Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set GitHub Actions with test cases #46

Merged
merged 50 commits into from
Oct 2, 2023
Merged

Conversation

jzelenjak
Copy link
Collaborator

Closes #38


on:
pull_request:
branches-ignore:
Copy link
Collaborator Author

@jzelenjak jzelenjak Sep 21, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should ignore PR to the docker branch

FF_REPO: "https://github.com/tudelft-cda-lab/FlexFringe"
shell: bash
run: |
gh release download latest -R $FF_REPO -p "flexfringe-x64-linux" # Might have to be updated if FlexFringe decides to change the binary name
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have added comments like this to indicate the dependency on FlexFringe (also present in other parts of this file)

- name: Run regression tests on CPTC-2017
env:
CHANGES_IDS: ${{ contains(github.event.pull_request.labels.*.name, 'changes-ids') }} # With 'changes-ids' label state IDs will be removed from the AGs
if: '!contains(github.event.pull_request.labels.*.name, ''changes-ags'')' # With 'changes-ags' label no regression tests will be run
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So there are three cases:

  1. Label changes-ags is present ⇒ don't run the regression tests
  2. Label changes-ids is present ⇒ run with -i (removes IDs and skips stats-sinks-ags.sh, since the states cannot be matched due to different IDs)
  3. Else, run normally

Something like this (tested on my fork):
image


Follow the same procedure as above, however **do add a label `changes-ags`**. This will skip the regression tests and only run the sink tests and the Python tests. Since there is no ground truth for the attack graphs, make sure that the changes to the attack graphs make sense. Please carefully describe them in the Pull Request description.

### Changes to the IDs
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The part related to the label changes-ids


If you want to add new test cases, feel free to do so. For Python tests, you can add them to the `tests.py` file. In addition, you can add the new tests to the GitHub Actions by modifying the `.github/workflows/test.yml` file. The tests, however, need first be approved, see the procedure above.

### Updating the docker branch
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reminded about the existence of the docker branch

- Clone [FlexFringe repository](https://github.com/tudelft-cda-lab/FlexFringe).
- Move `spdfa-config.ini` file to `FlexFringe/ini/` directory. Alternatively, you can set the `path_to_ini` variable in `sage.py` to `"./spdfa-config.ini"`.
- In case you move the `FlexFringe/` directory to another location, update the function `flexfringe` in `model_learning.py` accordingly.
- You can find the compressed alerts for the [Collegiate Penetration Testing Competition (CPTC)](https://cp.tc/research) and [Collegiate Cyber Defense Competition (CCDC)](https://github.com/FrankHassanabad/suricata-sample-data) datasets (taken from the linked sources) in the `alerts/` directory. To uncompress the alerts, run:
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Referencing the alerts + command that uncompresses them. Does it look fine to you?

echo "------------"


echo "Test 6: Checking sinks stats"
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have decided to skip this test when running with a -i option (i.e. removing state IDs). It is not possible to join the states in two attack graphs if the IDs are different (the script will behave as if they have been merged, as was the case when merging sinks)

total_tests += 1


# TODO: has to be written
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As you have once mentioned, I have left TODOs for the future

from signatures.attack_stages import MicroAttackStage


def run_episode_test(frequencies, expected, test_name="test"):
Copy link
Collaborator Author

@jzelenjak jzelenjak Sep 21, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MicroAttackStage.DATA_EXFILTRATION and 'alert' are just placeholders. They are not used, but are needed for the code to run

passed_tests = 0
total_tests = 0

# Test case 1: normal sequence
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do these test cases make sense to you?

@jzelenjak jzelenjak added the changes-ags This PR changes the attack graphs (regression tests will be skipped) label Sep 21, 2023
@jzelenjak jzelenjak marked this pull request as ready for review September 21, 2023 14:32
@azqanadeem azqanadeem merged commit 0325a81 into main Oct 2, 2023
1 check passed
@jzelenjak jzelenjak deleted the 38-test-cases-for-sage branch October 7, 2023 12:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
changes-ags This PR changes the attack graphs (regression tests will be skipped) testing Test cases for SAGE
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Test cases for SAGE
2 participants