Mirai_botnet_0.9.xml

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE nta PUBLIC '-//Uppaal Team//DTD Flat System 1.1//EN' 'http://www.it.uu.se/research/group/darts/uppaal/flat-1_2.dtd'>
<nta>
	<declaration>//***********************************************************
//Variables
//***********************************************************
urgent broadcast chan activate_first, new_victim, activate_new, activated, report, start_loader;
broadcast chan setup;

const int total_devices = 6;                     //the number of devices in the network
const int timeout = 10;                           //the maximum amount of time to wait for a login response

int total_scans = 0;
int total_attempts = 0;
int total_messages = 0;
int[0, total_devices] current_number_bots = 0;   //the number of infected devices at any given time

typedef int[1, total_devices] bot_id_t;           //possible values for bot ids (akin to ip addresses)
typedef int[1, total_devices-1] bot_ip_t;
typedef int[101, 111] credentials_t;             //possible values for credentials (akin to username/password combination)

broadcast chan dictionary_attack[total_devices];           //a channel for each device representing the attempted login on that device
urgent broadcast chan login_success[total_devices];               //a channel for each device representing the a successful login response to the attacking bot
urgent broadcast chan login_failed[total_devices];                //a channel for each device representing the a failed login response to the attacking bot
broadcast chan load_binary[total_devices];                 //a channel for each device representing the command to begin secondary infection

bot_id_t victim_id;                              //the id of the bot currently being infected
bool in_botnet[total_devices];                   //the list of currently infected bot IDs (the index value is the device id and the value indicates if the device is in the botnet)

credentials_t credential_attempt[total_devices]; //a list to represent passing credentials from attacking bot to device under attack

clock total_time;



//***********************************************************
//Functions
//***********************************************************
bool MATCH(int id){
    return in_botnet[id];
}

void ADD_RECORD(bot_id_t id){
    in_botnet[id] := true;
    current_number_bots += 1;
}

/* bot_id_t CHOOSE_IP(){
    bot_id_t i = 1; 
    for (i; i&lt;=total_devices; i++){
        if (!MATCH(i)){
            total_scans += 1;
            return i;
        }            
    }
    return i;
}
*/


//***********************************************************
//Gantt Color Codes
//***********************************************************
const int Color_Blue = 2;
const int Color_LBlue = 18;
const int Color_Cyan = 9;

const int Color_Purple = 3;
const int Color_DPurple = 20;

const int Color_Green = 8;
const int Color_LGreen = 24;

const int Color_Red = 0;
const int Color_Pink = 12;

const int Color_Orange = 5;
const int Color_LOrange = 14;
const int Color_Yellow = 6;</declaration>
	<template>
		<name>Mirai_Master</name>
		<location id="id0" x="-476" y="-119">
			<name x="-493" y="-153">Initial</name>
			<label kind="invariant" x="-510" y="-110">total_time&lt;=5</label>
		</location>
		<location id="id1" x="-289" y="-119">
			<name x="-332" y="-153">Setup_Servers</name>
		</location>
		<init ref="id0"/>
		<transition>
			<source ref="id0"/>
			<target ref="id1"/>
			<label kind="guard" x="-433" y="-161">total_time&gt;=5</label>
			<label kind="synchronisation" x="-408" y="-144">setup!</label>
		</transition>
	</template>
	<template>
		<name>CnC_Server</name>
		<location id="id2" x="-1097" y="-229">
			<name x="-1107" y="-263">Idle</name>
		</location>
		<location id="id3" x="-943" y="-229">
			<name x="-978" y="-263">Pre_Active</name>
			<committed/>
		</location>
		<location id="id4" x="-765" y="-229">
			<name x="-782" y="-263">Active</name>
		</location>
		<location id="id5" x="-586" y="-323">
			<name x="-620" y="-306">IM_Stage_1</name>
			<committed/>
		</location>
		<location id="id6" x="-586" y="-136">
			<name x="-620" y="-119">IM_Stage_2</name>
		</location>
		<init ref="id2"/>
		<transition>
			<source ref="id6"/>
			<target ref="id4"/>
			<label kind="synchronisation" x="-731" y="-178">activated?</label>
		</transition>
		<transition>
			<source ref="id5"/>
			<target ref="id6"/>
			<label kind="synchronisation" x="-578" y="-229">activate_new!</label>
		</transition>
		<transition>
			<source ref="id4"/>
			<target ref="id5"/>
			<label kind="synchronisation" x="-731" y="-306">new_victim?</label>
		</transition>
		<transition>
			<source ref="id3"/>
			<target ref="id4"/>
			<label kind="synchronisation" x="-901" y="-254">activate_first!</label>
		</transition>
		<transition>
			<source ref="id2"/>
			<target ref="id3"/>
			<label kind="synchronisation" x="-1046" y="-254">setup?</label>
		</transition>
	</template>
	<template>
		<name>Report_Server</name>
		<location id="id7" x="-781" y="-221">
			<name x="-791" y="-255">Idle</name>
		</location>
		<location id="id8" x="-620" y="-221">
			<name x="-646" y="-255">Wait</name>
		</location>
		<location id="id9" x="-467" y="-221">
			<name x="-509" y="-255">New_Credentials</name>
			<committed/>
		</location>
		<init ref="id7"/>
		<transition>
			<source ref="id9"/>
			<target ref="id8"/>
			<label kind="guard" x="-612" y="-340">!in_botnet[victim_id]</label>
			<label kind="synchronisation" x="-586" y="-297">start_loader!</label>
			<label kind="assignment" x="-629" y="-323">ADD_RECORD(victim_id)</label>
			<nail x="-493" y="-297"/>
			<nail x="-595" y="-297"/>
		</transition>
		<transition>
			<source ref="id9"/>
			<target ref="id8"/>
			<label kind="guard" x="-612" y="-144">in_botnet[victim_id]</label>
			<nail x="-493" y="-144"/>
			<nail x="-595" y="-144"/>
		</transition>
		<transition>
			<source ref="id8"/>
			<target ref="id9"/>
			<label kind="synchronisation" x="-569" y="-221">report?</label>
		</transition>
		<transition>
			<source ref="id7"/>
			<target ref="id8"/>
			<label kind="synchronisation" x="-722" y="-246">setup?</label>
		</transition>
	</template>
	<template>
		<name>Loader</name>
		<declaration>clock loader_x;</declaration>
		<location id="id10" x="178" y="-68">
			<name x="152" y="-102">Loaded</name>
			<committed/>
		</location>
		<location id="id11" x="-230" y="-68">
			<name x="-256" y="-102">Standby</name>
		</location>
		<location id="id12" x="-51" y="-68">
			<name x="-77" y="-102">Loading</name>
			<label kind="invariant" x="-85" y="-60">loader_x&lt;=2</label>
		</location>
		<init ref="id11"/>
		<transition>
			<source ref="id10"/>
			<target ref="id11"/>
			<label kind="synchronisation" x="-85" y="0">new_victim!</label>
			<nail x="178" y="25"/>
			<nail x="-230" y="25"/>
		</transition>
		<transition>
			<source ref="id12"/>
			<target ref="id10"/>
			<label kind="guard" x="-8" y="-110">loader_x&gt;=1</label>
			<label kind="synchronisation" x="-9" y="-93">load_binary[victim_id]!</label>
		</transition>
		<transition>
			<source ref="id11"/>
			<target ref="id12"/>
			<label kind="synchronisation" x="-187" y="-93">start_loader?</label>
			<label kind="assignment" x="-187" y="-68">loader_x:=0</label>
		</transition>
	</template>
	<template>
		<name>Bot_Default</name>
		<parameter>const int id, const credentials_t credentials</parameter>
		<declaration>clock x1;
int[0, 10] attack_attempts;
bot_ip_t target_ip;
credentials_t target_cd;

void exploit_credential(credentials_t target_cd){
    attack_attempts += 1;
    total_messages += 2;
    total_attempts += 1;
    credential_attempt[target_ip] = target_cd;
}</declaration>
		<location id="id13" x="-688" y="-348">
			<name x="-714" y="-382">Inactive</name>
		</location>
		<location id="id14" x="-518" y="-348">
			<name x="-535" y="-382">Active</name>
			<committed/>
		</location>
		<location id="id15" x="8" y="-348">
			<name x="-35" y="-383">Victim_Found</name>
			<label kind="invariant" x="-8" y="-331">x1&lt;=1</label>
		</location>
		<location id="id16" x="-348" y="-347">
			<name x="-408" y="-381">Telnet_Port_Scan</name>
			<label kind="invariant" x="-323" y="-340">x1&lt;=2</label>
		</location>
		<location id="id17" x="280" y="-348">
			<name x="228" y="-332">Attack_Attempted</name>
			<urgent/>
		</location>
		<location id="id18" x="8" y="-153">
			<name x="-51" y="-136">Attack_Successful</name>
			<committed/>
		</location>
		<init ref="id13"/>
		<transition>
			<source ref="id17"/>
			<target ref="id16"/>
			<label kind="guard" x="59" y="-238">MATCH(target_ip)</label>
			<nail x="195" y="-212"/>
			<nail x="-280" y="-212"/>
		</transition>
		<transition>
			<source ref="id15"/>
			<target ref="id16"/>
			<label kind="guard" x="-238" y="-263">attack_attempts&gt;=10</label>
			<label kind="assignment" x="-195" y="-238">x1:=0</label>
			<nail x="-102" y="-238"/>
			<nail x="-255" y="-238"/>
		</transition>
		<transition>
			<source ref="id14"/>
			<target ref="id16"/>
			<label kind="assignment" x="-450" y="-346">x1:=0</label>
		</transition>
		<transition>
			<source ref="id13"/>
			<target ref="id14"/>
			<label kind="synchronisation" x="-646" y="-370">activate_first?</label>
		</transition>
		<transition>
			<source ref="id17"/>
			<target ref="id15"/>
			<label kind="synchronisation" x="85" y="-510">login_failed[target_ip]?</label>
			<label kind="assignment" x="110" y="-484">target_cd++</label>
			<nail x="280" y="-484"/>
			<nail x="8" y="-484"/>
		</transition>
		<transition>
			<source ref="id15"/>
			<target ref="id17"/>
			<label kind="guard" x="93" y="-408">x1&gt;=1 &amp;&amp;
attack_attempts&lt;10</label>
			<label kind="synchronisation" x="68" y="-374">dictionary_attack[target_ip]!</label>
			<label kind="assignment" x="68" y="-348">exploit_credential(target_cd),
x1:=0</label>
		</transition>
		<transition>
			<source ref="id17"/>
			<target ref="id18"/>
			<label kind="synchronisation" x="76" y="-178">login_success[target_ip]?</label>
			<label kind="assignment" x="102" y="-153">victim_id:=target_ip</label>
			<nail x="280" y="-153"/>
		</transition>
		<transition>
			<source ref="id18"/>
			<target ref="id16"/>
			<label kind="synchronisation" x="-195" y="-178">report!</label>
			<nail x="-348" y="-153"/>
		</transition>
		<transition>
			<source ref="id16"/>
			<target ref="id15"/>
			<label kind="select" x="-221" y="-391">ip:bot_ip_t</label>
			<label kind="guard" x="-204" y="-374">x1&gt;=2</label>
			<label kind="assignment" x="-246" y="-348">target_ip:=ip, total_scans++,
x1:=0, target_cd:=101,
attack_attempts:=0,
total_messages+=2</label>
		</transition>
	</template>
	<template>
		<name>Bot_t1</name>
		<parameter>const bot_id_t id, const credentials_t credentials</parameter>
		<declaration>clock x2;
int[0, 10] attack_attempts;
bot_ip_t target_ip;
credentials_t target_cd;

bool credential_match(){
    return credentials == credential_attempt[id];
}

void exploit_credential(credentials_t target_cd){
    attack_attempts += 1;
    total_messages += 2;
    total_attempts += 1;
    credential_attempt[target_ip] = target_cd++;
}</declaration>
		<location id="id19" x="-1632" y="-153">
			<name x="-1691" y="-136">Attack_Successful</name>
		</location>
		<location id="id20" x="-1564" y="-340">
			<name x="-1607" y="-375">Victim_Found</name>
			<label kind="invariant" x="-1581" y="-323">x2&lt;=1</label>
		</location>
		<location id="id21" x="-2840" y="-426">
			<name x="-2874" y="-418">Connected</name>
		</location>
		<location id="id22" x="-2389" y="-340">
			<name x="-2448" y="-323">Login_Successful</name>
		</location>
		<location id="id23" x="-2091" y="-340">
			<name x="-2109" y="-324">Active</name>
			<committed/>
		</location>
		<location id="id24" x="-1938" y="-340">
			<name x="-1997" y="-374">Telnet_Port_Scan</name>
			<label kind="invariant" x="-1921" y="-340">x2&lt;=2</label>
		</location>
		<location id="id25" x="-2839" y="-578">
			<name x="-2864" y="-612">Inactive</name>
			<label kind="invariant" x="-2882" y="-569">x2&lt;=5</label>
		</location>
		<location id="id26" x="-2236" y="-341">
			<name x="-2279" y="-324">Compromised</name>
		</location>
		<location id="id27" x="-2627" y="-341">
			<name x="-2678" y="-324">Login_Attempted</name>
			<committed/>
		</location>
		<location id="id28" x="-1309" y="-340">
			<name x="-1360" y="-323">Attack_Attempted</name>
			<urgent/>
		</location>
		<init ref="id25"/>
		<transition>
			<source ref="id28"/>
			<target ref="id24"/>
			<label kind="guard" x="-1547" y="-229">MATCH(target_ip)</label>
			<nail x="-1428" y="-204"/>
			<nail x="-1887" y="-204"/>
		</transition>
		<transition>
			<source ref="id19"/>
			<target ref="id24"/>
			<label kind="synchronisation" x="-1819" y="-179">report!</label>
			<nail x="-1938" y="-153"/>
		</transition>
		<transition>
			<source ref="id20"/>
			<target ref="id24"/>
			<label kind="guard" x="-1819" y="-255">attack_attempts&gt;=10</label>
			<label kind="assignment" x="-1785" y="-229">x2:=0</label>
			<nail x="-1657" y="-229"/>
			<nail x="-1853" y="-229"/>
		</transition>
		<transition>
			<source ref="id28"/>
			<target ref="id20"/>
			<label kind="synchronisation" x="-1496" y="-518">login_failed[target_ip]?</label>
			<label kind="assignment" x="-1462" y="-493">target_cd++</label>
			<nail x="-1309" y="-493"/>
			<nail x="-1564" y="-493"/>
		</transition>
		<transition>
			<source ref="id24"/>
			<target ref="id20"/>
			<label kind="select" x="-1785" y="-382">ip:bot_ip_t</label>
			<label kind="guard" x="-1776" y="-365">x2&gt;=2</label>
			<label kind="assignment" x="-1819" y="-340">target_ip:=ip, total_scans++,
x2:=0, target_cd:=101,
attack_attempts:=0, 
total_messages+=2</label>
		</transition>
		<transition>
			<source ref="id20"/>
			<target ref="id28"/>
			<label kind="guard" x="-1487" y="-408">x2&gt;=1 &amp;&amp;
attack_attempts&lt;10</label>
			<label kind="synchronisation" x="-1504" y="-365">dictionary_attack[target_ip]!</label>
			<label kind="assignment" x="-1504" y="-340">exploit_credential(target_cd),
x2:=0</label>
		</transition>
		<transition>
			<source ref="id28"/>
			<target ref="id19"/>
			<label kind="synchronisation" x="-1496" y="-179">login_success[target_ip]?</label>
			<label kind="assignment" x="-1479" y="-153">victim_id:=target_ip</label>
			<nail x="-1309" y="-153"/>
		</transition>
		<transition>
			<source ref="id27"/>
			<target ref="id22"/>
			<label kind="guard" x="-2558" y="-382">credential_match()</label>
			<label kind="synchronisation" x="-2559" y="-367">login_success[id]!</label>
		</transition>
		<transition>
			<source ref="id27"/>
			<target ref="id21"/>
			<label kind="guard" x="-2796" y="-382">!credential_match()</label>
			<label kind="synchronisation" x="-2779" y="-365">login_failed[id]!</label>
			<nail x="-2840" y="-341"/>
		</transition>
		<transition>
			<source ref="id21"/>
			<target ref="id27"/>
			<label kind="synchronisation" x="-2797" y="-452">dictionary_attack[id]?</label>
			<nail x="-2627" y="-426"/>
		</transition>
		<transition>
			<source ref="id26"/>
			<target ref="id23"/>
			<label kind="synchronisation" x="-2211" y="-367">activate_new?</label>
		</transition>
		<transition>
			<source ref="id25"/>
			<target ref="id21"/>
		</transition>
		<transition>
			<source ref="id23"/>
			<target ref="id24"/>
			<label kind="synchronisation" x="-2048" y="-365">activated!</label>
			<label kind="assignment" x="-2031" y="-340">x2:=0</label>
		</transition>
		<transition>
			<source ref="id22"/>
			<target ref="id26"/>
			<label kind="synchronisation" x="-2363" y="-366">load_binary[id]?</label>
		</transition>
	</template>
	<system>// Place template instantiations here.
MIRAI = Mirai_Master();
CNC_SRV = CnC_Server();
RPT_SRV = Report_Server();

LDR = Loader();

BOT_DF = Bot_Default(0,110);

BOT1 = Bot_t1(4,101);
BOT2 = Bot_t1(1,109);
BOT3 = Bot_t1(3,103);
BOT4 = Bot_t1(5,103);
BOT5 = Bot_t1(2,108);


// List one or more processes to be composed into a system.
system MIRAI, CNC_SRV, RPT_SRV, LDR, BOT_DF, BOT1, BOT2, BOT3, BOT4, BOT5;
    


//************************************************
//Gantt Chart
//************************************************

gantt {

//=====================AGENTS=====================
    //Storage Agent
//    S_Empty:     S.Empty -&gt; Color_Cyan;
    
//=====================SERVERS=====================
    CnC_Server_Active:     CNC_SRV.Active -&gt; Color_Blue;
    Scan_Server_Active:    RPT_SRV.Wait -&gt; Color_Blue;  
    Loading_Binary:        LDR.Loading -&gt; Color_Purple;

//=====================BOTs=====================

    BOT_DF_Scanning:        BOT_DF.Telnet_Port_Scan -&gt; Color_LOrange;
    BOT_DF_Attacking:   BOT_DF.Victim_Found -&gt; Color_Red; 

    BOT_1_safe:    BOT1.Connected -&gt; Color_Green;
    BOT_1_Scanning:     BOT1.Telnet_Port_Scan -&gt; Color_LOrange;
    BOT_1_Attacking:    BOT1.Victim_Found -&gt; Color_Red;

    BOT_2_safe:    BOT2.Connected -&gt; Color_Green;
    BOT_2_Scanning:     BOT2.Telnet_Port_Scan -&gt; Color_LOrange;
    BOT_2_Attacking:    BOT2.Victim_Found -&gt; Color_Red;

    BOT_3_safe:    BOT3.Connected -&gt; Color_Green;
    BOT_3_Scanning:     BOT3.Telnet_Port_Scan -&gt; Color_LOrange;
    BOT_3_Attacking:    BOT3.Victim_Found -&gt; Color_Red;

    BOT_4_safe:    BOT4.Connected -&gt; Color_Green;
    BOT_4_Scanning:     BOT4.Telnet_Port_Scan -&gt; Color_LOrange;
    BOT_4_Attacking:    BOT4.Victim_Found -&gt; Color_Red;

    BOT_5_safe:    BOT5.Connected -&gt; Color_Green;
    BOT_5_Scanning:     BOT5.Telnet_Port_Scan -&gt; Color_LOrange;
    BOT_5_Attacking:    BOT5.Victim_Found -&gt; Color_Red;
}</system>
	<queries>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
		<query>
			<formula>&lt;----- MODEL VERIFICATION -----&gt;</formula>
			<comment></comment>
		</query>
		<query>
			<formula>A[] !deadlock</formula>
			<comment>Deadlocks never occur</comment>
		</query>
		<query>
			<formula>A[] deadlock imply current_number_bots==total_devices-1</formula>
			<comment>A deadlock implies that all devices have been infected</comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
		<query>
			<formula>&lt;----- INFECTION REACHABILITY -----&gt;</formula>
			<comment></comment>
		</query>
		<query>
			<formula>A&lt;&gt; current_number_bots==total_devices-1</formula>
			<comment>All devices will always be infected in every possible scenario</comment>
		</query>
		<query>
			<formula>E&lt;&gt; current_number_bots==total_devices-1</formula>
			<comment>It is possible for every device to eventually be infected</comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
		<query>
			<formula>&lt;----- INFECTION TIMES -----&gt;</formula>
			<comment></comment>
		</query>
		<query>
			<formula>A[] total_time==50 imply current_number_bots==total_devices-1</formula>
			<comment>All devices are always infected by 50 time units</comment>
		</query>
		<query>
			<formula>Pr[total_time&lt;=100; 100] (&lt;&gt;current_number_bots==total_devices-1)</formula>
			<comment>The probability all devices are compromised in 100 time units</comment>
		</query>
		<query>
			<formula>Pr[total_time&lt;=50] (&lt;&gt;current_number_bots==total_devices-1)</formula>
			<comment>The probability all devices are compromised in 50 time units</comment>
		</query>
		<query>
			<formula>Pr[total_time&lt;=25] (&lt;&gt;current_number_bots==total_devices-1)</formula>
			<comment>The probability all devices are compromised in 25 time units</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=10; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 10 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=20; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 20 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=25; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 25 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=30; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 30 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=40; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 40 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=50; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 50 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=60; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 60 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=70; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 70 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=80; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 80 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=90; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 90 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>E [total_time&lt;=100; 100] (max: current_number_bots)</formula>
			<comment>The expected number of compromised devices in 100 time units (generated with 100 simulation runs)</comment>
		</query>
		<query>
			<formula>Pr[&lt;=50] (&lt;&gt;in_botnet[1])</formula>
			<comment>The probability bot 1 has been infected by 50 time units</comment>
		</query>
		<query>
			<formula>Pr[&lt;=50] (&lt;&gt;in_botnet[2])</formula>
			<comment>The probability bot 2 has been infected by 50 time units</comment>
		</query>
		<query>
			<formula>Pr[&lt;=50] (&lt;&gt;in_botnet[3])</formula>
			<comment>The probability bot 3 has been infected by 50 time units</comment>
		</query>
		<query>
			<formula>Pr[&lt;=50] (&lt;&gt;in_botnet[4])</formula>
			<comment>The probability bot 4 has been infected by 50 time units</comment>
		</query>
		<query>
			<formula>Pr[&lt;=50] (&lt;&gt;in_botnet[5])</formula>
			<comment>The probability bot 5 has been infected by 50 time units</comment>
		</query>
		<query>
			<formula>Pr[&lt;=25] (&lt;&gt;in_botnet[1])</formula>
			<comment>The probability bot 1 has been infected by 25 time units</comment>
		</query>
		<query>
			<formula>Pr[&lt;=25] (&lt;&gt;in_botnet[1] &amp;&amp; in_botnet[2])</formula>
			<comment>The probability bots 1 and 2 have been infected by 25 time units</comment>
		</query>
		<query>
			<formula>Pr[&lt;=25] (&lt;&gt;in_botnet[1] &amp;&amp; in_botnet[2] &amp;&amp; in_botnet[3])</formula>
			<comment>The probability bots 1, 2 , and 3 have been infected by 25 time units</comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=100; 100] {current_number_bots}</formula>
			<comment>simulate 100 runs for 100 time units each and plot the number of infected bots against simulation time</comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=100; 100] {in_botnet[1], in_botnet[2], in_botnet[3], in_botnet[4], in_botnet[5]}</formula>
			<comment>simulate 100 runs for 100 time units each and plot when each bot becomes infected</comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
		<query>
			<formula>&lt;----- Network Traffic -----&gt;</formula>
			<comment></comment>
		</query>
		<query>
			<formula>Pr[&lt;=32] (&lt;&gt; total_messages&gt;75)</formula>
			<comment>Probability that at least 75 messages are sent over the network in 32 time units (which is the expected time the infect all 5 devices)</comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=100; 100] {total_scans, total_attempts} : current_number_bots==total_devices-1</formula>
			<comment>Simulate 100 runs for either 100 time units, or until every bot is infected, and plot the number of network scans and login attempts</comment>
		</query>
		<query>
			<formula>simulate [total_time&lt;=100; 100] {total_messages} : current_number_bots==total_devices-1</formula>
			<comment>Simulate 100 runs for either 100 time units, or until every bot is infected, and plot the number of messages sent over the network</comment>
		</query>
		<query>
			<formula></formula>
			<comment></comment>
		</query>
	</queries>
</nta>