System for dynamically provisioning cyber training environments
11600198 · 2023-03-07
Assignee
Inventors
- Laura Lee (San Diego, CA)
- Raymond C. Prouty (San Diego, CA, US)
- Joseph T. Kowtko (Jamesburg, NJ, US)
- Ryan Pressley (Saltillo, MS)
Cpc classification
G06N3/006
PHYSICS
G09B7/00
PHYSICS
A63F9/24
HUMAN NECESSITIES
A63F13/63
HUMAN NECESSITIES
G06F3/00
PHYSICS
H04L67/131
ELECTRICITY
A63F13/00
HUMAN NECESSITIES
International classification
A63F9/24
HUMAN NECESSITIES
A63F13/63
HUMAN NECESSITIES
G09B7/00
PHYSICS
G06F3/00
PHYSICS
G09B19/00
PHYSICS
A63F13/00
HUMAN NECESSITIES
G06N3/006
PHYSICS
H04L67/131
ELECTRICITY
Abstract
Methods and systems allow a user or operator to easily create cyber-training environments for use in a cyber-training system. In one embodiment, the environments are configured as missions. The missions may have a plurality of features, such as training objectives, a mission storyline, a mission order and mission objectives, relative to a mission environment. The mission environment comprises a virtual environment, such as defined by a virtual network having virtual machines or devices.
Claims
1. A mission system for a cyber-training system configured to implement one of a plurality of different missions comprising: at least one user station, each user station comprising at least one display device, at least one user input device, a memory device, and at least one controller; and at least one mission server, said at least one mission server comprising: a processor configured to execute machine readable code; at least one communication interface which permits said server to transmit information to said at least one user station and to receive information from said at least one user station; a data storage device accessible by said processor; and a mission database stored on said data storage device, said mission database storing a plurality of missions, each mission having a plurality of variable mission parameters, wherein said variable mission parameters are associated with corresponding mission plugins, wherein one or more of the mission parameters of one or more of said missions are different from one another, and wherein when a selected one of said plurality of missions is selected and executed by said cyber-training system, said mission parameters associated with said selected mission cause said cyber-training system to generate a virtual cyber mission environment and an associated mission having features which vary depending upon said mission parameters.
2. The mission system in accordance with claim 1 wherein said mission plugins comprise one or more of a storyline plugin, a mission setup plugin, a mission order plugin, a mission objective plugin, a solution and hints plugin, a network map plugin, an events plugin, a questions and answers plugin, a quizzes plugin and a mission library plugin.
3. The mission system in accordance with claim 2 wherein when said storyline plugin is selected, a storyline user interface is presented to prompt the user to enter parameters for one of said missions comprising a storyline text and/or a storyline video.
4. The mission system in accordance with claim 2 wherein when said mission setup plugin is selected, a creating new mission interface is presented to the user prompting the user to enter parameters for one of said missions comprising a mission name, a mission description, and a mission difficulty of a new mission.
5. The mission system in accordance with claim 2 wherein when said mission order plugin is selected, a mission order interface is presented to the user prompting the user to generate parameters for one of said missions comprising written mission orders.
6. The mission system in accordance with claim 2 wherein when said mission objective plugin is selected, a mission objective interface is presented to the user prompting the user to generate parameters for one of said missions comprising written mission objectives including at least one of an objective name, an objective score, skills addressed by an objective, an umpire check associated with an objective that forms a basis for automated scoring, and (4) List of Existing Objectives.
7. The mission system in accordance with claim 2 wherein when said solution and hints plugin is selected, a solution and hints interface is presented to the user prompting the user to generate parameters for one of said missions comprising a solution and at least one associated hint for each mission objective.
8. The mission system in accordance with claim 2 wherein when said network map plugin is selected, a network map interface is presented to the user presenting network map option parameters options for one of said missions to the user.
9. The mission system in accordance with claim 8 wherein said network map options include an option to show OS type, an option to show a simple name, an option to show an IP address, an option to show services, and an option to show key terrain.
10. The mission system in accordance with claim 9 wherein when the show key terrain option is selected, a key terrain ranking is displayed on network elements in the network map designated as key elements.
11. The mission system in accordance with claim 2 wherein when said events plugin is selected, a mission objective interface is presented to the user prompting the user to select parameters for one of said missions comprising added events to the mission and a designated event type.
12. The mission system in accordance with claim 2 wherein when said questions and answers plugin is selected, a questions and answers interface is presented to the user prompting the user select parameters for one of said mission comprising adding, deleting or editing questions and answers including a question and answer category.
13. The mission system in accordance with claim 2 wherein when said quizzes plugin is selected, a quizzes interface is presented to the user prompting the user select parameters for one of said missions comprising written questions each having a user selected difficulty ranking and at least one associated skill.
14. The mission system in accordance with claim 2 wherein when said mission library plugin is selected, a mission library interface is presented to the user presenting mission information concerning a mission selected by the user from a local file system.
15. The mission system in accordance with claim 1 wherein said machine readable code is configured to generate a top-level graphical user interface displayed on said user station, the top-level graphical user interface displaying the mission plugins as a plurality of selectable tabs, wherein when a user selects one of the tabs, the corresponding graphical user interface for the selectable plugin is displayed.
16. The mission system in accordance with claim 15 wherein the selectable tabs corresponding to the mission plugins on the top-level user interface each include a designator having a visual indication of a completion state of data needed by the corresponding mission plugin to have a complete mission.
17. The mission system in accordance with claim 1 wherein said plurality of missions are editable by a user of said user station.
18. The mission system in accordance with claim 17 wherein in response to input from said user to edit one of said missions in said mission database, a graphical user interface is displayed at said user station, said graphical user interface including a plurality of selectable elements corresponding to said mission plugins, permitting selection of individual ones of said plugins.
19. The mission system in accordance with claim 1 further comprising a global data logger configured to maintain and share information among the plurality of mission plugins.
Description
DESCRIPTION OF THE DRAWINGS
(1)
(2)
(3)
(4)
(5)
(6)
(7)
(8)
(9)
(10)
(11)
(12)
(13)
(14)
(15)
(16)
(17)
(18)
(19)
(20)
(21)
(22)
(23)
(24)
(25)
(26)
(27)
(28)
(29)
(30)
(31)
(32)
(33)
(34)
(35)
(36)
(37)
(38)
(39)
(40)
(41)
(42)
(43)
(44)
(45)
(46)
(47)
(48)
(49)
(50)
(51)
(52)
(53)
(54)
(55)
(56)
(57)
(58)
(59)
(60)
(61)
(62)
(63)
(64)
(65)
(66)
(67)
(68)
(69)
DETAILED DESCRIPTION OF THE INVENTION
(70) In the following description, numerous specific details are set forth in order to provide a more thorough description of the present invention. It will be apparent, however, to one skilled in the art, that the present invention may be practiced without these specific details. In other instances, well-known features have not been described in detail so as not to obscure the invention.
(71) Embodiments of the invention comprise methods and system for creating or generating cyber environments, and preferably methods and systems for designing and configuring specific training mission hardware and software environments.
(72)
(73) In one embodiment shown in
(74) As illustrated in
(75) The mission database 46 can include a plurality of preconfigured missions as well as missions that have been saved by mission developers, such that the mission database 46 may grow over time. A mission designer can design a mission from scratch or start from one of the preconfigured or saved missions and use that mission without change or after modifying the mission.
(76) The Orion system is a cyber mission builder and provides the capability for creating and editing of a new cyber scenario or mission that can be used in a training environment or platform. For example, using the system, a user can create scenarios involving how to defend a bank's network from a financial attack using ransomware or a scenario where a hacker tries to steal credit card data. Orion is used to develop new missions and content. It is used by mission designers, not end users of cyber training.
(77)
(78) The Ares game system may include an automated advisor, such as an automated artificial intelligence advisor (such as under the name “Athena”). This advisor may, for example, be capable of providing a player assistance during a game, such as by answering player questions or providing hints, among other things. The Ares game system may also include an “umpire” (which may be implemented as part of the advisor, or separately therefrom). The umpire may, for example, score the player based upon their actions (and/or inactions) during the mission.
(79) Relative to the Ares system (or similar systems), the Orion system of the present invention preferably allows an operator to create or generate different missions (e.g., objective-based assignments within a defined environment, such as a cyber environment which includes a virtualized network).
(80) In one embodiment, the high-level architecture of the system is a plugin paradigm using a state-machine life-cycle. Each plugin 44 is an independent wizard for adding/modifying one aspect of the mission. The plugins 44 are maintained by a controller which messages state changes with each plugin. There is a general method for communications between plugins. A global logger 42 is maintained.
(81) A top-level state machine (TLSM) is implemented that supports the mission building guidelines. The purpose of the TLSM is to provide a concrete implementation of the guidelines. It will provide a means to collect and store artifacts that are produced outside of the Orion environment (e.g., mission video, adversary attack motivations, mission art, . . . )
(82) The status of the TLSM is maintained by the Orion controller and is visible in a panel on the graphical user interface (GUI). The panel can be hidden/displayed at any time.
(83) Orion Controller
(84) The Orion or system controller 48 provides the glue for the application—keeping track of what is going on and communicating to individual plugins 44 as needed. Table 1 describes the Orion System Controller States.
(85) TABLE-US-00001 TABLE 1 State Actions Start The application is started. The main window is created. The Controller and Logger are instantiated. The environment is probed (username, machine name, OS, etc). Command arguments are processed. Discover Appropriate directories are searched for wizard plugin class files. Initialize Each plugin is instantiated with a reference to the Controller, a reference to the global Logger, a reference to the main menu bar, and a graphical container for it to display its content. A tab is generated for the plugin on the main window as in FIG. 1. Idle There are no pending user commands to process at the main window or main menu level. Open Open an existing mission Create Create a new mission. The controller will create a data directory for each plugin under the main mission directory. Save The loaded mission is being saved. This requires integrating the saves of each plugin Cleanup The application is shutting down Error An unrecoverable error has occurred
(86) Global Data Singleton
(87) Orion has some data which is “shared” among the plugins. To maintain the integrity of the data, the data is preferably maintained by a (set of) global data singleton(s). In one embodiment, the following data is included:
(88) (1) Master Services List from database
(89) (2) Master Detections List from database
(90) (3) Master Umpire Check Callback Functions from database
(91) (4) Master Service Events from database
(92) (5) Master Adversary Events from database
(93) (6) Master Malware List from database
(94) (7) Master Badges/Skills List from database
(95) (8) Master Quiz Questions List from database
(96) (9) Master Virtual Machine (VM) Templates from database
(97) (10) Master Tools List from database
(98) (11) Current Mission Objectives and associated Umpire Detections
(99) (12) Current Mission Network Diagram Node Information
(100) (13) Current Mission service/detection variable data
(101) The master data is preferably read in when the singleton is instantiated. At this time, the singleton will check to see if there are updates to the master from the mission design databases and use those.
(102) Current mission data is read in when a mission is opened (or structure created when new mission is created).
(103) Any data which may be editable within Orion is accessed in a synchronized manner.
(104) Plugin States
(105) At startup, all plugins are disabled until a mission is opened or created. Once a mission is active, each plugin tab 12 indicates the state of that plugin, such as shown in table 2. These plugin states are used when switching to a different mission to determine action needed, such as illustrated in
(106) TABLE-US-00002 TABLE 2 PLUGIN STATE COMMENT TAB LED READY_DIRTY Plugin has all the data it Green Flashing needs, but it has unsaved changes. READY_CLEAN Plugin has all the data it Green Solid needs, no save needed. NOT_READY_DIRTY Plugin does not have all Red Flashing the data it needs, and it has unsaved changes. NOT_READY_CLEAN Plugin does not have all Red Solid the data it needs, but no save is needed.
(107) Inter-Plugin Communication
(108) A general method of plugin to plugin communication is provided. In one embodiment, this communication is a messaging mechanism similar to a post office. One plugin posts a message (e.g., mission objectives when objective added) and other plugin(s) gets the post and processes it as appropriate (e.g., solution and hints to add another page for the new objective).
(109) The processing may use threads with a behind-the-scenes wait-notify mechanism. In one embodiment, messages are not received on the GUI thread, so no direct drawing occurs as a result.
(110) Messages
(111) The PluginMessage class provides the structure for the message to be sent. A message consists of: (1) Source (the plugin that sent the message); (2) Source Name (the name on the plugin tab; (3) Message ID (defined in PluginMessageType enum); and (4) Payload (any object to send—simple or complex).
(112) Messages are not sent over a socket so the payload is not being serialized—the actual object arrives at the other plugins who in principal could corrupt the object.
(113) Message Types
(114) PluginMessageType enum contains the IDs for the messages. Current values may be: (1) Objectives and (2) Text.
(115) Sending Messages
(116) Every plugin has a method postMessage(MessageType type, Object payload). This creates a message with the plugin as the source, the plugin tab name as the source name, and the type and payload given.
(117) Example: postMessage(MessageType.objectives, objectives) where objectives is an object that contains the objectives.
(118) All plugins get the message. Those that have need of it use it, others ignore it.
(119) The Log Plugin
(120) The log plugin simply logs every message it gets—keeping a record of messages posted in the log tab.
(121) Processing Messages
(122) Every plugin implements the interface IMessageProcessor. It contains one method processMessage(PluginMessage message). The default implementation will do nothing. Override processMessage to be able to handle message(s). For example:
(123) TABLE-US-00003 @Override public void processMessage(PluginMessage message) { switch(message.getType( ) { case objectives: dosomething(message.getPayload( ); break; case (whatever) break; } }
(124) processMessage is called on a separate (non-GUI) thread.
(125) Webswing Configuration
(126) When Orion is configured as a thin client using the web browser to deliver Orion capability, Webswing is used to present the Orion experience to the user. Webswing provides a Javascript client, which mirrors a running Java app (such as Orion) on the server. Webswing captures Swing draw calls, and sends it to the Javascript client via a secure websocket connection, which then mirrors the draw call.
(127)
(128) Security Model
(129) Data in Transit
(130) Data which traverses an external network (not localhost) will utilize TLS v1.2. This is between the Mission Server and Orion. The connections utilize both client and server authentication using certificates signed by a recognized Certificate Authority.
(131) Mission Building
(132) Mission Definition
(133) Basic information for the mission is defined when the mission is created. These parameters include one or more of:
(134) (1) Organization
(135) (2) Mission Name
(136) (3) Mission Description
(137) (4) Mission Number as a unique identifier when combined with an organization
(138) (5) Mission Level of Difficulty
(139) As illustrated in
(140) Create New Mission
(141) One example of a methodology for creating a new mission is as follows:
(142) Click File.fwdarw.New Mission from the mission setup plugin in
(143) Enter the desired Organization Prefix, Mission Name, Mission Description, Mission Number and choose a Mission Difficulty.
(144) Select/browse to the place where the mission is to be stored and click the New Mission button 82. A folder is created in the selected folder titled <prefix>_mission_<number>_<difficulty> (e.g. XYZ_mission_1_Easy).
(145) Click the Cancel button to exit the dialog without creating a mission.
(146) Open Existing Mission
(147) One example of a methodology for opening an existing mission is as follows:
(148) Click File.fwdarw.Open Mission . . . to bring up an Open dialog 90 (see
(149) Browse to the folder containing the desired mission.
(150) Select the mission and click the Open button. Orion tabs will populate with the current data of the mission.
(151) Click the Cancel button to exit the dialog without opening a mission.
(152) Unsaved Changes
(153) When switching to another mission (either by creating a new mission or opening a different existing mission) or exiting the Orion application when unsaved changes exist, the Save Changes dialog 100, such as illustrated in
(154) Click the Yes button to save the changes prior to switching mission or exiting Orion. Click the No button to switch or exit without saving the changes.
(155) Save Mission
(156) To save the current mission, click File.fwdarw.Save Mission . . . . The mission data for each tab is saved in a folder under the main Mission folder.
(157) Many of these tabs also provide for save of just their associated information (see appropriate section in this document).
(158) Copy Mission
(159) To copy the currently loaded mission to a new one,
(160) Click File.fwdarw.Save Mission As . . . to bring up the Save Mission As dialog 110 (see
(161) Edit the Organization Prefix, Mission Name, Mission Description, Mission Number and Mission Difficulty as desired using the dialog 110.
(162) Select/browse to the place where the mission is to be stored
(163) Click the New Mission button. The current mission data is copied to the new mission.
(164) Click the Cancel button to exit dialog without creating a copy of the mission.
(165) Advanced Mission Settings
(166) In a preferred embodiment, control parameters for executing the Orion mission are defaulted to typical values and can be modified by the Mission Designer.
(167) To modify the parameters:
(168) Click File.fwdarw.Advanced Mission Settings . . . to bring up the Advanced Mission Settings dialog 120,
(169) Default Location: If you have multiple locations where your virtual machines (VMs) are stored, you can select which location by numeric value here.
(170) Boot Timeout: If the virtual machines in the mission don't start up within this time, the mission will fail. If you have a very large number of virtual machines, this may need to be a larger value.
(171) Publish Timeout: If all the umpire checks, orchestration and transformations don't load and complete within this amount of time, the mission will fail. If you are doing a lot of manipulations of your base virtual machines, you may want a longer duration for a publish timeout.
(172) Time Limit: After this period of time, your mission will suspend and all your VMs are suspended along with it.
(173) Enter desired changes to the parameters and click the OK button. The dialog closes. Parameter changes is saved when the mission is saved.
(174) Click the Cancel button to close the dialog without making any changes.
(175) Exporting Mission Definition
(176) The following items may be included in the export:
(177) Mission Orders.fwdarw.orders.xml (in export/Assets folder)
(178) Objectives with associated skills and umpire checks, solutions and hints.fwdarw.services_0.yaml
(179) Network Map.fwdarw.out.xml (in export/Network_Map folder)
(180) Events.fwdarw.msel.json (in export/Events folder)
(181) Athena Q&A defined in this mission (Mission_Questions.txt, General_Questions.txt, Athena_Questions.txt)
(182) Quizzes defined in this mission (quiz.txt)—a Quiz Q&A.csv file is also created for easy viewing.
(183) Mission parameters (vem.yaml, vsphere.yaml)
(184) Some tabs also provide for import and/or export of just their associated information (see appropriate section in this document).
(185) To export Orion mission information, click File.fwdarw.Export Mission. The Export Summary dialog 130,
(186) Click the Close button to close the dialog. The appropriate file(s) is created in the export folder under the main mission folder as illustrated in
(187) Mission Storyline
(188) The storyline component or backstory of the system (an introduction to the user or player of the mission which provides them information regarding the mission, such as a background or plot for the mission) may include a video 140 as depicted in
(189) To access the Storyline, click on the Storyline tab in the interface of
(190) Storyline Menu Items
(191) When the Storyline tab is selected, the items under the Storyline Menu 150 at the top of the page are available as shown in
(192) Import Video
(193) To import a video for the mission,
(194) Click Storyline.fwdarw.Import Video File . . . to bring up an Open dialog. (Clicking the Cancel button will close the dialog and without continuing the import process.)
(195) Browse to the folder containing desired video file.
(196) Select the video file and click the Open button. The video is imported to the mission and displayed/started in the Video Player area of the tab.
(197) Click the Cancel button to exit the dialog without importing a video file.
(198) Remove Video
(199) To remove a video from the mission,
(200) Click Storyline.fwdarw.Remove Video File as shown in
(201) Click the Yes button to remove the video. The video is removed from the mission. (Or click the No button to cancel removal.)
(202) Save Storyline
(203) Click Storyline.fwdarw.Save Storyline Data to save the current information on this tab for the mission.
(204) Defining the Storyline
(205) The storyline gives the context for the mission in the form of introductory video and or text depicted in
(206) Video Player Area
(207) The Video Player area is where the mission video can be viewed.
(208) Click the Play/Pause icon to play or pause the video.
(209) The Now Playing area provides information about the location/size/duration of the video.
(210) Storyline Text
(211) Enter any desired storyline text into the text area.
(212) Mission Order
(213) The Mission Order component may define the following areas for the mission as depicted in the mission orders menu 160 of
(214) (1) Situation—Describe overall scenario and threat intelligence information
(215) (2) Mission—Describe the specific mission and skills or core competencies required to go on mission
(216) (3) Execution—Describe the purpose, key tasks, end state and concept of operations to include user credentials and tools
(217) (4) Sustainment—Describe how long the mission should take and any requirements on the end of the mission
(218) (5) Command and Control (C&C)—Describe who commands this mission above the Team Lead and any reporting requirements
(219) (6) Rules of Engagement (ROE)—Describe any rules about the virtual environment to include out-of-bounds list, tools, traffic generation and key services that must be maintained
(220) (7) References—for each mission objective or task in the Execution description above, provide a list of references that players should read.
(221) These orders are shown in the game environment, such as in the format illustrated in
(222) To access Mission Orders, click on the Mission Orders tab of
(223) Mission Order Menu Items
(224) When the Mission Orders tab is selected, the items under the Mission Order Menu at the top of the page are available.
(225) Save Mission Order
(226) Click Mission Order.fwdarw.Save Mission Order to save the current information on this tab for the mission.
(227) Import Mission Order
(228) To import the Mission Order from another mission,
(229) Click Mission Order.fwdarw.Import Mission Order from the game environment to bring up an Open dialog. (Clicking the Cancel button will close the dialog and without continuing the import process.)
(230) Browse to the folder containing desired mission orders.xml file.
(231) Select the desired file and click the Open button. Any current mission order information is replaced with information from the selected file.
(232) Click the Cancel button to exit the dialog without changing the current mission order information.
(233) Export Mission Order
(234) Click Mission Order.fwdarw.Export Mission Order to save the current Orion Mission Order in the correct format. An Export Successful dialog is presented
(235) The orders.xml file is saved in the Assets folder within the export folder under the main mission folder.
(236) Defining the Mission Order
(237) Select the desired area from the list in the toolbar 170, such as illustrated in FIG. 18, for which to define the mission order. The appropriate “page” of data is displayed with any current text.
(238) Use the edit area to describe this area of the mission order as depicted in
(239) Mission Order Page Settings
(240) Mission Order Page Settings provides access to settings for the Mission Order page. Currently the Image Type may be set.
(241) Click the Settings icon to bring up the Page Settings dialog 190,
(242) Select the image type among the choices watermark, background and none for this page and click the OK button. The settings are changed and stored with the Mission Order page.
(243) Click the Cancel button to close the dialog without making any changes.
(244) Mission Objectives
(245) The Mission Objectives component defines the objectives for the mission and associated badges/skills and umpire checks along with relative scoring.
(246) Mission objectives may be viewed in the game environment while playing the game as shown in the mission objectives interface 200 of
(247) To access the Mission Objectives, click on the Mission Objectives tab of
(248) Mission Objectives Menu Items
(249) When the Mission Objectives tab is selected, the items under the Mission Objectives Menu 210 of
(250) Save Mission Objectives
(251) Click Mission Objectives.fwdarw.Save Mission Objectives to save the current information on this tab for the mission.
(252) Import Mission Objectives
(253) To import mission objectives and associated skills and umpire checks, solutions and hints from an existing mission (or previously saved/exported Orion mission data),
(254) Click Mission Objective.fwdarw.Import Objectives. This brings up an Import Objectives confirmation dialog warning about data replacement.
(255) Click the OK button to bring up an Open dialog. (Clicking the Cancel button will close the dialog and without continuing the import process.)
(256) Browse to the folder containing desired mission services_0.yaml file.
(257) Select the desired file and click the Open button. Any current mission objectives and associated information is replaced with information from the selected file.
(258) Click the Cancel button to exit the dialog without changing the current objective information.
(259) Export Mission Objectives
(260) Click Mission Objective.fwdarw.Export Objectives to save the current Mission Objectives and associated skills and umpire checks, solutions and hints in the correct format. An Export Successful dialog is presented showing that the services_0.yaml file has been saved in the export folder under the main mission folder. Click the OK button to acknowledge and close the dialog.
(261) Defining the Mission Objectives
(262) The Mission Objectives tab illustrated in
(263) Define Objective Name
(264) The objective name may be edited at any time in the Objective field at the top of the tab. The current objective number is shown above the field.
(265) Assign Objective Score
(266) The objective score may be chosen at any time by selecting the desired value from the Score dropdown at the top of the tab. The score could be based on “How hard is this objective on a scale of 1 to 10?”.
(267) Add Objective
(268) To add an objective, click the Add Objective button 212 at the top of the tab. This will increment the objective count and provide a blank objective/set of skills and umpire checks for definition of a new objective. It will also add a “blank” objective to the Existing Objectives list.
(269) Fill in the Objective name, Score, and associate appropriate Skills and Umpire Check.
(270) Copy Objective
(271) To copy the currently displayed objective
(272) Click the Copy Objective button 214 at the top of the tab. This will add an objective with a blank name to the end of the list with the same skill(s), umpire check and score as the current objective.
(273) Fill in the objective name.
(274) Reorder objectives if needed.
(275) Delete Objective
(276) To delete the currently displayed objective, click the Delete Objective button 216 at the top of the tab. This brings up the Delete Objective dialog.
(277) Click the OK button to delete the objective (or click the Cancel button to close the dialog without deleting the objective). The currently displayed objective and associated skills and umpire check is removed and remaining objectives renumbered appropriately.
(278) Next Objective
(279) To display the next objective, click the Next button 218 at the top of the tab. The information for the next objective is displayed.
(280) Previous Objective
(281) To display the previous objective, click the Previous button 220 at the top of the tab. The information for the previous objective is displayed.
(282) Select Existing Objective to Display
(283) To display a specific objective, click on the row in the Existing Objectives list 222 and the objective information for that objective is displayed.
(284) Reorder Objectives
(285) To reorder an objective, select an objective in the Existing Objectives list 222 and drag up or down the list to desired location. The objectives are renumbered automatically.
(286) Objective Skills
(287) Associate Skills
(288) To associate skill(s) with an objective:
(289) (1) Select the desired objective in the list of objectives. The list of skills available are displayed in the skills interface 230 of
(290) (2) Click the Select checkbox 232 next to desired skill(s) OR click in the associated skill text field. The associated skill is highlighted and the score selection box is enabled.
(291) (3) Select the desired Skill Score 234 from the list (how hard is this skill on a scale of 1 to 10?).
(292) To disassociate the skill, click on the checkbox (OR associated skill text field) again to clear it.
(293) Search for Skill
(294) To search for specific skill, enter text to search for in the Search for Skills dialog in
(295) Each skill that matches the entered text is outlined as shown in
(296) Use the Down Arrow and Up Arrow buttons to scroll to next/previous occurrence of the entered text. The one that is scrolled to is outlined with a slightly darker outline.
(297) Objective Umpire Checks
(298) Umpire checks form the basis of automated scoring and are required for each mission objective.
(299) Associate Umpire Check
(300) To associate a single umpire check with an objective:
(301) (1) Select the desired objective in the list of objectives in
(302) (2) Click the Select checkbox 242 next to desired umpire check OR click in one of the associated umpire check text fields. The associated umpire check is highlighted.
(303) To disassociate the umpire check, click on the checkbox (OR associated umpire check text field) again to clear it. Selecting a different umpire check will also clear the previously selected one.
(304) Search for Umpire Check
(305) To search for specific umpire check, enter text to search for in the Search Checks for: field 244. The number of results (if any) is shown to the right.
(306) Each umpire check whose description and/or name matches the entered text is outlined as shown in
(307) Use the Down Arrow and Up Arrow buttons to scroll to next/previous occurrence of the entered text. The one that is scrolled to is outlined with a slightly darker outline.
(308) Solutions and Hints
(309) The Solutions and Hints component defines the solution and associated hint(s) for each mission objective. The solution walks the player through the objective. The hints provide multiple statements to lead the player to the solution.
(310) Viewing hint(s) will result in loss of points. The PDF link under the set of objective hints provides the solution for that objective as depicted in
(311) To access the Solutions and Hints, click on the Solution and Hints tab from
(312) Solution and Hints Menu Items
(313) When the Solutions and Hints tab is selected, the items under the Solution and Hints Menu at the top of the page are available. The interface of
(314) Save Mission Solution
(315) Click Solution and Hints.fwdarw.Save Mission Solution to save the current information on this tab for the mission.
(316) Defining the Solutions and Hints
(317) Defining the Solutions and Hints is illustrated in interface 252 of
(318) Select Objective
(319) To choose an objective, select the desired one from the drop down list of names at the top of the tab. The Solution and Hints area will automatically be filled in with any existing information for that objective.
(320) Define Solution
(321) Use the Solution area shown in
(322) Add Hint
(323) Initially there is a “blank” Hint shown for which text can be entered as illustrated in
(324) Typically, the full solution is written and then pieces of it are used as hint(s).
(325) Network Map
(326) The Network Map component shown in
(327) Network Map Menu Items
(328) When the Network Map tab is selected, the items under the Network Map Menu at the top of the page are available.
(329) Save Network Map
(330) Click Network Map.fwdarw.Save to save the current information on this tab for the mission.
(331) Import Network Map
(332) Click Network Map.fwdarw.Import . . . to browse to and open a previously saved Orion Network Map. The network data is filled in on the map.
(333) Export Network Map
(334) Click Network Map.fwdarw.Export to save the current Orion Network Map in the correct format for game environment. An Export Successful dialog is presented showing that the out.xml file has been saved in the Network_Map folder within the export folder under the main mission folder. Click the OK button to acknowledge and close the dialog.
(335) Clear Drawing
(336) Click Network Map.fwdarw.Clear Drawing to remove ALL items from the current network map.
(337) If changes have been made to the network map which have not been saved, the Discard Changes dialog is displayed.
(338) Click the Yes button to close the dialog and remove ALL items from the current network map OR click the No button to close the dialog without clearing the network map.
(339) Duplicate
(340) Click Network Map.fwdarw.Duplicate to make a copy of the currently selected node on the network map. All associated attributes (name, IP Address, OS, services . . . ) are also copied.
(341) Zoom to Fit
(342) Click Network Map.fwdarw.Zoom to Fit to zoom in to whatever resolution necessary to show ALL items in the network map area.
(343) Snap to Grid
(344) Click Network Map.fwdarw.Snap to Grid to toggle the alignment of nodes to the grid as they are dragged on the network map. Checkmark indicates the feature is turned on.
(345) Snap Size
(346) Click Network Map.fwdarw.Snap Size to adjust the size of the grid. The current size is shown on the menu.
(347) Options
(348) Click Network Map.fwdarw.Options to toggle the viewing of various details on the network map as shown in
(349) Show OS Type—view the operating system (OS) for the node(s) on the network map.
(350) Show Simple Name—view the name assigned to the node(s) on the network map.
(351) Show IP Address(es)—view all non-control IP Addresses assigned to the node(s) on the network map.
(352) Show Control IP Address—view the control IP Address assigned to the node(s) on the network map (“Control:” is prepended to the address).
(353) Show Services—view the service(s) assigned to the node(s) on the network map.
(354) Show Key Terrain—view indication as depicted in
(355) Network Map Toolbar
(356) The Network Map Toolbar provides quick access to items for working with the network map of
(357) The Select icon is the default and allows for selections on the network map.
(358) The Camera icon provides a means to capture and save an image of the current network map. Click this icon to bring up a Save dialog. Browse to desired location, name the file and click the OK button. Click the Cancel button to close the dialog without saving.
(359) The Rubberband Zoom icon shown in
(360) The Zoom In icon increases the size of displayed items viewed on the network map.
(361) The Zoom Out icon decreases the size of displayed items viewed on the network map.
(362) The Undo Previous Zoom icon reverses the last zoom action performed.
(363) The Panning icon provides a means to manually move the viewing area of the network map. Click on this icon and then click and hold on the map while moving the cursor to desired viewing area.
(364) The Re-center icon provides a means to manually center the viewing area of the network map at a particular point. Click on this icon and then click on desired center point on the network map.
(365) The Restore Original Zoom icon resets the zoom level of the network map to the default size.
(366) The Refresh icon redraws the page.
(367) The Node Box icon provides a means to encapsulate a set of node(s) within a defining box. Click this icon, then click on the network map, hold and drag to enclose desired node(s) and release (the box can be renamed).
(368) The Connector icon provides a means to connect two items (nodes or boxes) on the network map with a straight line. Click this icon, then click the first item to be connected on the network map and click the second item to be connected. A straight-line connector is shown between the two items.
(369) The Elbow Connector icon provides a means to connect two items (nodes or boxes) on the network map with a right-angled connector. Click this icon, then click the first item to be connected on the network map and click the second item to be connected. A right-angled set of line segments is show between the two items (if the two items are in line with each other—horizontally or vertically—a straight line is shown).
(370) The Delete icon deletes any selected items on the network map. If a selected item has connector(s), the connector(s) will also be deleted.
(371) Network Map Components
(372) The left panel of the Network Map tab provides elements to define and identify information for items on the network map.
(373) Nodes Palette
(374) The Nodes palette as shown in
(375) Attributes Palette
(376) The Attributes palette shown in
(377) The Services icon is the first icon in the set.
(378) Click on this icon and then click on the node on the network map for which service(s) are to be assigned. This will bring up the Services dialog.
(379) Select the desired service(s) by selecting them in list. To select multiple, hold down shift key (for multiple in succession) or ctrl key (for separate items). Unselecting a service removes its association with the node.
(380) Click the OK button to apply the services to the selected node (or click the Cancel button to close the dialog without changing).
(381) The Key Terrain icon is the second icon in the set.
(382) Click on this icon and then click on the node on the network map for which key terrain value is to be (un)assigned. This will bring up the Key Terrain dialog.
(383) Select the desired value.
(384) Click the OK button to apply the level to the selected node (or click the Cancel button to close the dialog without changing).
(385) The Operating System icon is the third icon in the set.
(386) Click on this icon and then click on the node on the network map for which the operating system is to be assigned. This will bring up the Operating System dialog.
(387) Select the desired operating system. Unselecting the operating system removes its association with the node.
(388) Click the OK button to apply the operating system to the selected node (or click the Cancel button to close the dialog without changing).
(389) Mouseover Feedback
(390) The Mouseover Feedback area shown in
(391) Editable Properties
(392) The Editable Properties area shown in
(393) Network Map Graph Area Actions
(394) This section describes the various actions which can be taken on the Network Map Graph Area while defining the network.
(395) Position Items on Network Map
(396) Nodes and Boxes may be moved on the network map.
(397) Click on the item to be moved (hold down mouse button and drag to encompass an area with multiple items).
(398) Click again on selected item/area and drag to desired location.
(399) Arrange Item
(400) Nodes and Boxes may be arranged in a specified order for viewing. This is important when two or more items overlap because it determines which one(s) are in front or back.
(401) Right Click on the item shown in
(402) Lock Item
(403) Nodes and Boxes may be “locked” so that they cannot be selected, edited or moved within the network map.
(404) Right Click on the item to be locked and select Locked as shown in
(405) Right Click on the item and select this option again to unlock the item as shown in
(406) Defining the Network Map
(407) Use the Network Map Graph Area to define the network map for the mission as shown in
(408) Select from various node types and add to the network map (see Nodes Palette section).
(409) Select from various attributes and apply to each node on the map (see Attributes Palette section).
(410) Connect nodes on the map (see Network Map Toolbar section).
(411) Use boxes to group nodes on the map (see Network Map Toolbar section).
(412) Enter the appropriate properties for each item on the map (see Editable Properties section).
(413) Events
(414) The Events component include a list of various events for the mission.
(415) To access the Events, click on the Events tab of
(416) Events Menu Items
(417) When the Events tab is selected, the items under the Events Menu at the top of the page of
(418) Save Events
(419) Click Events.fwdarw.Save . . . to save the current information on this tab for the mission.
(420) Import Events
(421) To import events for the mission,
(422) Click Events.fwdarw.Import . . . to bring up an Open dialog. (Clicking the Cancel button will close the dialog without continuing the import process.)
(423) Browse to the folder containing desired event file.
(424) Select the event file and click the Open button. The event information is imported into this mission.
(425) Click the Cancel button to exit the dialog without importing the events.
(426) Export Events
(427) Click Events.fwdarw.Export . . . to save the current event information in the correct format for the game environment. An Export Successful dialog is presented showing that the msel.json file has been saved in the Events folder within the export folder under the main mission folder. Click the OK button to acknowledge and close the dialog.
(428) Defining Events
(429) Defining Events as shown in
(430) Add Event
(431) Initially there are several “blank” events shown in the event list with a default Event ID as shown in
(432) To add additional Event(s), click the Add button 260 at the top of the page of
(433) Delete Event
(434) To delete an Event,
(435) Select one of the text fields in the row to be deleted. The Delete button 262 will show the Event ID of the row selected.
(436) Click the Delete button. The row is removed from the list.
(437) Duplicate Event
(438) Select one of the text fields in the row to be duplicated. The Duplicate button 264 will show the Event ID of the row selected.
(439) Click the Duplicate button. The row is duplicated as an additional row is added to the list.
(440) Edit Event Field
(441) General Text Fields
(442) For most fields in the list,
(443) Select the field in the list. This will place any current text in the edit box above the list.
(444) Make changes to the text and click the accept icon. The text is now updated in the list. (Click the cancel icon to clear the edit box and leave the field as it was in the list.)
(445) Note: Select the field in the list again in order to edit.
(446) Event Type Field
(447) To edit the Event Type,
(448) Click in the Event Type field for the event to be defined/changed. This will bring up the Type dialog with the Event ID shown in the title.
(449) Select the desired Event Type and click the OK button. The dialog closes and selected Event Type is shown in the list. (Click the Cancel button to close the dialog without making any change.)
(450) Steps Field
(451) To edit the Steps,
(452) Click in the Steps field for the event to be defined/changed. This will bring up the Steps for id dialog 270 as shown in
(453) Select the desired Step(s) in the list—using shift key to select consecutive rows or ctrl key to select multiple/disjoint rows.
(454) Click the OK button to close the dialog and apply the steps to the event. (Click the Cancel button to close the dialog without changing the event.)
(455) To “reorder” the Steps,
(456) Click in the Steps field for the event to be defined/changed.
(457) Click the Cancel button the Steps dialog to close the dialog.
(458) Now use the edit box above the list to enter/reorder the steps—they must be separated by a space.
(459) Associated Files Field
(460) To view/edit the Associated Files:
(461) Click in the Associated Files field for the event being defined/edited. This brings up the Select Associated Files for: id dialog.
(462) To add a file to the list,
(463) Click the Add icon at the top of the dialog. This brings up an Open dialog.
(464) Browse to/select the desired file.
(465) Click the OK button to close the dialog. The file is listed in the Select Associated Files for: id dialog. (Or click the Cancel button to close the dialog without adding a file.)
(466) Repeat steps a-c to add additional file(s).
(467) Click the OK button. The dialog closes and the first associated file is shown in the list.
(468) To see multiple associated files, click in the Associated Files field again to bring up dialog/view the list in edit box at top of page.
(469) To delete a file from the list,
(470) Select the file(s) to be deleted in the dialog list
(471) Click the Delete icon at the top of the dialog. The file(s) are removed from the list
(472) Click the OK button. The dialog closes and the deleted file(s) are no longer associated with the event.
(473) Sorting Events
(474) To sort the event list by Event ID, click on the Event ID table header for the list. The events are sorted in ascending alphabetic order. Click the header again to sort in descending alphabetic order.
(475) Quizzes
(476) The Quizzes as shown in
(477) To qualify for a mission in the game environment, the player must first answer several quiz questions as depicted in
(478) To access the Quizzes, click on the Quizzes tab.
(479) Quizzes Menu Items
(480) When the Quizzes tab is selected, the items under the Quizzes Menu at the top of the page are available.
(481) Save Quizzes
(482) Click Quizzes.fwdarw.Save Quizzes to save the current information on this tab for the mission.
(483) Search for Questions
(484) There is a “master” list of quiz questions delivered with Orion. These questions may be searched for relevancy to the current mission and included/modified as desired.
(485) Click Quizzes.fwdarw.Search for Questions to bring up the Search for Questions dialog.
(486) Enter the desired criteria to search by (any combination):
(487) Difficulty Level (Any does not constrain the search)
(488) Key Word(s) (specific key words with which question(s) may have been tagged)
(489) Question Content (a string of text to be found in the question)
(490) Answer Content (a string of text to be found in any answer field—correct, wrong options, or detailed answer)
(491) Mission(s) (specific mission(s) for which question(s) may have been tagged).
(492) Skill Content (a string of text to be found in any skill associated with the question(s)).
(493) Click the Search button to review results (or click the Cancel button to close dialog without searching).
(494) If no results are found, No Results Found confirmation is displayed—click the OK button to close the confirmation dialog.
(495) Otherwise, the Select Questions to Include . . . dialog 280 is displayed as shown in
(496) Select the desired question(s).
(497) To select ALL of the questions click the Select All button 284 at the top of the dialog. All Select boxes are checked.
(498) To deselect ALL of the questions click the Deselect All button 286 at the top of the dialog. All Select boxes are unchecked.
(499) To select individual question(s), click the Select box 282 by the desired question(s). Click the box again to unselect.
(500) Click the Apply button 288 to include the selected question(s) in this mission (or Cancel to close the dialog without including any of the questions). Any questions included are automatically added to the quiz question list for the mission.
(501) Export Quiz Questions
(502) Click Quizzes.fwdarw.Export Quiz Questions to export any entered quiz question(s) in the correct format for game environment. An Export Successful dialog is presented showing that the questions which have been defined within this mission have been saved as the Quiz Q&A.csv file in the export folder under the main mission folder.
(503) If there are no quiz questions defined in this mission, an Export Quiz Questions dialog is brought up.
(504) Click the OK button to acknowledge the information. No export file is created.
(505) Defining the Quizzes
(506) The Quizzes tab 290 as illustrated in
(507) Question navigation
(508) Question entry
(509) Associated Skills
(510) List of Existing Questions (with associated skill(s))
(511) Assign Question Difficulty
(512) The question difficulty may be chosen at any time by selecting the desired value from the Difficulty drop down. If the question could apply to multiple difficulty levels, choose
(513) “Any”.
(514) Define Question
(515) Enter text for the Question, multiple choice answers (Answer, Wrong1, Wrong2, Wrong3), Detailed Answer (explanation), Applicable Mission IDs, and Key Words for the question displayed. The total number of questions currently defined for the mission is displayed at the top of the page.
(516) Quiz Question Skills
(517) Associate Skill(s) with Question
(518) To associate skill(s) with a question
(519) Select the desired question in the list of questions. The list of skills available are displayed.
(520) Click the Select checkbox next to desired skill(s) OR click in the associated skill text field. The associated skill is highlighted.
(521) To disassociate the skill, click on the checkbox (OR associated skill text field) again to clear it.
(522) Search for Skill
(523) To search for specific skill, enter text to search for in the Search Skills for: field. The number of results (if any) is shown to the right.
(524) Each skill that matches the entered text is outlined.
(525) Use the Down Arrow and Up Arrow buttons to scroll to next/previous occurrence of the entered text. The one that is scrolled to is outlined with a slightly darker outline.
(526) Add Question
(527) To add a question, click the Add Question button 292 at the top of the tab. This will provide a blank question entry area for defining the new question. It will also add a “blank” question to the Existing Questions list. Fill in the fields for this new question.
(528) Delete Question(s)
(529) To delete the currently displayed question, click the Delete Question button 294 at the top of the tab. This brings up the Delete Quiz Question dialog.
(530) Click the OK button to delete the question (or click the Cancel button to close the dialog without deleting question). The currently displayed question is removed.
(531) Next Question
(532) To display the next question, click the Next button 296. The information for the next question is displayed.
(533) Previous Question
(534) To display the previous question, click the Previous button 298. The information for the previous question is displayed.
(535) Select Existing Question to Display
(536) To display a specific question, click on the row in the Existing Questions list and the question information for that question is displayed.
(537) In addition, if the question text is too long to fit in the list, it will end with “ . . . ” and holding the cursor over that row will provide a tool tip with the entire text of the question.
(538) Checklists
(539) The Checklists tab 300 as shown in
(540) The checklist on the left shows each of the Orion components with their status(es).
(541) Green icon—completed
(542) Red icon—not completed
(543) Click on an item in the left list to view a description of what needs to be done for that item to be complete. For example—Clicking on Mission Order—Describe Situation may show what needs to be done for Mission Order.
(544) Detailed System Design
(545) Main Window
(546) The java application is a single window with a tabbed pane, one tab for each key item (plugin). The title contains the name of the current mission.
(547) The main menu may include one or more of the following elements:
(548) (1) File
(549) (2) New Mission . . . (to create a new mission—define organization, title, description, number, level of difficulty)
(550) (3) Open Mission . . . (to open an existing mission)
(551) (4) Save Mission (to save all data for the currently selected mission)
(552) (5) Save Mission As . . . (to save the currently selected mission as a different mission allowing change of the parameters similar to New Mission . . . )
(553) (6) Verify Mission Data . . . (to verify completion status of mission data)
(554) (7) Advanced Mission Settings . . . (to maintain various mission settings not specific to a plugin)
(555) (8) Export Mission for game environment (saves mission and then exports all available mission data in game environment format to export folder under the mission)
(556) (9) View Orion Users Guide (provide link to view user's guide)
(557) (10) About Orion . . . (provide Orion version/licensing information)
(558) (11) Quit (exit the application)
(559) (12) Menu items for each plugin (only accessible when the tab for that plugin is selected)—see individual plugins for details.
(560) Defining a New Mission
(561) File.fwdarw.New Mission . . . brings up a dialog shown in
(562) (1) Organization
(563) (2) Mission Name
(564) (3) Mission Number
(565) (4) Operation
(566) (5) Mission Level of Difficulty (Easy, Medium, or Hard)—default=Easy
(567) (6) Mission Type (Offensive, Defensive, Battle Room)—default=Defensive
(568) Once defined, the user is provided a way to save the mission to a user-selected directory. A subdirectory named <ORG>_Mission_<Difficulty Level> is created with data directories underneath for each plugin and for exporting the mission to game environment.
(569) Opening an Existing Mission
(570) File.fwdarw.Open Mission . . . brings up a file selector dialog to browse to and select the desired mission.
(571) Saving a Mission as Another
(572) File.fwdarw.Save Mission As . . . brings up a dialog similar to defining a new mission for the user to update basic information for the mission and select where to save it. The same naming conventions for the mission is followed and all current mission data is copied to the new mission.
(573) Verify Mission Data
(574) File.fwdarw.Verify Mission Data will examine the current mission data and present a dialog indicating the completeness and consistency of the data. The verification will include
(575) Verify mismatches in exported files (run “orchestration script” to verify files are complete/consistent)
(576) Verify all required pieces for the Mission have been defined
(577)
(578) Advanced Mission Settings
(579) File.fwdarw.Advanced Mission Settings . . . brings up a dialog 330 to allow update of mission settings (which are defaulted as shown in
(580) Total Game Points—default to 1000 for Easy, 2000 for Medium, 3000 for Hard
(581) Hint Points—default to 20%
(582) Default Location—default to 1
(583) Boot Timeout—default to 20 minutes
(584) Publish Timeout—default to 40 minutes
(585) Time Limit—default to 480 minutes
(586) Tooltips is provided for each item.
(587) Export Mission for Game environment
(588) File.fwdarw.Export Mission for game environment writes out the appropriate mission files in format for the target game environment. The user is then presented with a dialog 340 as depicted in
(589) View Orion User's Guide
(590) File.fwdarw.View Orion User's Guide will bring up the document in a browser window.
(591) About Orion
(592) File.fwdarw.About Orion . . . brings up a dialog with information about Orion including:
(593) Orion version number
(594) Owner copyright information
(595) Any End User License Agreement (EULA) information required
(596) Link to Orion User's Guide
(597) Quit
(598) File.fwdarw.Quit exits the Orion application. The mission designer is warned if there is any unsaved data.
(599) Mission Development Methodology Walkthru
(600) Central to the use of Orion is the Mission Development Methodology Walkthru pane showing in
(601) An example of what the Mission Development Walkthru may look like is shown in
(602) Red/Green lights indicate the status of each step. The arrow icon to the right of the pane allows the pane to be “hidden” (collapsed). While collapsed the arrow icon allows the pane to be displayed (expanded) again.
(603) Welcome Page
(604) The main “Welcome” page as depicted in
(605) Mission Setup Plugin
(606) Information is gathered at the beginning of mission definition that defines what the mission is about. The Mission Setup Plugin has several tabs allowing the mission designer to define various aspects of the mission, such as one or more of:
(607) (1) User Pre-requisites
(608) (2) Key Terrain
(609) (3) Mission Characteristics
(610) (4) Training Outcomes
(611) (5) Associate Mission Related File(s)
(612) Mission Setup Menu Items
(613) Print Mission Setup—brings up a print dialog with available printer(s) and print text to selected printer.
(614) Example of concept:
(615) Mission: Name: Disable Botnet Number: 1 Operation: Goatherd Difficulty: Easy
(616) Type: Offensive
(617) Mission Files: Mission Storyline: Mission_1_Storyline.docx Mission Video: Mission1_intro.mp4 Mission Thumbnail: mission1.thumb Mission Coin: GoatherdInsignia.png Other Mission Info:
(618) Mission 1 Design.pptx Mission_1_Easy_Solution.docx
(619) User Pre-requisites: Computer Languages Command Line Interface
(620) Key Terrain: Cyber Key Terrain: Maravian National Bank Protocols: telnet, vnc, ssh Systems/Data: Command and Control Server Baseline Flows: Defensive Posture:
(621) Mission Characteristics:
(622) Summary: Infiltrate the enemy's environment and disable the command and control web server responsible for thousands of defrauded victims.
(623) Purpose: The purpose of Mission 1 is to have a basic offensive mission where early users can get used to Athena and how the game environment works. They will learn skills applicable to Certified Ethical Hacking (CEH). Certification: CEH Domain: Commercial Type of Play: One-Sided Number of Players: One or more Players Max Players: 10 Max Trainers: 5 Network Size: Small (˜10 VMs) Network Complexity: Basic Location: 23.3790 N/113.7633 E
(624) Training Outcomes: Learn about password cracking techniques Manage firewall rules Identify Industrial Control Systems (“ICS”)
(625) Mission Setup Plugin Tab
(626) User Pre-Requisites
(627) This subtab 350 shown in
(628) A search capability is provided for finding skills in the list.
(629) All currently selected skills are displayed in a list to the right.
(630) Key Terrain
(631) This subtab 360 shown in
(632) Mission Characteristics
(633) This subtab 370 shown in
(634) Selected items are “highlighted” and fields default as follows:
(635) Domain—Critical Infrastructure
(636) Type of Play—Two-sided
(637) Number of Players—One or More Players
(638) Max Players—5/Max Trainers—3
(639) Tactics—Offensive
(640) Network Size—Small
(641) Training Outcomes Tab
(642) This tab 380 shown in
(643) Associate Mission Related File(s)
(644) This tab 390 shown in
(645) Mission Order Plugin
(646) The Mission Order Plugin provides the capability to define information for the mission, such as one or more of:
(647) (1) Situation (overall scenario and threat intelligence information)
(648) (2) Mission Core Competencies (required to go on mission)
(649) (3) Execution Instructions: User Credentials and Tools
(650) (4) Sustainment (how long mission should take and requirements on the end of the mission)
(651) (5) Command & Control (who commands the mission above the Team Lead and any reporting requirements)
(652) (6) Rules of Engagement (ROE)
(653) (7) References
(654) Mission Order Menu Items
(655) Save Mission Order (save data for this plugin in the associated data folder under the mission)
(656) Import Mission Order from game environment (browse to select existing mission order file from game environment)
(657) Export Mission Order to game environment (export mission order in game environment format to export folder under the mission)
(658) Mission Order Plugin Tab
(659) The Mission Order plugin tab 400 provides a styled editor depicted in
(660) The mission designer is able to switch between the pages by selecting the desired page to be displayed.
(661) A styled editor is implemented to provide tools to edit/format the text for the Mission Order. Capabilities include:
(662) Basic operations: cut, copy, paste, undo, redo
(663) Lists: bulleted and numbered lists
(664) Hyperlinks: insert/edit/delete a hyperlink
(665) Paragraph styles
(666) Character styling: Bold, Italic, Underline, Color
(667) Mission Objectives Plugin
(668) The Mission Objectives plugin provides the capability to define Mission Objectives, associated badges/skills and umpire detections.
(669) Mission Objectives Menu Items
(670) Save Mission Objectives (save data for this plugin in the associated data folder under the mission).
(671) Import Objectives from Game environment (browse to select existing mission objectives (objectives.yaml) file from Game environment—the file contains associated solutions/hints and umpire detections as well).
(672) Export Objectives to Game environment (export mission objectives in Game environment format (objectives.yaml) to export folder under the mission—the file contains associated solutions/hints and umpire detections as well). The umpire check tag will automatically be assigned a value of “objective<#>” for each objective where <#> is the objective number. See Export Objective Scoring section for details on formatting scores for Game environment.
(673) Export Objective Scoring
(674) Orion Objective Scoring and GAME ENVIRONMENT Objective Game Points are two separate entities. In one embodiment, Orion Objective Scores for “normal” Missions need to be a percentage of total game points (adding up to 100%). This total number plus the Objective % points is used to determine the game points for the objective.
objective game points=(percentage_points*total_game_points)/100
(675) For Battle Room Missions, there may be a large number of objectives (30+) which are not necessarily related to each other, so Orion maintains the concept of just a relative score (i.e. 1-10) rather than a percentage. This number is used (as a “percentage” of objective points) along with the total number of points for the game to determine the game points for the objective.
objective game points=(battle_room_score*total_game_points)/sum(all battle_room_score)
(676) Hint/Solution points is determined based on a total hint percentage—the percentage of points of objective that would be lost if ALL hints for that objective were taken.
hint score=((hint_percentage*objective game points)/100)/number of hints for that objective
(677) “Normal” Mission Example
(678) This is an example based on mission 1 easy (services_0.yaml).
(679) Given: (1) total game points of 1000; (2) hint % of 20
(680) TABLE-US-00004 objectives: - tag: objective1 description: Gather credentials percentage_points: 20 points: 200 coreskills: - points: 1 name: Command_Line_Interface - points: 1 name: O/S_Differences(Windows|Linux_methods) - points: 2 name: Offensive_Tools - points: 1 name: Network_Services_and_Communication - points: 1 name: Pentesting hints: - points: 8 text: “You may or may not see an IP address ...\n” - points: 8 text: “You can use nmap to find open ports ...\n” - points: 8 text: “You may be awarded Objective 2 early ...\n” - points: 8 text: “For ssh, use one of these commands ...\n” - points: 8 text: “For vnc: Use one of these commands ...\n” - points: 8 text: “For telnet, you can use the following...\n” - tag: objective2 description: Gain access to C2 server percentage_points: 30 points: 300 coreskills: - points: 20 name: Command_Line_Interface - points: 20 name: System_Administration - points: 20 name: Network_Tools hints: - points: 0 text: “Login to the C2 server. ...\n” - tag: objective3 description: Kill Web Service to disable botnet percentage_points: 50 points: 500 coreskills: - points: 2 name: Command_Line_Interface - points: 2 name: System_Administration hints: - points: 50 text: “To verify that this machine is acting ...\n”
(681) Battle Room Mission Example
(682) This is a “partial” example based on battleroom-host easy services_0.yaml.
(683) Given: (1) total game points of 1000; (2) hint % of 20; (3) assume 20 objectives half with a battleroom score of 2 and half with battle_room_score of 3
(684) TABLE-US-00005 objectives: - tag: objective1 description: From the Kali client, use the ping program/utility ... points: 60 battle_room_score: 3 prompt: 900 category: Reconnaissance coreskills: - name: Command_Line_Interface points: 1 - name: Core_Cybersecurity_Tools points: 1 - name: Network_Tools points: 1 - name: O/S_Knowledge_and_Commands points: 1 hints: - points: 6 text: ping is the program used to send ICMP diagnostic messages, ... - points: 6 text: ping LinuxServerIP - tag: objective2 description: From the Windows client, use the ping program/utility to ... points: 40 battle_room_score: 2 prompt: 900 category: Reconnaissance coreskills: - name: Command_Line_Interface points: 1 - name: Core_Cybersecurity_Tools points: 1 - name: Network_Tools points: 1 - name: O/S_Knowledge_and_Commands points: 1 hints: - points: 4 text: ping is the program used to send ICMP diagnostic messages, ... - points: 4 text: ping LinuxServerIP
(685) Mission Objectives Plugin Tab
(686) The Mission Objectives plugin tab 410 shown in
(687) The list of current Objective(s) with associated skill(s) is displayed separately on the left side of the plugin tab to allow for easy viewing/switching between objectives.
(688) For each objective:
(689) The mission designer is able to assign score points based on mission type (see below).
(690) A list of available skills is displayed. The mission designer selects skill(s) from the master database list (see Orion—Database IDD) and assign their score (between 1-10).
(691) The mission designer selects Umpire Detection(s) to associate with the objective and assign values to it (see below).
(692) Objective Scoring
(693) Mission scoring is based on the Mission Type.
(694) Mission: The Objective score is relative. The sum of all Objective scores in the mission must add up to 100%. If the user slides one up, the score(s) is adjusted to re-equal 100%.
(695) Battle Room: Each Objective score is independent with a value of 1-10 (10 being most difficult)
(696) Umpire Detections
(697) The mission designer is able to define the Umpire Check associated with the Objective.
(698) Detection events are combined based on the selected value (and, or, data)—default=and.
(699) Optionally, a callback function to be called with the return of any detection events. The “master list” of callback functions is defined in Orion—Database IDD.
(700) Optionally, other Umpire Check(s) which are required to be accomplished prior to this one being activated.
(701) Indicate whether the Umpire Check should be persistent.
(702) Add, Delete or Edit associated umpire detection events.
(703) Add Detection Event
(704) Add Detection by clicking Add Detection button 412. This will bring up a selection list of all detections currently NOT associated with this objective.
(705) Select the desired detection and click OK. This displays a dynamic dialog with the fields associated with the detection for the user to fill in.
(706) Click OK to add the detection (or cancel to exit dialog without adding the detection)
(707) Delete Detection
(708) Delete a detection event by selecting the detection(s) in the list of current detections and clicking the Delete Detection button 414. User is asked to confirm (Are you sure?)
(709) Edit Detection
(710) Edit a detection event by selecting the detection in the list of current detections and clicking the Edit Detection button 416.
(711) This brings up the same dynamic dialog as Add Detection—with current values filled in.
(712) Modify value(s) as desired and click OK to save/Cancel to exit without saving
(713) Mission Solutions and Hints Plugin
(714) The Mission Solutions and Hints Plugin provides the capability to define the mission solution and associated hint(s) for each objective. The hints provide multiple statements to lead the player to the solution. The solution walks the player through the objective.
(715) Mission Solutions and Hints Plugin Menu Items
(716) Save Mission Solutions (save data for this plugin in the associated data folder under the mission)
(717) Mission Solutions and Hints Plugin Tab
(718) The Mission Solutions and Hints plugin tab 420 depicted in
(719) A styled editor is implemented to provide tools to edit/format the text for the Objective Solution/Hint. Capabilities include:
(720) Basic operations: cut, copy, paste, undo, redo
(721) Lists: bulleted and numbered lists
(722) Hyperlinks: insert/edit/delete a hyperlink
(723) Paragraph styles
(724) Character styling: Bold, Italic, Underline, Color
(725) For Hint(s), a list of current hint(s) with first part of the text of the hint are displayed.
(726) To view the full hint without bringing up the editor dialog, hover over the hint text area.
(727) The mission designer is able to add a hint as follows:
(728) Click the Add Hint button 422 which adds another “line” to the list of hint(s).
(729) Choose the type of hint
(730) Text—just text information
(731) Variable—based on a mission variable (e.g. remote service)
(732) For Text hint, a dialog 430 such as shown in
(733) click on the text area (which will display the first part of existing text for the hint) to bring up the styled editor
(734) When completed, click OK (or Cancel to close dialog without saving any changes)
(735) For Variable Hint—
(736) Select the appropriate mission variable from list presented (or select+ADD to add a new variable—process described elsewhere)
(737) “Rows” for each of the variable values is shown.
(738) Click on desired text area to bring up styled editor to edit the hint (similar to Text hint)
(739) To delete a hint, click the Delete button next to that hint.
(740) Network Map Plugin
(741) The Network Map Plugin will provide the capability to define the network for the mission.
(742) Network Map Menu Items
(743) Save (save data for this plugin in the associated data folder under the mission)
(744) Create Network Map Report (user readable file with data describing the network—see Network Map Report section below)
(745) Clear Drawing (delete all items on the network map)
(746) Duplicate (make a duplicate of selected item(s))
(747) Zoom to Fit (zoom as necessary to fit ALL nodes on the screen)
(748) Snap to Grid (indicate whether items added to network map will automatically snap to the grid)
(749) Snap Size (provide choice of size—e.g. 1 mm-10 mm)
(750) Options to show various details on the network map
(751) Show OS Type
(752) Show Simple Name
(753) Show IP Address(es)
(754) Show Control IP Address
(755) Show Services
(756) Network Map Report
(757) This report is a file of network map node information including:
(758) Node Name
(759) Node Type
(760) Operating System
(761) IP Address(es)
(762) Service(s) Provided
(763) Tool(s) Installed
(764) Connections
(765) Network Map Plugin Tab
(766) The Network Map plugin tab 440 shown in
(767) View the network map as it would be seen in the game environment game UI as well as full development mode.
(768) Select from various Node types and add to the network map. These nodes are icons representing the type of node (e.g. server, firewall, printer . . . ).
(769) Apply various attributes to a selected node on the map. The attributes available are based on node type.
(770) Adversary (mark whether this node is an adversary)
(771) Services (list from “master list” as defined in Orion—Database IDD)
(772) Network Interfaces (random vs regular)
(773) Tools (list from “master list” as defined in Orion—Database IDD)
(774) Operating System (OS) (current list of operating systems is provided in Appendix A)
(775) Key Terrain: Not Key Terrain, Tier 1 (High), Tier 2 (Medium), Tier 3 (Low)
(776) Connect nodes on the map.
(777) Select a node or connector on the map illustrated in
(778) Network Map Viewing Modes
(779) Two modes of network map viewing are available to the mission designer.
(780) Developer View—allows editing of the network map and shows ALL network nodes
(781) Game View—view only mode showing just the nodes which will also be shown in the Game environment Game UI
(782) Click on the “Show Game View” button 442 to switch to view-only mode (with “floating” nodes such as Trainer being hidden). The button name will change to “Show Developer View”. Clicking the newly named button will switch back to Developer View.
(783) Adversary Node
(784) The mission designer is able to indicate whether a node is an adversary.
(785) Right-click on a node will bring up a popup dialog where Adversary may be (un)checked.
(786) Services for Node
(787) The mission designer is able to manage the service(s) associated with a node on the map.
(788) Right-click on a node brings up a popup dialog to select from options to manage the service(s).
(789) Add . . . brings up the selection list of those services NOT associated with this node yet and they can pick ONE to add (or cancel out of process)
(790) Display field(s) for service (from master service database) and allow user to fill in/edit based on “type” of data for each field.
(791) Click OK to save configuration for this service with the node (or click Cancel to close dialog without saving). Orion will keep track of whether all required fields were filled in—for completeness checks.
(792) Delete—brings up the selection list of those which ARE associated with this node and they can pick multiple and delete (with “are you sure? confirmation)
(793) Configure—brings up the selection list of those which ARE associated with this node and they can pick ONE and configure it with the dynamic dialog as shown for Add . . . .
(794) Network Interfaces for Network
(795) The mission designer is able to manage the network interfaces for a network on the map. This is a key step because the system configures the network and sets up interfaces and IP addresses through this process.
(796) Right-click on a network “box” brings up a popup dialog to define the interface(s). A dialog displaying network interface fields is displayed for the mission designer to define.
(797) Node Tools Installed
(798) The mission designer is able to manage which tool(s) are installed for a node on the map. When a user selects a tool for a host computer on the network diagram, the system sets up all the installation configuration for that to be completely installed.
(799) Right-click on a node brings up a popup dialog to select the tool(s).
(800) Brings up the selection list of tools available (from “master list”—see Orion-Database IDD). Multiple selection is allowed.
(801) Click the OK to associate the tool(s) (or click Cancel to close dialog without selecting the tool(s)).
(802) Node Key Terrain
(803) The mission designer is able to associate a Key Terrain value for a node on the map.
(804) Right-click on a node brings up a popup dialog to select the desired Key Terrain value for this node.
(805) Events Plugin
(806) The Events Plugin provides the capability to define the various events for a mission.
(807) Events Menu Items
(808) Save (save data for this plugin in the associated data folder under the mission)
(809) Events Plugin Tab
(810) The Events plugin tab 450 as shown in
(811) The tab displays the list in time order and provide capability to Add, Edit, Delete events in the list
(812) To Add an event:
(813) Click the Add Event button 452. This will bring up the Define Event dialog with blank fields to be selected/filled in.
(814) Select Event Frequency (Run Once, Periodic) and enter start time (and interval if Periodic)
(815) Select Event Type
(816) Select Event Category from dropdown of values from the master Adversary Event list (see Orion—Database IDD)
(817) Once the Category is selected, the Event Technique dropdown is populated with corresponding values from the master list, select value
(818) Based on the Category/Technique, appropriate fields are shown for any necessary parameters (from master list). Enter/select values desired.
(819) Click on the Target(s) field to bring up Select Target(s) dialog and choose the desired target(s) from list of appropriate(??) network map nodes and any existing event targets emitted by earlier Delivery events.
(820) Click OK to close target dialog and display selected target(s) for the Event. (Click Cancel to close dialog without making any changes)
(821) Click OK to close dialog and add the event to the Event List in time order (or Cancel to close without adding).
(822) To Edit an existing event:
(823) Double-click on the desired row of the list to bring up the Define Event Dialog with current values filled in.
(824) Make changes desired (similar to Add Event) and click OK to close the dialog and apply the changes to the Event List (or Cancel to close without making changes).
(825) To Delete an existing event:
(826) Click on the desired row to highlight it.
(827) Click the Delete Selected Event button 454 to delete it (with confirmation)
(828) Athena Q&A Plugin
(829) The Athena Q&A Plugin provides the capability to define questions and answers for the Artificial Intelligence (AI) in-game Advisor for Game environment (ATHENA). The types of Q&A include
(830) Mission Specific (specific to (the objectives of) this mission)
(831) General Cybersecurity (general offense/defense)
(832) Athena Persona
(833) Athena Q&A Plugin Menu Items
(834) Save Athena Q&A (save data for this plugin in the associated data folder under the mission)
(835) Search for Athena Q&A (search the “master” Athena Q&A data file (see Orion—Database IDD for format) and select which one(s) to include)
(836) Brings up dialog 460 with criteria to search by criteria for search:
(837) Category (Mission Specific, General Cybersecurity, Athena Persona)
(838) Question Content
(839) Answer Content
(840) Mission Objective (if entered, then the current Mission Number is assumed)
(841) Click Search to obtain dialog with list of Q&A matching the criteria entered
(842) Select the desired Q&A and click Apply to bring into the Mission (click Cancel to close dialog without applying any Q&A)
(843) Export Athena Q&A File (export Athena Q&A in Game environment format to export folder under the mission)
(844) The format for the file(s) is given in the Orion—Database IDD.
(845) Athena Q&A Plugin Tab
(846) The Athena Q&A plugin tab 460 shown in
(847) Data for each Q&A include:
(848) Category (as indicated by individual tab for each)
(849) Question
(850) Answer
(851) Mission Objective (for Mission Specific category only)
(852) NOTE: for Mission Specific Q&A—the current Mission Number is assumed.
(853) Quizzes Plugin
(854) The Quizzes Plugin provides the capability to pull existing questions from the master quiz database and to define new quiz questions for the mission. The questions are multiple choice in nature, may be associated with multiple missions, and optionally provide Key Words, and a Source for the information.
(855) Quizzes Plugin Menu Items
(856) Save Quizzes (save data for this plugin in the associated data folder under the mission)
(857) Search for Questions (search the “master” quiz data file (see Orion—Database IDD for format) and select which one(s) to include in this mission)
(858) Brings up dialog with criteria to search by
(859) criteria for search:
(860) Difficulty Level (Any, Easy, Medium, Hard)
(861) Key Word(s)
(862) Question Content
(863) Answer Content (search in any of the answer fields)
(864) Mission(s)
(865) Skill Content
(866) Click Search to obtain dialog with list of quiz questions matching the criteria entered
(867) Select the desired question(s) and click Apply to bring into the Mission (click Cancel to close dialog without applying any questions)
(868) Export Quiz Questions (export Quiz Questions in Game environment format to export folder under the mission)
(869) The format for the file is given in the Orion—Database IDD. (a csv formatted file will also be exported for easier reading by a user.)
(870) Quizzes Plugin Tab
(871) The Quizzes plugin tab 470 shown in
(872) Data for each question include:
(873) Difficulty Level (Any, Easy, Medium, Hard)
(874) Question
(875) Answer
(876) 3 wrong answers
(877) Detailed Answer
(878) Applicable Mission ID(s)
(879) (optional) Key Word(s)
(880) In addition, skills earned for the question may be selected from list of Badges/Skills.
(881) The list of current Quiz Question(s) with associated skill(s) is displayed separately to allow for easy viewing/switching between questions.
(882) Mission Library Plugin
(883) The Mission Library plugin 480 shown in
(884) File(s) may be selected on the local file system and drag/dropped into the appropriate field. A file may also be selected on this page and drag/dropped onto the local file system.
(885) The following files are required for the mission to be complete. Only a single file may be selected for these—if another file is selected, then it will replace the existing one (user is warned).
(886) Mission Storyline
(887) Mission Video
(888) Mission Thumbnail
(889) Mission Coin
(890) Other Mission Info is for optional file(s) which the mission designer may want included/saved with the mission. Multiple files may be selected.
(891) To remove file(s) from this list, select desired file(s) in list and click the Remove Selected File(s) button.
(892) Double-click on a file to open it with default system editor (if available).
(893) Battle Room Support
(894) Battle Rooms are places where players can do small technical tasks and reinforce their knowledge in different areas. Missions are end-to-end scenarios where players need to be able to figure out how to solve a problem with a set of tools. As such, Battle Rooms need to be handled differently in some areas. They do not require some of the mission complexity.
(895) The following plugins do not apply for Battle Rooms since they are virtual environments that are used outside of a mission context:
(896) Storyline
(897) Mission Setup
(898) Mission Order
(899) Athena Q&A
(900) Quizzes
(901) The tabs for these plugins are not be displayed nor considered for checklists/completeness when the mission designer chooses the Mission Type as Battle Room upon mission creation/save as (see screenshot under Defining a New Mission section of this document).
(902) In addition, the following differences might also be considered
(903) Objective Scoring (see Objective Scoring section of this document)
(904) Work roles
(905) VM Construction
(906) There are several files which Orion needs to output for the VEM to be able to create/launch a mission. Details of data fields for each file are defined in the Orion—Game environment VEM IDD. These subsections define where the data is derived from within Orion.
(907) Blueprint
(908) The blueprint.yaml file depicted in Table 3 outlines all virtual machines (VMs) to be created by the VEM. The following table shows how/where Orion gets data to write this out.
(909) TABLE-US-00006 TABLE 3 yaml tag parent tag Orion Source serial_id — yymmdd<##> when file is to be written out base_vapp — Derived from information on New Mission/Save Mission As . . . Dialog <ORG>_mission_<#>_<Difficulty> vapp — Version for this mission base_vapp_<##> - start at 00 then check/increment when this mission is “deployed” vms — Network Map <vmName> vms Network Map template <vmName> Network Map startOrder <vmName> Default to 1 for Master-C7 and 2 for other VMs - modifiable by user ram <vmName> Default to template value - modifiable by user cpu <vmName> Default to template value - modifiable by user core <vmName> Default to template value - modifiable by user networks <vmName> <network> networks type <network> ip <network> mask <network> mappable <network> adapter <network> nodeMeta <network> location nodeMeta type location x location y location services Deprecated mirror <vmName> <mirror id> mirror vm <mirror id> src <mirror id> dst <mirror id> credentials <vmName> From template - not modifiable by user user credentials From template - not modifiable by user password credentials From template - not modifiable by user connections — from connections to connections points connections x points y points
(910) Mission Definition
(911) The mission definition.yaml file depicted in Table 4 contains the high-level mission data for the mission.
(912) TABLE-US-00007 TABLE 4 yaml tag parent tag Orion Source serial_id — yymmdd<##> when file is to be written out missionCharacteristics — playType missionCharacteristics Mission Setup - Mission Characteristics networkSize missionCharacteristics Mission Setup - Mission Characteristics networkComplexity missionCharacteristics Mission Setup - Mission Characteristics numberPlayers missionCharacteristics Mission Setup - Mission Characteristics numberTrainers missionCharacteristics Mission Setup - Mission Characteristics missionParameters — missionType missionParameters Create Mission/Save Mission As . . . Dialog trainingType missionParameters Create Mission/Save Mission As . . . Dialog (for regular mission - offensive or defensive) operation missionParameters Create Mission/Save Mission As . . . Dialog missionNumber missionParameters Create Mission/Save Mission As . . . Dialog missionTitle missionParameters Create Mission/Save Mission As . . . Dialog (name) description missionParameters Create Mission/Save Mission As . . . Dialog difficulty missionParameters Create Mission/Save Mission As . . . Dialog totalGamePoints missionParameters Advanced Settings Dialog hintPercentage missionParameters Advanced Settings Dialog thumbnail missionParameters Mission Setup - Mission Files
(913) Network
(914) The Mission network.yaml file depicted in Table 5 lists the networks (both static and random) for the mission.
(915) TABLE-US-00008 TABLE 5 yaml tag parent tag Orion Source serial_id — yymmdd<##> when file is to be written out networks — network networks routes networks dest route gateway route static network <ip> Static domain_name network servers <ip> domain_name_servers dhcp network domain_name dhcp servers <ip> domain_name_servers range dhcp <from_ip> range <to_ip> range routers dhcp <ip> routers random_networks — network random_networks routes random_networks dest route gateway route members random_networks <vmName> members policies — <domain> policies members <domain> <vmName> members domain_name <domain> servers <ip> domain_name_servers
(916) Objectives
(917) The Mission objectives.yaml file depicted by Table 6 provides the objectives with their skills/scores/hints solutions and umpire check detections for the mission.
(918) The table below indicates where the information for the file comes from within Orion.
(919) TABLE-US-00009 TABLE 6 yaml tag parent tag Orion source serial_id — yymmdd<##> when file is to be written out objectives — Mission Objectives coreskills objective Mission Objectives name coreskills Mission Objectives points coreskills Mission Objectives description objective Mission Objectives points objective (calculated based on total game points from Advanced Settings Dialog) percentagePoints objective Mission Objectives (mission) battleRoomScore objective Mission Objectives (battle room) hints objective Solution and Hints points hint (calculated based on objective points and % hint points from Advanced Settings Dialog) text hint Solution and Hints For a Variable Hint - put text as (((hint<#>_obj<#>))) - matching the assignment.assign_extend variable (see Services yaml section) isSummary hint (set when exporting the solution) tag objective Mission Objectives (set to Objective<#>) umpire — <umpiretag> umpire Matches objective tag description <umpiretag> not required - Orion will not generate type <umpiretag> Mission Objectives - Umpire Detections require <umpiretag> Mission Objectives - Umpire Detections <umpireCheckTag> require Umpire Detections - dialog to pick from other existing <umpiretag>(s) callback <umpiretag> Mission Objectives - Umpire Detections persist <umpiretag> Mission Objectives - Umpire Detections detection <umpiretag> Mission Objectives - Umpire Detections name detection Umpire Detections - pick from list of existing detections in detection library type detection From detection library target detection Associated from Network Map OR picked in Mission Objectives - Umpire Detections persist detection Umpire Detections args detection Umpire Detection Configuration dialog
(920) Services
(921) There are two services yaml files shown by Table 7 which represent data that is loaded at different times into the VEM. The services in the network definition are broken into two layers: Services and Services_0. The first is the basic network which stores a working base definition. The second is an overlay (Services_O) that adds the dynamic variation in the mission to include threat actors. This lets you do many different things to your basic network definition. When a new threat attack comes out, like WannaCry, you can take your service template for a hospital network and quickly create a WannaCry Services_0 overlay, for example.
(922) TABLE-US-00010 TABLE 7 yaml tag parent tag Orion Source serial_id — yymmdd<##> when file is to be written out variables — Added when a Service is added to the network Diagram or a detection is added to an Objective. A master list is kept and is editable from the network diagram or objective plugin The services/detection database will need to store the “type” (random_choice, machine_ip, . . .) of the variables used in the service/detection definition The implication is that there is a list of Variable Types available. assign variables Handled by the add/edit capability. <assign> assign Handled by the add/edit capability. For “Variable Hint” - a set of assign variables may be created for each “choice” of the variable chosen for the hint with the value being the text for that choice (e.g. ssh_hint, vnc_hint, telnet_hint). [value(s)] <assign> Handled by the add/edit capability. random_string variables Handled by the add/edit capability. <random_var> random_string Handled by the add/edit capability. [value(s)] <random_var> Handled by the add/edit capability. random_choice variables Handled by the add/edit capability. <choose> random_choice Handled by the add/edit capability. [value(s)] <choose> Handled by the add/edit capability. machine_ips variables Handled by the add/edit capability. <server> machine_ips Handled by the add/edit capability. [value(s)] <server> Handled by the add/edit capability. random_ip variables Handled by the add/edit capability. <net_sim> random_ip Handled by the add/edit capability. [value(s)] <net_sim> Handled by the add/edit capability. assignments — Unclear need better definition from Ryan assign_extend assignments See above <assign> assign_extend See above For “Variable Hint” an assign_extend is created named hint<#>_obj<#> with <part1> being the variable associated with the hint and <part2> being “hint” <part1> <assign> See above <part2> <assign> See above assign_service assignments See above <service> assign_service See above <name> <service> See above users — List of users and trainers that can log into a system The Orion users will only specify the # of users/trainers. Orion will automatically create the user and trainer ids based on a starting UID for users/trainers The Orion users will also have the ability to add a random user to a node/host <vmName> users Name of the Orion node. Trainer node floats just like random services and ????? <user> <vmName> User is able to assign the UID for random users uid <user> See above configurations — Top level tag is included from Orion. The serviceName sub tags are added automatically by Orion when the user adds a service to a node on Network Map. <serviceName> configurations Default name comes from the service database and assigned to a node. Multiple nodes can use one configuration. name <serviceName> Assumed to be preconfigured in the services database - no user input is required - Orion will “copy” if it exists service <serviceName> Assumed to be preconfigured in the services database - no user input is required - Orion will “copy” if it exists type <serviceName> Assumed to be preconfigured in the services database - no user input is required - Orion will “copy” if it exists event <serviceName> When service type = event - must select an event (name is in event block) Events come from events database Values within the event block is filled in by popping up a dynamic (?) dialog box. <eventblock> <serviceName> See above stage <serviceName> Assumed to be preconfigured in the services database - no user input is required - Orion will “copy” if it exists ssh <serviceName> User is presented with a dialog box asking for the user passwd and sudo subtags Defaults is supplied in the services database user ssh See above passwd ssh See above sudo ssh See above description <serviceName> Assumed to be preconfigured in the services database - no user input is required - Orion will “copy” if it exists reset <serviceName> Assumed to be preconfigured in the services database - no user input is required - Orion will “copy” if it exists transform <serviceName> Comes from the services database Values within the transform block is filled in by popping up a dynamic dialog box. <transformblock> transform See above salt <serviceName> Comes from the services database. Values within the salt block is filled in by popping up a dynamic dialog box. <saltblock> salt See above services — Contains a list of network nodes that the user has placed on the Network Map. Only nodes that have a service at the corresponding level is included in this list <vmName> services See above <serviceName> <vmName> List of services that the user associated with the node on Network Map Originated from the services database groups — Yaml files authored by Orion will only include groups for random services. (Orion will put in an entry for each node that uses a static service.) Random Services is added as a floating node on the map. Users is able to add a service to random list of hosts (nodes) and the ability to specify how many hosts in the list will get the random service. <group> groups See above hosts <group> See above <vmName> hosts See above services <group> See above <serviceName> <group> See above random <group> See above <serviceName> random See above
(923) Base level—services.yaml: loaded into the VEM cache at startup—any services w/o variables or random information
(924) Level 1—services_0.yaml: loaded into VEM at Mission Game startup—any services with variables or random information
(925) Orion treats these two files similarly—the difference being that all variable/random information and events must be in services_0.
(926) For adversary events an adversary “configuration” and “service event” is inserted.
(927) VEM
(928) The Mission vem.yaml file depicted in Table 8 is the data fixture file which contains basic metadata for the mission.
(929) TABLE-US-00011 TABLE 8 yaml tag parent tag Orion Source fields — boot_timeout fields Advanced Settings Dialog default_location fields Advanced Settings Dialog description fields Derived from mission number on New Mission/Save Mission As . . . Dialog name fields Derived from mission number/ difficulty level on New Mission/Save Mission As . . . Dialog networking fields Static text polymorphic_ctype fields Static text publish_timeout fields Advanced Settings Dialog timelimit fields Advanced Settings Dialog base_services fields Static text services fields Static text objectives fields Static text mission_parameters fields Static text model — Static text pk — Derived from information on New Mission/Save Mission As . . . Dialog <ORG>_mission_<#>_<Difficulty> serial_id — yymmdd<##> when file is to be written out
(930) Vsphere
(931) The Mission vsphere.yaml file depicted in Table 9 is the data fixture file for the virtualization model. It describes and includes the data necessary for the virtualization implementation.
(932) TABLE-US-00012 TABLE 9 yaml tag parent tag Orion Source fields — blueprint fields Static text model — Static text pk — Derived from information on New Mission/Save Mission As . . . Dialog <ORG>_mission_<#>_<Difficulty> serial_id — yymmdd<##> when file is to be written out
(933) Cyber Ranges
(934) In one embodiment of the invention, the output of the Orion or mission builder system creates a single training mission that may train one or more users. The training mission may be reused and added to a library of other missions for use by students to learn key concepts.
(935) In other embodiments, created missions may be grouped into a cyber training or exercise event in order to create a realistic virtual world or cyber range complete with simulated users, simulated mission systems, simulated data and emulated adversaries—all connected to a simulated Internet.
(936) Cyber ranges may begin as racks of computer hardware that can be reconfigured into various network topologies and overlaid with different baseline network services and traffic profiles to coincide with the business or mission of the enterprise environment. Cyber ranges operate in a closed loop environment as a necessity to introduce malware safely and prevent damage to live networks. The cyber range provides for network routing, defensive tools, mission applications and an overlay of virtual users that automatically perform the activities of real users to generate realistic simulated network traffic.
(937) The formation of a cyber range with which to train users with missions created by the system is a virtualization approach that essentially mimics the real-world internet of back-bone routing and connectivity between organizations. Modules and interconnection across virtual environments are essential components of the cyber range where training missions take place.
(938) In the cyber range embodiment of the system, many mission designer users could create, for example, an ICS mission, a radar mission, a military range mission, and other required missions to meet their training objectives. No coordination is required when each mission designer or student latches on to the cyber range, which interconnects all users just like in the real world. This approach supports key training objectives such as trust relationships while creating a single plane from which the exercise support teams, like the opposing force, can operate using the cyber range across many teams at once. In addition, scenarios involving multi-team echelon reporting can be easily exercised. In other embodiments, entire virtual e-cities can be configured for training in a straightforward and tractable problem.
(939) In one embodiment, key features of the cyber range embodiment where created missions are used for training may include: (1) the unique ability to “swing and latch” on to networks via the configuration of a single interface for each add-on environment; (2) a uniquely small footprint but is able to handle a large traffic volume and dynamically sets up routes to new environments; (3) scaling to different sizes, such as 2, 8, 16, and 28 mission networks; and (4) quick deployment due to the modular design.
(940) The approach supports event configurations across multiple game training systems, meaning, it can be launched in one cyber training system and connected to an entirely different system as long as the physical switches that connect the two clusters or systems has the swing network (a virtual local area network distribution identification or “VLANID”) defined. These clusters “could” be geographically different as long as the layer 2 traffic on each end of the WAN connection is unscathed. In addition, multiple cyber ranges might even be connected.
(941) The cyber range can be latched on to user emulation modules, Internet corpus modules, management and monitoring modules, and opposition forces (live and automated) modules.
(942) Using a cyber range of the invention, such as with missions created by the Orion/mission builder system of the invention as depicted in
(943) In the backbone of cyber range, dynamic routing is used via a Border Gateway Protocol (BGP). Each content server and infrastructure device is configured to redistribute the routes of all the interfaces configured. If a new sub-interface is created with a new IP address that has new web content, for example, that IP address is automatically injected into the BGP route table for client consumption. This dynamic routing capability facilitates content, traffic, and purpose flexibility into the product. Any and all valid IP space can be used in the virtual environment resulting in the ability to present regions of the world based on IP address.
(944) The routing flexibility and solution design makes it very robust, such as a red team adversary emulation mission training platform. Adversary presence using the cyber range embodiment for training missions is simple, flexible, and realistic. A red team can control and distribute Domain Name System (DNS) and route characteristics into the cyber range much like today's adversaries have demonstrated. This feature provides the ability not only to demonstrate the characteristics of a specific attack method, but also enables it to be representative by a particular region and footprint.
(945)
(946) INET-NNW, NW, WNW, W, etc routers act essentially as “ISP's” “ISP” for each mission. If a small training exercise is run with 8 teams, the teams are able to share the “Internet Corpus” module which contains DNS, NTP, SMTP, FTP, and all the browsable websites for Lariat and/or other user traffic generators. The teams can also share the “User Emulation” module, which is a customized Lariat setup to support the teams in some capacity. Then there are two other pick-offs; the “Live Inject” module, and the “Auto-Inject” module. The “Live Inject” module is for a Red (OPFOR) team to work from with access to all the teams via the Cyber Range. The “Auto-Inject” module is for any automated attacks/objectives we put into the game that can be scripted and scored automatically.
(947) This embodiment of the system, where missions are integrated and used by multiple teams as shown in
(948) It will be understood that the above described arrangements of apparatus and the method there from are merely illustrative of applications of the principles of this invention and many other embodiments and modifications may be made without departing from the spirit and scope of the invention as defined in the claims.