		<init ref="id6"/>
		<transition>
			<source ref="id3"/>
			<target ref="id5"/>
			<label kind="synchronisation" x="363" y="43">report!</label>
			<nail x="253" y="68"/>
		</transition>
		<transition>
			<source ref="id4"/>
			<target ref="id5"/>
			<label kind="guard" x="329" y="-34">attack_attempts&gt;=10</label>
			<label kind="assignment" x="363" y="0">x1:=0</label>
			<nail x="491" y="-8"/>
			<nail x="295" y="-8"/>
		</transition>
		<transition>
			<source ref="id7"/>
			<target ref="id4"/>
			<label kind="guard" x="644" y="-255">x1&gt;=1</label>
			<nail x="788" y="-229"/>
			<nail x="533" y="-229"/>
		</transition>
		<transition>
			<source ref="id5"/>
			<target ref="id4"/>
			<label kind="select" x="348" y="-161">ip_sel:bot_ip_t</label>
			<label kind="guard" x="372" y="-144">x1&gt;=1</label>
			<label kind="assignment" x="321" y="-119">target_ip:=ip_sel,
x1:=0,
attack_attempts:=0</label>
		</transition>
		<transition>
			<source ref="id4"/>
			<target ref="id7"/>
			<label kind="select" x="603" y="-178">cd_sel:credentials_t</label>
			<label kind="guard" x="603" y="-161">attack_attempts&lt;10</label>
			<label kind="synchronisation" x="576" y="-144">dictionary_attack[target_ip]!</label>
			<label kind="assignment" x="603" y="-119">target_cd:=cd_sel,
x1:=0,
exploit_credential(target_cd)</label>
		</transition>
		<transition>
			<source ref="id7"/>
			<target ref="id3"/>
			<label kind="synchronisation" x="601" y="42">login_success[target_ip]?</label>
			<label kind="assignment" x="618" y="68">victim_id:=target_ip</label>
			<nail x="788" y="68"/>
		</transition>
		<transition>
			<source ref="id6"/>
			<target ref="id5"/>
			<label kind="synchronisation" x="93" y="-144">activate_first?</label>
			<label kind="assignment" x="85" y="-119">in_botnet[0]:=true,
x1:=0</label>
		</transition>
	</template>
	<template>
		<name>Bot_t1</name>
		<parameter>const bot_id_t ip, const credentials_t credentials</parameter>
		<declaration>clock x2;
int[0, 10] attack_attempts;
bot_ip_t target_ip;
credentials_t target_cd;

bool credential_match(){
    return credentials == credential_attempt[ip];
}

void exploit_credential(credentials_t target_cd){
    attack_attempts += 1;
    credential_attempt[target_ip] = target_cd;
}</declaration>
		<location id="id8" x="-1564" y="-153">
			<name x="-1623" y="-136">Attack_Successful</name>
			<committed/>
		</location>
		<location id="id9" x="-1564" y="-340">
			<name x="-1607" y="-375">Victim_Found</name>
			<committed/>
		</location>
		<location id="id10" x="-2091" y="-569">
			<name x="-2125" y="-603">Connected</name>
		</location>
		<location id="id11" x="-2091" y="-340">
			<name x="-2125" y="-323">Vulnerable</name>
		</location>
		<location id="id12" x="-1844" y="-340">
			<name x="-1903" y="-374">Telnet_Port_Scan</name>
			<label kind="invariant" x="-1895" y="-331">x2&lt;=1</label>
		</location>
		<location id="id13" x="-1309" y="-340">
			<name x="-1360" y="-323">Attack_Attempted</name>
			<label kind="invariant" x="-1300" y="-306">x2&lt;=1</label>
		</location>
		<location id="id14" x="-2091" y="-450">
			<name x="-2142" y="-433">Login_Successful</name>
			<committed/>
		</location>
		<init ref="id10"/>
		<transition>
			<source ref="id14"/>
			<target ref="id11"/>
			<label kind="synchronisation" x="-2082" y="-408">login_success[ip]!</label>
		</transition>
		<transition>
			<source ref="id8"/>
			<target ref="id12"/>
			<label kind="synchronisation" x="-1734" y="-178">report!</label>
			<nail x="-1844" y="-153"/>
		</transition>
		<transition>
			<source ref="id9"/>
			<target ref="id12"/>
			<label kind="guard" x="-1768" y="-255">attack_attempts&gt;=10</label>
			<label kind="assignment" x="-1734" y="-221">x2:=0</label>
			<nail x="-1606" y="-229"/>
			<nail x="-1802" y="-229"/>
		</transition>
		<transition>
			<source ref="id13"/>
			<target ref="id9"/>
			<label kind="guard" x="-1453" y="-476">x2&gt;=1</label>
			<nail x="-1309" y="-450"/>
			<nail x="-1564" y="-450"/>
		</transition>
		<transition>
			<source ref="id12"/>
			<target ref="id9"/>
			<label kind="select" x="-1751" y="-382">ip_sel:bot_ip_t</label>
			<label kind="guard" x="-1725" y="-365">x2&gt;=1</label>
			<label kind="assignment" x="-1759" y="-340">target_ip:=ip_sel,
x2:=0,
attack_attempts:=0</label>
		</transition>
		<transition>
			<source ref="id9"/>
			<target ref="id13"/>
			<label kind="select" x="-1496" y="-399">cd_sel:credentials_t</label>
			<label kind="guard" x="-1496" y="-382">attack_attempts&lt;10</label>
			<label kind="synchronisation" x="-1521" y="-365">dictionary_attack[target_ip]!</label>
			<label kind="assignment" x="-1496" y="-340">target_cd:=cd_sel,
x2:=0,
exploit_credential(target_cd)</label>
		</transition>
		<transition>
			<source ref="id13"/>
			<target ref="id8"/>
			<label kind="synchronisation" x="-1496" y="-178">login_success[target_ip]?</label>
			<label kind="assignment" x="-1479" y="-153">victim_id:=target_ip</label>
			<nail x="-1309" y="-153"/>
		</transition>
		<transition>
			<source ref="id10"/>
			<target ref="id14"/>
			<label kind="guard" x="-2082" y="-535">credential_match()</label>
			<label kind="synchronisation" x="-2082" y="-518">dictionary_attack[ip]?</label>
		</transition>
		<transition>
			<source ref="id11"/>
			<target ref="id12"/>
			<label kind="synchronisation" x="-2023" y="-365">load_binary[ip]?</label>
			<label kind="assignment" x="-1989" y="-340">x2:=0</label>
		</transition>
	</template>
	<template>
		<name>Bot_t2</name>
		<parameter>const bot_id_t ip, const credentials_t credentials, const int reboot_length, const int_t reboot_period, const int period_overflows, int_t reboot_time, int time_overflows</parameter>
		<declaration>clock x2, x_reboot;
int[0, 10] attack_attempts;
bot_ip_t target_ip;
credentials_t target_cd;

bool credential_match(){
    return credentials == credential_attempt[ip];
}

void exploit_credential(credentials_t target_cd){
    attack_attempts += 1;
    credential_attempt[target_ip] = target_cd;
}

void reboot(){
    x2:=0;
    in_botnet[ip] := false;
    reboot_time:=reboot_period;
    time_overflows:=period_overflows;
}</declaration>
		<location id="id15" x="-1530" y="-119">
			<name x="-1589" y="-102">Attack_Successful</name>
			<committed/>
		</location>
		<location id="id16" x="-1530" y="-306">
			<name x="-1573" y="-341">Victim_Found</name>
			<committed/>
		</location>
		<location id="id17" x="-2057" y="-535">
			<name x="-2091" y="-527">Connected</name>
			<label kind="invariant" x="-2184" y="-518">x_reboot&lt;=reboot_time+LIMIT*time_overflows</label>
		</location>
		<location id="id18" x="-2057" y="-306">
			<name x="-2091" y="-289">Vulnerable</name>
		</location>
		<location id="id19" x="-1810" y="-306">
			<name x="-1869" y="-340">Telnet_Port_Scan</name>
			<label kind="invariant" x="-1861" y="-297">x2&lt;=1 &amp;&amp;
x_reboot&lt;=reboot_time+LIMIT*time_overflows</label>
		</location>
		<location id="id20" x="-1275" y="-306">
			<name x="-1326" y="-289">Attack_Attempted</name>
			<label kind="invariant" x="-1266" y="-272">x2&lt;=1 &amp;&amp;
x_reboot&lt;=reboot_time+LIMIT*time_overflows</label>
		</location>
		<location id="id21" x="-2057" y="-416">
			<name x="-2108" y="-399">Login_Successful</name>
			<committed/>
		</location>
		<location id="id22" x="-1649" y="-535">
			<name x="-1675" y="-569">Rebooting</name>
			<label kind="invariant" x="-1700" y="-527">x2&lt;=reboot_length</label>
		</location>
		<init ref="id17"/>
		<transition>
			<source ref="id20"/>
			<target ref="id22"/>
			<label kind="guard" x="-1521" y="-561">x_reboot &gt;= reboot_time+LIMIT*time_overflows</label>
			<label kind="assignment" x="-1428" y="-535">reboot(),
current_number_bots--</label>
			<nail x="-1198" y="-535"/>
		</transition>
		<transition>
			<source ref="id19"/>
			<target ref="id22"/>
			<label kind="guard" x="-1802" y="-416">x_reboot &gt;= reboot_time+LIMIT*time_overflows</label>
			<label kind="assignment" x="-1802" y="-399">reboot(),
current_number_bots--</label>
			<nail x="-1810" y="-442"/>
		</transition>
		<transition>
			<source ref="id17"/>
			<target ref="id22"/>
			<label kind="guard" x="-1989" y="-561">x_reboot &gt;= reboot_time+LIMIT*time_overflows</label>
			<label kind="assignment" x="-1870" y="-535">reboot()</label>
		</transition>
		<transition>
			<source ref="id22"/>
			<target ref="id17"/>
			<label kind="guard" x="-1895" y="-629">x2&gt;=reboot_length</label>
			<label kind="assignment" x="-1887" y="-603">x_reboot:=0</label>
			<nail x="-1734" y="-603"/>
			<nail x="-1963" y="-603"/>
		</transition>
		<transition>
			<source ref="id21"/>
			<target ref="id18"/>
			<label kind="synchronisation" x="-2048" y="-374">login_success[ip]!</label>
		</transition>
		<transition>
			<source ref="id15"/>
			<target ref="id19"/>
			<label kind="synchronisation" x="-1700" y="-144">report!</label>
			<nail x="-1810" y="-119"/>
		</transition>
		<transition>
			<source ref="id16"/>
			<target ref="id19"/>
			<label kind="guard" x="-1734" y="-221">attack_attempts&gt;=10</label>
			<label kind="assignment" x="-1700" y="-187">x2:=0</label>
			<nail x="-1572" y="-195"/>
			<nail x="-1768" y="-195"/>
		</transition>
		<transition>
			<source ref="id20"/>
			<target ref="id16"/>
			<label kind="guard" x="-1419" y="-442">x2&gt;=1</label>
			<nail x="-1275" y="-416"/>
			<nail x="-1530" y="-416"/>
		</transition>
		<transition>
			<source ref="id19"/>
			<target ref="id16"/>
			<label kind="select" x="-1717" y="-348">ip_sel:bot_ip_t</label>
			<label kind="guard" x="-1691" y="-331">x2&gt;=1</label>
			<label kind="assignment" x="-1725" y="-306">target_ip:=ip_sel,
x2:=0,
attack_attempts:=0</label>
		</transition>
		<transition>
			<source ref="id16"/>
			<target ref="id20"/>
			<label kind="select" x="-1462" y="-365">cd_sel:credentials_t</label>
			<label kind="guard" x="-1462" y="-348">attack_attempts&lt;10</label>
			<label kind="synchronisation" x="-1487" y="-331">dictionary_attack[target_ip]!</label>
			<label kind="assignment" x="-1462" y="-306">target_cd:=cd_sel,
x2:=0,
exploit_credential(target_cd)</label>
		</transition>
		<transition>
			<source ref="id20"/>
			<target ref="id15"/>
			<label kind="synchronisation" x="-1462" y="-144">login_success[target_ip]?</label>
			<label kind="assignment" x="-1445" y="-119">victim_id:=target_ip</label>
			<nail x="-1275" y="-119"/>
		</transition>
		<transition>
			<source ref="id17"/>
			<target ref="id21"/>
			<label kind="guard" x="-2048" y="-493">credential_match()</label>
			<label kind="synchronisation" x="-2048" y="-476">dictionary_attack[ip]?</label>
		</transition>
		<transition>
			<source ref="id18"/>
			<target ref="id19"/>
			<label kind="synchronisation" x="-1989" y="-331">load_binary[ip]?</label>
			<label kind="assignment" x="-1955" y="-306">x2:=0</label>
		</transition>
	</template>
	<system>MIRAI_BLCK = Mirai_Blacknet();
BOT_DF = Bot_Default(0,110);
BOT1 = Bot_t2(1,150,6,360,0,279,0);
BOT2 = Bot_t2(2,141,6,360,0,211,0);
BOT3 = Bot_t2(3,148,6,360,0,323,0);
BOT4 = Bot_t2(4,103,6,360,0,287,0);
BOT5 = Bot_t2(5,143,6,360,0,242,0);
BOT6 = Bot_t2(6,139,6,360,0,347,0);
BOT7 = Bot_t2(7,116,6,360,0,320,0);
BOT8 = Bot_t2(8,142,6,360,0,155,0);
BOT9 = Bot_t2(9,147,6,360,0,2,0);
BOT10 = Bot_t2(10,153,6,360,0,296,0);
system MIRAI_BLCK, BOT_DF, BOT1, BOT2, BOT3, BOT4, BOT5, BOT6, BOT7, BOT8, BOT9, BOT10;
</system>
	<queries>
		<query>
			<formula>A[] total_time==50 imply current_number_bots+==total_devices-1</formula>
			<comment></comment>
		</query>
		<query>
			<formula>E&lt;&gt; current_number_bots==total_devices-1</formula>
			<comment></comment>
		</query>
		<query>
			<formula>E&lt;&gt; total_time == 5
</formula>
			<comment></comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
		<query>
			<formula>Pr[&lt;=500] (&lt;&gt;current_number_bots==5)</formula>
			<comment></comment>
		</query>
		<query>
			<formula>Pr[&lt;=50] (&lt;&gt;current_number_bots==5)</formula>
			<comment></comment>
		</query>
		<query>
			<formula>Pr[&lt;=25] (&lt;&gt;current_number_bots==5)</formula>
			<comment></comment>
		</query>
		<query>
			<formula>simulate[&lt;=500; 15] {BOT_DF.Telnet_Port_Scan, BOT_DF.Victim_Found}</formula>
			<comment></comment>
		</query>
		<query>
			<formula>simulate[&lt;=50] {in_botnet[1]}</formula>
			<comment></comment>
		</query>
		<query>
			<formula>Pr[&lt;=25] (&lt;&gt;in_botnet[1])</formula>
			<comment></comment>
		</query>
		<query>
			<formula>Pr[&lt;=25] (&lt;&gt;in_botnet[1] &amp;&amp; in_botnet[2])</formula>
			<comment></comment>
		</query>
		<query>
			<formula>Pr[&lt;=25] (&lt;&gt;in_botnet[1] &amp;&amp; in_botnet[2] &amp;&amp; in_botnet[3])</formula>
			<comment></comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
		<query>
			<formula>Pr[&lt;=25] (&lt;&gt;current_number_bots==1)</formula>
			<comment></comment>
		</query>
		<query>
			<formula>Pr[&lt;=25] (&lt;&gt;current_number_bots==2)</formula>
			<comment></comment>
		</query>
		<query>
			<formula>Pr[&lt;=25] (&lt;&gt;current_number_bots==3)</formula>
			<comment></comment>
		</query>
		<query>
			<formula>Pr[&lt;=25; 500] (&lt;&gt;current_number_bots==4)</formula>
			<comment></comment>
		</query>
		<query>
			<formula>Pr[&lt;=25] (&lt;&gt;current_number_bots==5)</formula>
			<comment></comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
		<query>
			<formula>&lt;----- MODEL VERIFICATION -----&gt;</formula>
			<comment></comment>
		</query>
		<query>
			<formula>A[] !deadlock</formula>
			<comment>Deadlocks never occur</comment>
		</query>
		<query>
			<formula>A[] deadlock imply current_number_bots==total_devices-1</formula>
			<comment>A deadlock implies that all devices have been infected</comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
		<query>
			<formula>&lt;----- INFECTION REACHABILITY -----&gt;</formula>
			<comment></comment>
		</query>
		<query>
			<formula>A&lt;&gt; current_number_bots==total_devices-1</formula>
			<comment>All devices will always be infected in every possible scenario</comment>
		</query>
		<query>
			<formula>E&lt;&gt; current_number_bots==total_devices-1</formula>
			<comment>It is possible for every device to eventually be infected</comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
		<query>
			<formula>&lt;----- INFECTION TIMES -----&gt;</formula>
			<comment></comment>
		</query>
		<query>
			<formula>A[] total_time==50 imply current_number_bots==total_devices-1</formula>
			<comment>All devices are always infected by 50 time units</comment>
		</query>
		<query>
			<formula>Pr[total_time&lt;=100; 100] (&lt;&gt;current_number_bots==total_devices-1)</formula>
			<comment>The probability all devices are compromised in 100 time units</comment>
		</query>
		<query>
			<formula>Pr[total_time&lt;=50] (&lt;&gt;current_number_bots==total_devices-1)</formula>
			<comment>The probability all devices are compromised in 50 time units</comment>
		</query>
		<query>
			<formula>Pr[total_time&lt;=25] (&lt;&gt;current_number_bots==total_devices-1)</formula>
			<comment>The probability all devices are compromised in 25 time units</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=10; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 10 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=20; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 20 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=25; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 25 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=30; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 30 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=40; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 40 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=50; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 50 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=60; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 60 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=70; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 70 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=80; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 80 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=90; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 90 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=100; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 100 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>Pr[&lt;=50] (&lt;&gt;in_botnet[1])</formula>
			<comment>The probability bot 1 has been infected by 50 time units</comment>
		</query>
		<query>
			<formula>Pr[&lt;=50] (&lt;&gt;in_botnet[2])</formula>
			<comment>The probability bot 2 has been infected by 50 time units</comment>
		</query>
		<query>
			<formula>Pr[&lt;=50] (&lt;&gt;in_botnet[3])</formula>
			<comment>The probability bot 3 has been infected by 50 time units</comment>
		</query>
		<query>
			<formula>Pr[&lt;=50] (&lt;&gt;in_botnet[4])</formula>
			<comment>The probability bot 4 has been infected by 50 time units</comment>
		</query>
		<query>
			<formula>Pr[&lt;=50] (&lt;&gt;in_botnet[5])</formula>
			<comment>The probability bot 5 has been infected by 50 time units</comment>
		</query>
		<query>
			<formula>Pr[&lt;=25] (&lt;&gt;in_botnet[1])</formula>
			<comment>The probability bot 1 has been infected by 25 time units</comment>
		</query>
		<query>
			<formula>Pr[&lt;=25] (&lt;&gt;in_botnet[1] &amp;&amp; in_botnet[2])</formula>
			<comment>The probability bots 1 and 2 have been infected by 25 time units</comment>
		</query>
		<query>
			<formula>Pr[&lt;=25] (&lt;&gt;in_botnet[1] &amp;&amp; in_botnet[2] &amp;&amp; in_botnet[3])</formula>
			<comment>The probability bots 1, 2 , and 3 have been infected by 25 time units</comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=100; 100] {current_number_bots}</formula>
			<comment>simulate 100 runs for 100 time units each and plot the number of infected bots against simulation time</comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=100; 100] {in_botnet[1], in_botnet[2], in_botnet[3], in_botnet[4], in_botnet[5]}</formula>
			<comment>simulate 100 runs for 100 time units each and plot when each bot becomes infected</comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
		<query>
			<formula>&lt;----- Network Traffic -----&gt;</formula>
			<comment></comment>
		</query>
		<query>
			<formula>Pr[&lt;=32] (&lt;&gt; total_messages&gt;75)</formula>
			<comment>Probability that at least 75 messages are sent over the network in 32 time units (which is the expected time the infect all 5 devices)</comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=100; 100] {total_scans, total_attempts} : current_number_bots==total_devices-1</formula>
			<comment>Simulate 100 runs for either 100 time units, or until every bot is infected, and plot the number of network scans and login attempts</comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=100; 100] {total_messages} : current_number_bots==total_devices-1</formula>
			<comment>Simulate 100 runs for either 100 time units, or until every bot is infected, and plot the number of messages sent over the network</comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=300; 100] {total_messages} : current_number_bots==total_devices-1</formula>
			<comment></comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=300; 100] {message_loops*LIMIT + total_messages} : current_number_bots==total_devices-1</formula>
			<comment></comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=500; 10] {total_messages} : current_number_bots==total_devices-1</formula>
			<comment></comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=500; 10] {message_loops*LIMIT + total_messages} : current_number_bots==total_devices-1</formula>
			<comment></comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=500; 20] {message_loops*LIMIT + total_messages} : current_number_bots==total_devices-1</formula>
			<comment></comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=500; 1] {BOT9.Rebooting}</formula>
			<comment></comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=500; 1] {current_number_bots}</formula>
			<comment></comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=5000; 5] {message_loops*LIMIT + total_messages} : current_number_bots==total_devices-1</formula>
			<comment></comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
	</queries>
</nta>