Research in Intrusion-Detection Systems: A Survey* Stefan Axelsson

!"# $&%(') +*,. %/021($'43 5 687:9)@7ACBDBDE2= F 7HG";2IJ6DKL7H=6MEN9O(EPKQG#R 6D7IS=#TPUC=#77HIDUC=#T O(V#;2AWKQ7IJBXM=#UZYP7IJBDUZ6[\E29^]^7H_`V#=#EPACEPT2[ aLE2b 6D7cdEPIDT e"5f7g#7H= 7HKh;2UCAjilkmon"pMq`rsMR#TPR#B6o| ey|P|2|

« M#¬8H¤ J" ®J`£"¯w¢"°"±H²´l³ òl:#j$H#µ¨jªjH£ ¡¶"(·¢+¸¹8ºD£» D¼ J¤¦¥ 8DD ' D7D7PDD C!0D7D7CD7D7DD < D7D7DDD ./, !! DD (, - >F* $C"*,:3$P*,>' ') C',%*, 9S#P "6 !)$ ' CP!0C$0>C' 3 D D7D D7D7D D7D D7D D7D7D D7D D7D D7D7D D7D !I $ D $ J "+K -L)B*+' IQ.8R!QCC' 3 D D7D D7D7D D7D D7D D7D7D D7D D7D D7D7D D7DP$Q,

$0D (

) *K

F$ ' < Q >' L' %K* ' M"4 >@?A' B "') * $ M"') D D '0$0>' D7D D7D7D D7D D7D D7D7D D7D D7D D7D7D D7D D7D D7D D D R$0!Q" 4-Q!Q.3' C * 8' 0T3C 3* 6Q"') T*,$#*,0/ $ Z* " D D7D D7D D7D7D D7D D7D D7D7D D7D D7D D7D7D D7D D7D D7D D D 7 9*,V>@?A' BW>' * $ ' .89* ' D D7D D7D D7D7D D7D D7D D7D D D 0 6)!' "3C' D7D D7D D7D D7D7D D7D D7D D7D7D D7D D7D D7D 0D 0 9* #9*,Z"') * *,!0CF D D7D7D D7D D7D D7D7D D7D D7D D7D D D '0$0>' D7D D7D7D D7D D7D D7D7D D7D D7D D7D7D D7D D7D D7D

$ %, $.

$ V5 $/ $I

$ !0

$ !Q!

$$ ,, $Q$B.5 $Q$Q// $$ II &&$ I00 && !! && !! &&B$! &Q&Q(( &Q&Q(( &B& ., &D&D55 && // && I/ (( 00 (D(D$$ (D(B&$ (B( (& ((D(, (D, (D(D,, (B( .5 (( 55

$$ (( $! ") $$ (( (& 6$$ (( ., 6) $$ ,, $! 1 "K J ) $$ ,, (& 6 J $$ ,, ., 6) J $$ ).. J;$! * ") $$ .. (& 6) L- KL" 6R*$$ %%55 $! "2 $$ %%55 (& L6 - KL" 6 ) F$$ %/5 ,! ") R*$/$ U $$ // (& ) $$ // ., '1 KL$$ "+/I K %5! )B* ") K $$ II &$ F $$ II (, 6 K "+K ) -$ )I - . *) $$ !!00 %$! "- ) U$$ )!! 0! - & ! ")* )

$0$0DD !Q!Q!! D%D &$ JL ' . *', 8' ' 0@R!Q.3C7*,!Q C9*,< "D ' D7D7 D D7D7DD D7D7DD D7D7D7D7DD D7D7DD D7D7DD D7D7D7D7DD D7D7DD(D( I5 $0$0DD !Q!Q!! DD%(, 6)Q 6 "!W >' D73>D D7CD7' 3D D7DD D7D7DD D7D7D7D7DD D7D7DD D7D7DD D7D7D7D7DD D7D7DD D7D7DD D7D7D7D7DD D7D7DPDP,, 00 $ D ! $ K0$ D T! 0$ ' D !J;* " 'I0'Q$ 0M"' ') *,C' D7' 3D ', D7%.3DD D7D7DD Z/2 D7D7>D7D79DD D7D7'ODD D7D7DD D7D7"')D7D7 DD $0D7D7DD >D7D7DD' D7D7 D7D7DDD D7D7D7DPDPDP,Q,S,S&&$ 0$ D ! & D%$ L $00$ DD !! & & DD (& J-TQ) !0. '0@.$0"!QM4)' "3 ')> *,CD7' ' 3D D7"DD D7D7DD "')D7D7 D7D7$ DD >D7D7 MDD D7D7"')DDPD7D7!0D7D7@DD D * D7C$D7' 3D D7DD CD7D7' DD PD7D7$0D7D7DD >D7D7DD ' LD7D7DD!QD7D7CD7D74- CC D7>' 3D ZD7@!DD M ' "3')>Q 6Q"CD7' ' 3D D' D73>DD7CCD7' ' 3D O D7$0DDD7D7 MDD D7D7' -D7D7%(DD ')D7D7DD TD7D7DD M"')1 032406587+90MD ?FC&'7 6)!# C* 0/ * * 9 >U;' * * 6 4) *,$P*O.' ',@!Q.8 *, * 35@$0$VG 3' * "* "6)! G0*,3$ * ""*,6 ! D T'O"4 A' ?*,9$ 7C!0CZT'- D )0' Z@! .8' F>! D =!Q. F* "! G+' ')%(> 8 4#') !J' ',%; D $02 R' H=*, 6)%(')W!J"3@* 9*,$0FL*,.- MRB ' ' 'Q 'Q 3$- ' %>' *7. * C>$ * ' " "%S') 57*,%(* $L' % 8 4L* C9* 9B)$L6QF*"D UR0%(' * ! GV

*, 3L* X>I0.86 P*,$ * ?B?*,9$ *,.. '* 9EG"3> ZOF& * ! ' ]@ ' ? * Q! ' 0 ?"L 3* ?A*,3ÔH' *,C'))') ',%Q=C!0C< ' ? G? "+IQ* . 6 )"')H9*,B . F* >- OQ6Q') %(')L"*)O* $ * 9* > ' IQ* * * 9B)9 ' %;$ ">' 3C )KC' F$& ! . '0> $VD +I*,)$0>>=' F$ 8+>U;>$ ! =4)*

!QC') $-$0'J *, $ * M"') *,/ M"') "'H.3.8M"6) D S #"' $0>' X!0@ ! ' ')$0 9+* *, G D 4D ?A* !W' %$0"U;F* " 4 8>@?A 74 "%(3>'# d 9 0U7 ! 7 7>F* K3*

3

?

=

)

B-

M

!" # %$'&() '*+ , - . / 0,12 ! & 34$'&5 66! ,78 9 !9 ;:=?'@A B', 6C $ %D,9E$6C F,0 G @' !//6@G G5,1?'@H/ I$'&66C &E 5,1?6J K CL. @G,7.)M,H G N30! 6O J:%P2/ , !E ) %,1M!,7N3A6C 3 $7:Mku p3nl}r4e4kie4fhkPg?g6-+g6e4k?s4flf>w\panlnh}4g>k(kP-nhnhtJ}~gpaw-s4flnk8*6vkPtZkPf*s4p m4nlgLkPg6fTflnl w }4nuk `

Wa

(

b

&

' %K #F$0 *5'W. '0> T* $0"R$ * 9*-%(' R')4 F$7* S%(' F4)')*,V' F$ 3#*,C* "$VD C ' < $ 'L Q! $P* . . ')* 9 D

-

!I +( 0

-

M

"

2

!I

43

-

=?4 ') 0Q: 4 G* 8' 0#' ? * 5 W0 ?S') F$ : "' Z') "! 8*,4)S Q*, 8* 6Q' G ', C/ * "! "Z 8* 6Q' .3 D F *, 3-*W. ' "< ?H &@?S' @!.8#',% 3* 6Q"') #$0'L ' #' 6 F*,.ED !0@< * &" *, 'H*)>.0 $ *, 4)' 8* 6Q' 7*) ]C ') 83* 6' R?" 'C7. ',:3" T@!Q. *,"!P*O>')%

Q S. FC 4T' %Q S*,!R.* .3G 6)9*, C' /2$0 M' #!0@>' LC!0C< L4) * "FC $ * FC ' 83 C $O* SC') K' %V$* *G)B)! 8')*,9$&" .0G0>') Z@! 4 ( O Z!3 O %(' JS*,!Q. J*,%("!)GH G*,' 7$0"W>F*, "M"')&!0@ (?" ' '$06F* "') %(')< ' ')a ^ F ' 3O. >$ "'Q'C"!)D R',#') "! C 3/ * 6Q"') G 0#* ' '@ .* * @?A' BP.*,9*,9G8>9,DE*, 8 '0$0 83* 6' *,SF ' ! ]C3C. F>' 3T ^5H* G3* $P ' " 9 ! 756QF$0#',%BQ ' ? ""6)T* >6"@! G"SF=C"8 ',*, ')' W*)=* 8' 6 )G)"3> CZ%" *, "4-' ' < R 8*,4 4)$L*)R$0F*,6 ',%* P""') *,C #* 8' 6 >F* C":3* ' )'5@?S'O>F* D ~9 2 07 757 ! 5 .3 #$ >: "' L* 3' 6) D D ! 2 07 7+587 ! 5 R$0>>' OF *)C $&')WC')IQ3*,' !0@. 8>')M"')P. ". R>*,!WC.8Z:3* "') *)C $VD 0 RR&C* 73* *,U8 M9T J').3*,' L',%K J0/ 0 "') $0 M' H!0@< *)C39ED ' ? *,$ ? 'W>' MR* $0"R$ * 9* G0 ' ? ' .3')$L' C' 3R,DJ> D# F F Q M"') C!0CM$VD 0 W>%(3>O$ * 9*HC' 9*,4)O@' 0%(' "4O')0:4) *,' * $ *)M6 5$ * 9* C')* 4 )D 69 C/ M' . "3>. " . 6Q' "!OR>') $ e4y44-w jh}4kPmog6s4k"e4p3e kPfnl}4pan zPg6s4zPkPfls4jw nljhkP vW\w nl}Njly4z}op(jhnhy4mru 3

/

" 3

8. ' ! * $ $0>' EG 7. T*, ') )"S3* #!0@< *,0',/ ! FE6Q"')*, $VD F K .8' !-*, 8 .8>": $O" S* 7 5 U7 69 51GQ' S* 7 5 7 2 , % * 0/ ' ED D D YZ O.3 >":5' ',')% < 8', G,$W* 6 ?' F$ $ S?A"4)* B"4JC) G 3*,C' $JW* $0' U;>D * 6Q" 4L$09* ? * Z@! >Z*,V6)D 0 FS* 4 ')!5>'))*)@9=!0@')$0* W$0F* ! G')J. '0> $ *,*5" C$0W').3*, 4LC!0C< B) ' 4G*,. . F* "') . ')4 9*,< ' 4G >@?A' B . 9,D D , 030 47T6 ! 5 ~7>D * "6)+C!0C/ .3')$ Q!W ' "%(!Q" 4& .').3A* 0 ')"@! G !$ '& ' A @?A' B ' M"')# C.8' 3C-' C.8M$ *,C9* 9B0G*,$ ') '09BQJC.8M-C!0C< * "FG $7&* ! 7 5 "'0*,' EGK.8M"6)O',%T? # $ *,*L')4 *,7%(')< ') .3' "! * ' F* $5%(')< G>9,D &FJ ' & *,

0

+

# !" 8

: ;D 5 1 * 6 C

=

{

6

*E

F :; 5 I H

w~

& 0 " @

>e

' 3

2 ,

, +

& 0 @ 3

@

>

>

>e

>e >

>

^ "

, + '

"

M>

>

>

:< @< =

: ;< 9

'

z

y

|y

y |

y

w

~ v x

q }

w |

w z { y

|

|

u

x ~

}w

}

~ v

| }w ªy

|

z

v

w

~ |

}|

z y }

X

w

w

w

r z

y

|

{

y

~

yu

~z

|

z

y

w ~

~

= =

' 4

` X

x y

|

}

t

| y w x

}|

z

w

wu z

z

u w y

w

y

u N

D> >?

#

>

>?
')B0+>' % ' ?AE' D BQC *,/ "')D F ' ?A6 GQ >@?A' BO 9 ')"')4 ! ?"9 4O @?S')B0G)% *)@T>@?A' B ' ')$0 4 PQ! F$ * . . ')* 9 GQ% (D5 D C B @?A' B0 ' %A?A' B0@9* ' 3 F CZ% 7%(' < >* "FC $ "') $0 M' 'H$0C 0 $ C' P$0>' ED P $X')">' ED F ')C 3* $ "@!-"')4 4)" 4J@?A' B9*,.EG

* $-"3$0 $5 R@?S'7. "!5 >@?A' B#')>>K') 7* 'O6 *,$P*)M' #* * / ')4 ')AQ6Q"' U;M"6)! G=* $ *)$ &' *,X* 9ZM 9*, 4 Z@!X*,W.*,9*,6 !X*)$ $0D $ F " *,"!P' ?A* $R!QC') F$#*,F@*,"! 8A* "S' ?"C* $VD A >.*,.8 G * * $ $ SC')')>9* ' ' %7 C *,99 ? H ?S*,99 ',% CW.8' ! 3* $ $0>' EG * 5>I0.3#',%=* ' )#!0@F*,< ')0/2 *, *)>! G;*,3$P9* * "Z@! ',%S6 R* &! ' %0* 7' 4)* * "') C*, *)>') * ""@! GQ*, =*, . '))') GQ9 *)A" '))"' K$ *,* . 'QC 43G * $J*, ')* Z/1' T*, * . .8*,R' 8-*,3C 4O &*,C*)9B;D R' . ' OFS" *,"!&"O% * 6)' =',%V*)>! ',% H$ > M"')EGA L.8')C ""@! ' % ' .8" 4 H!QC< ' * $0 F*,"/ ' % /26QW* C9* 9B;GK*,$ * ""@! G%(')""') $0>M"') !0@< *, 3 C $ 'O.3')$') ' ?ED >')@?A' BQW4 >% * C G?AH*, .'0> W') *)C 4 *, *OF :W>! % * CR.* G*,T &.3C%(')7' % #C' L$0 M' H!0@
vp3kPw-z8flj>nlkPw s4s4|zPg3w nkPn(uLjZpNw-}4sJvgTk?[nlpa}4k8nlw-+y4jkPfhp3fTkJfh k?g3prv[4nlb tJ}r`kLg6jh jhn/iy4p3s4fh-+g3jhk8nlk{u+p3kP4p3mup3fljtur jrnlkPtJw rv j? u+g6Ty n \w- - $.

#

*

!(

*)":$5)3C' ( T.8')Z"6) ' TQ < 8=',%;""')>')>!J>F* C/ ":$#*) ' 0/2"6 G % * + 4)*,6 . SQ < 8',%0 S.3'C"6 G 1D )D %(9* >' H' %=)3C' R3* 7*, 3-$0>>$ED , +6 P ') 4 &< ?A' F$ 8 *WC%( E' L!QC M G '5?*,$04 *, !QC')>!-*)"%(!& "' G* $*, !QC< ' M"! >F* C"%(! "') ' 9 * $04 P* Z *, 8 C $5'#.3')$-* >6 !#'7< L T*)C')&?AT* B& C @"')F 3* =?AT?A' F$5"B ') +)3C' W$0 M' W!0@< ' 8R* "'7 C.8' 3$5*)

* >D+ 9* 7! 3G C7 ' F%K9B*)!M G06 * $W .3')>)G0 ?* Z'-*)* A""C "7 Q C * C9* 9B;G0? F9L>' "! *,$ >U;>6 !

3

3

3

F

b z?g6s+¢{+pakPs4nh}4w-kPkPstZn"pa[nhw-p?zTup3-g3u v/z?p3-z?yrpanlw-s47 6 !"#"8+$ 0%'&.()*9,+:+').+'-/;&/!"*?2;A13@ 8+'0"4B95+C..0D )!">* )+/- }4w-jb w-j g3v;}4nlw-kPjszTnhpa}4nh}4kQkPtJ6g6g6fhjhu n }~jhnhp3y4j mrs4u|g3w-s4nDinhkP}4k?k*sNjhny4p3fh4+yrk8u+pakPnlmNkPmdfhk8p3vj\kPflw kPn s4w-zPjkPj[s4g3}4n g?[p(k8v+k?k?paf?nhy4flk"b g3vH nh}4}4k>w-j[jlz?y4pafnl+}4k8kPu+6k?g6m{fuZjur}~jp3nlkPj[tJs4j?g3nin\kPik?sZkPz?nlg6p3tJ4y4kPjpaz?nh-k?k?mop3fp3j\w }4n[kPw-s j s4}4g3gT[n[k8p +vkPk?fTpa nly4fhkg3vinh}4k\jly4f+kPu+kPmJjurjnlkPtJjT n ikPz?g6tJkPjxz?-k?p3fH\}4kPsJjhnhy4mru|w-s4"nl}4kjhy4fh+k8u+kPmJflk8vk?fhkPs4zPk?j "

Ma

a

9b

!,

7b

`

*,F'R $7' 3* 6 = D * T &* J',% &*,C9* 9B0T*,4*,CT &"' H$0>' !0@< Z9CZ%@G 3 C $W'-' Q 7>')>S' .89* "') % * '-?* T$04 * " ',%K' . .8')Z"')EG *,3$ ? -"*,5 ' "') 4 >' M"! .8%(' < "$00" G) ' ?X*,54 9* >%( 0$04)*,/ $ * "') ' % 6Q 3L A$ A* !0@< % *,T" 9 * ?A* ! *, C > Z@!',T>')>' !0@Z< * R',% L9*,FC $PT*,R"' H$0>' H!0@ A' 87:$0 $P>U;>6 ! DA 'W$* )G6)!W""C"J* 8 $0' 'O@$0!W 7>I0 >0"') :O">! ',%""') $ > M"')P!0@>' L',%K)3C' T"L* 9,D

H F

! $ & ( , .

T

J 3

J

K

QM J

U

;M

QM K MJ

!5

)

! !0Q0 - . 0

"

' 9$0 ' $0>> C"I @!Q.3 ',%&"')W C!0C< '0$ ',%=$0 M' *,' M"')EGE*,$ C4 *, 3* $H$0 M' D * ' >' F ' 4)*,$L* ') $P@?A' ' .09E* .3 C ' +* =CM"') !0@ 4- >' 9$ S.3C9*, 45'O>C9*,9GQ,D3* A.3 CM"')D F * ' F* %(' $ ' * 8 Z 3/ G =/ >' )GE?" * 7* C ')$ %(') * J3CDP FJC' >')$ ?A' F$ 8W"3CC$ )'P C ' >')$ $ *,* * G0*O>')A'5' )G0 D D . '0C 4 5*,3$0Z->')$ ? C *,99 "4L%(' -) / "')6 . *,' F@',% C' 3>' ' $ $0F* FDA FT* '

1

-

1R-

- L) " 1R-

LTR(TR1 1 J

)' PC!0CU;M9 ' L# #.89>"6)$ >%( ',% A* 4)>K>' I .0" 4-.8*,.3A # ' !-*,% )+! #

1 ) 6 "" ) 1 R1 ) ) 1 K ) K 1)1

?* $06 "').3 $ Q!L R* "')*, S')M"')7%(' >@?A' B $ .0K',% CF="')&$0>' EDK *,0 ' 9 I *,') * R*)>') G0.8$ " 45%( TQ6 C4)*,' ED ' ' 9$ G * ' * $ +IQ.8 0!QC< 'Q' F> / 0 %(') C' -$0>' ED / 0 +* %(')?*,9$J9* "" 4 IQ.8+C!0C< G "-? F9 &'0$0M"')H',%=* ? % * M "R% * M *)C)G34 4)9&6 * "3* ' L' %+ *)C)D F 7 5* #"'0$0= ? % * > "'R S% * > *)C)G,*,$#. '0C 4 C').R?" 5>')>"') $ * ?L? H ' ? R: D _ / 0 FR?"C EFC. G3*,3$ .'0$0 EFC.L>'0$0)G * *, 8&>') 'Q$ G0. ' 6Q$0 A%(' :O"I0> ' P',% 7IQ.8R!QC< D ;G +/ O >/ * HF.8' . *, $ ?" " $0C> * 4 ') 0 5 X" " ',%+Z5 Z@! i' :W> *)M' D $ * 8 $5".0' 3*, * $L',%+""%@GVH>U;> * 9 4-%(') *, * $0!WBQ ' ? "3$0* "')',%"' D CA* ' Q! * *, ')FC $ GT$0>M$ 3C 4

8' ', D# O*,0 ' 9 $ ' ' #$0ZU;*, 3@?SH 5@?S' *,*) "3> ! * 6 L ' 8 * L' C.*,9* P @?S' 4 * 6 *,* H*,$0" $ *,* DK TB)!&% * >' 9K'#>' 3CF$0S*,T* 6Q"')*,' +' W!QC< "6 ' M9GV* $HIQ >0"') C* CFR3* 6' F* J ')E "ANO?V CFO?GQA YE 3G>E "ANM Y *ANI M GQANM ?KLVWO?GQALV

J "+K -L)

""% E')J*T!Q< 8' ECC*,' EG 3* K >6 V" * $0"$ *,*6QF* @?S')B#%(')< '09BQ% )+! x# J Z&(")+!

"+' K %8' ) F 8R')CA #$0'0' % 'J>?' " R* !0 3@')0='))"Q 4 "' R>IQC/ *,' " C' K >M"') ' I0.8Q) !0@G0? 7*,.. '). *, D * F6"')J >' 45*J. ',:T%(')A*J4 ' .W' %E9GQ? '5C ') F$ 3* 6 " *,CWG>C Y

"+) K 'R) &

.' ',@!Q.8-',% $ ZU;$ %(' < O' 4 *,K. ',',@!Q.3- / .8M9D # ') @?A' Q 0/ ?S')B0C* "')GV' Q / W. * #@?A' B8G0') >')$ * R*&7$ * 9* *)C ?* $0F' Q $EG " % * 6)' ',%* '0* "!O$06)' .8$O*,3$0Z$ * 9* *)C)G ? R"S?* %(ZS*,= T%( * CS',% 9* " ?* S ' S?A8 "$W'J * >+.3* CS',% ;D C4 *, *)C $W$0>' C !0@< 3* $H') / 0 I0.3C#!QC< ?A*) *,FC' "3>' .8' 9* $VG > Z?* %(ZA3* C4 *, 3* $W$0 M' ?A*)= > *,!J'J. ' 6Q$ R*J' G3JQ < 8 ',%+ . " $P%(' R F C "')EG8' 7" 4, ' %*5TC' D

@ C -

$S&

O. ',',@!Q.8& 3$0#$0F>C' ' 3C $ 6." J@!4 9*)*X* 9?SB ',"C1D%' D < 8 5*,', % CP')-*)-C 9,DEF7*,F' B).07 $0"U;T6 M')S%(')T*&.3*,F> F*, >D C @9* FCF*,8. ',:S*,@!Q. F*,!5.8$ *, $O'& >S ? 83* 6' ')>*R$ * !)G,* % ')4 *,). ',:S3* 3 ]*,4)$VD ^L FK*,4 4 . '0 C * ?A 8* 6Q' . * !0E*F*,4 V.*, A$0>>' 7',% * ' 3*,7' F$0

8* 6Q' D R9* ' 3*, 8 47* C M9 8* 6Q' AC' ?!&9* 4 ' 6)"GK*,O$ WC!04 C' @?A $0"U8

O* 0' $ 3* 6Q"') G= P. ',',@!Q.8 ?* 5>IQ$0 $ ' *,$ " @?A' >9-',% . ',:3" #%(')&:3 &? F9 $ * !0J* ( U8 M ]C' * S >GQ F*, MG 3* $W') * Z/2?A' $- CF*,

8#$06)' .8$VD ' 9$0A'-$0>R*, ')":3R $ DK "C% *)> +*,4 9*,. *, O* GQ*,$-. ' 6Q$ R"R0/ "@!7'i:W> ?Z 8', ."' ',%;*, ')IQ * $J"9* M"')EG I0. * "" 4J?! "+K 'R)&%(' 3$O*,O* >6"@!&* ' E

R.* .3="F@AC6 9*, %(0 R * >') *%(' C ',%= $0> "4]C' #*,3$0ZR$* *&'O)G *,$P* $*,.0'5* CT>')$0"' D R.0Q ? W"' D * * + "&' %T. 'QC 4P%(') F7 *,3$0Z& >' 9$VD ' ?A6) GE' F* D =*)97 *)$J*) * K* Q < 8K',% %(M"')R*)'0>F* $?"L"T* @!Q. F* "! ' .3*,! *T"4)J' 4)J' ?Z# S.' :")D T' S' %S * $ (3*,')C6 * EC "')G0*, *,#"4 ! * ' % / 3*,$Q/ $0 D; ;G;*, F*,* $0"T >' 9$O:3F$VD 0D CT',%K* .09* * 4 S%(' T*->'))"Q ')G0 $ )"=" G' O' %S < >A G0' 7CTI0*,C $VD A* =@?S' @!Q.3 ' %3 '0$0 "& A D S:3C @!Q.8A$ "4)* K$ * 9*T:3F$ H &* $0" ' 9$VG8* $H*,L* 6)J*WK*,' ' D% ]C' ')>3 * 3')0# G *, . $%(' < )D =*)9L"#FR * C4 $L*O4)*)$0#') 9* ! ' %T " "' ' $ 9* ' GK* $ PC >' 3$ .*,J% * 6)' 97 ?Z ' 4) ;G1D D0 #D .8' W* * ' '))G')"3$0"6QF$0* *,$ ZT' 9$>' G0 .* C * ').3*,' $0: $ ' F$VD *,F$ T &* BL',%A*, ')')$ ?* #' $ $ *, ') ',%A$0>M"4H*, ')' 9$ .3 ' $ED Q *,99 4J 7 " 3* *, 3#$ ' 7P $0 D 5C >')$ DK .8%(' KZ@',! % * F $0$ED 7*, ')S%( @9* * W' F$ . ' * "! 8 * . . " $W'&' *,/ * G 8',.3C9*, "4 'J "@! GQ*,3$&' +:$G? R$0>' W' %E*, ')U;>6 & -$0>>' ?A' $ 3)D F F' %>') 9C7C" * ').3 )C' " :F$ ',% "') $0 M' D =% *)M*, SF$0 * 3 "3$ 7')4 *,$ ?&C3$0!Q" 4 >"@! . ' 0/ ' EG1D )D=Q6 C4)*,L.* C F*,* ' )Q > "@! 2LW: ?" 5 * ! F*, CG

* $ "T*)M"6Q"G * $ ' #*,$0"9*,1D >CZ:8* "') *,& ').3*, 4 !0@< . ' 6F$0 ?"W* O*,$0"+* "0* +' .3')*,* "3C > Z@!J"6 * +6 K* +* 6)A*,B) .*)>O' WC!0C< D Q"3>-O',%>')"> 4 * $0"T$ * 9* DK .'0> 4J' 6) *)$-',% ' " M 45$ * 9*JF=S* WG A*)

8* H* * 9!W * 6)$0$"S Q%(')! ' T.8',F*,8"'S',% * $0"$ *,*J" T6 ',%V*7!QC< *)CEG ?> 8 4 -')+') D >')*, ' >') F* C$07" C%( 0') ', G) .33CK*)M"6Q"@! G :T$0 >F* C":3*,' &> G ,D ]>' -EG',^X%R '). $0].3',>')UK:CD 5^ 4 $VG+ 6Q? 4W@9* CFT*,R*OC!0C>R"' G0! * 6 %(' $ * T9 C*,F@*, 373C%( V"P$0 "@! D >')CFC#',%T*P. $0: $ >&',%.3' " 7*,&* 8W":3 *,' $ 'W J"*,' *,R*,3$VD O. $0>:3 $ 7*,OC')$0"' C#* J?A' $ Z# * 'Q' .ED

"

!

3 )6 '0$ * !)D

))2

O1

2

F

1

"

% ,Q.

" " #! Z&Z%'>)6 ! )6 ! J= =?< B@ ADCFEHGJILKNM/CHOPGQA W>' $0 3 5 *,CO. FC $ 6 "')X' % ) J $ ! G+(D, DL) J F :9@LC!0C< ' C @?S')B 9*~W: $0">! * ' 9> ',%&* $0"P$* *D ) J C-.* "6)! ' *, @?S')B *i:W* W.3* C J ' 4) * ')*)$ *)@

-

JGK* $ $0 $0M9J"6) 3* 6Q"') 7%(' < F# . D &*,. . ')*)9 @ $0'Q5 ' -' 9 ')CJ?" ')05*)C 4 7 @?S')B;G *,P$0'-Z7'O$0> 7"')ED

!

L) J

$

M

H

L)G;*,3$ $06Q$0 R" "' . ' .8 + > .3* 9B D C&.* 9B)>9 *, " * !) GV*,$ >' F* < ' F$0">' *

$ *,*TC* ')*,$0>' g3v }4gT p3s w-s+nhfly4m4kPf"zPg6y4-md6gNp3 g6y|n"nlg `

+.

(

&B$

(D3 * RO$>* ' 3*7$0%(')< 6)R9' *, A > ' M "')O>*' !) +6)F=M*)' 9> .0 8 '$O * 4 = " 4H.0' Q* !5.*, F> 406F*,5 & 2 ')7 CM G

')4 G'%(')< * 4065 ~7 ! 5 MG *, . 8 =C*,',%Q @?S')BR*)M"6Q"@! ',%3* ')CD 0D +')C 6 M')V* K #' < "$ " ! 7 ! 57 7+5 2 7 )' * 4 9*,. G G Q!H*, 4 O')CC/1',/2 '@ " %(' ')D #4 9*,.T*,7.*)$ ' P'O7:* F* ! T*) *-CT',% ! 7 ! 587 75 6 M')D D A:* 0* !) G o 062406579 2 7 MG>')$03C T>') M $Q/2 >@?A' B 6)>' 9 )' *T 4 +6 M' G A!0@< 6 M')G3* $ > 8 A@9* +',%0 =)" !QC' 9G;* $L O>') >' H6)>' 9 * $*)= . S'5*&C. I00.8G0MC3$O9 $ *,* +*,/1 .*,. ',G :?S9', % !0@I0.8>$7' >' @! ',% 9* BQ *,$ BQ ' ?$04) * 8' 0 ' ? ?S"R CH.' '0>')W* 0"/ * "S CD '& $O* 0F*,+Z9+ CG ?" '& )C F$0)Z:8* "')EG R$0'Q ' R*,0 F*, F$0)Z:8* "')ED :3 $ ! &G %(')#*)9 ')CGV 7:4 O>') $ ' ')">' ',% 4 *, ' % .*)@R*,C*)9B0D $* *&%(' < 7C') 9>AF>')< $'-FC' P* 8' A 7"B)>/ 'Q'Q$ *, * .*,F>* >') >' . W""6) 3* 6Q"') G 3* $ ' * ' ' 3CF@9A',%%(' T$0"U;% * >' 9 3 W* ' ' J* %( M"') ',%A O. ' 3* /

""@!O',% >') >' 'Q> " 43G)* $O 3* ',%E >' >' ED F F * $ ' OB' ?" $04 5',%A OF* "6)&'0> >-' %=-@!.8O',%>')0/ M' G3%(')T* .*, ' % ')CGV* T* .*,F>* ') "Q6)' 6 $EG3)D 43D8F " * ) $ "')H?Z * Q* Q < 3 ',% Q!A* ' ')>! $0":$X$ Q!L-!0@< *)$0U " 1 K

L) J

= = KZE QY XM GDALM ?KNVWOPGQANV

C!0C< . $ J"C 4L" * 5Z5?A*) O:9@#'H0">@?A' B $ *,* $0 M"!)G)* * ' 9>' %8 . 0 D " ' =*,0 . C)$ 3 >:' %;9O* $0 >FC' HC ')$ 7'0$ * ! >@?A' BO 9 ')"')4 !3* R93*, 4)$L"7J?A' B . $ ?A*)-.3C%(') 8L. $VDA * 0 ') *,FC'. C 0~975.3C%(')J$* *G;? 9 ' "4O*, F *, ' ' % P' 6)"'Q' B)$-P >*,99ED

B* *

F

d% ! o Z# )| #! )| >% )+! d'# = D=?< @BADCFEHGJILKLM/CHO?GQA

"

i! # Z&(

) %

L- LK " 6 $ $0G $ , ?* $06 "').3 $ *, ') -R* Z( @!4).3Z')""* !)D ')&*,X"$0 $0F"'C 7" %(' S* $5"' -3* >') F$ 8#>F* C": $ :9CA #*,4 ' D ]* "3%(@4 Z* 0$*,' 0#G *)' ' %09%(J' ' C%(3> GA? ! "6) 8* 6Q' O*, 8L$0>>$ * $ L. ' .8 * 0' Z" 3 ',Z: $VD *,0 ' 9 * 6)-' F$ I0.3O?Z ')$0 4 ' ]CK'#' .3*,"' ED ' ') M $ 'R*T.*,"' ') 4 #*T.3')C G *,#* > E' "@!>F* Z:3* "')6 D TC!0C< >'))9*, 6F> '0$0 *,=* $0F* C/ ":$ : Q!W>F* C": $9>9,D #C6QF> '0$0T*, 3#$ "6QF$0$ )'5 7>F* -6F> '0$0. ' 6Q$ J* 0"/ 3 *,' P*,$P*)> ' ' V6F> '& #D Q' A$ *,*J*,FS' 3 %(' F* C 4P ', %S : " 7 C A " 1 #D E" J* 0 F*,) - 7J * $ .3>' ')9$ *,&+*%( ' 7*,+(A

,*4$ % JB89, # +%K>(,(6G>(('+F,( .(+ . +(L;+ M89,0 (N21CD' O.+ .P4+(/.8Q.#E R #,$. % S' TEU?* ++78J(,A*4M 6 ! +R' D BV,?-(, F4/'+ U('+)R% , +W,4A2 XM4'Y+ ,4,Z>,Y >( S[O\S]^_ J,( +&H`( #64B a#4A>2YCD'+ 89,0 &89,/('+LA>;; %%6 VT'+B('+,/' S4B,(,( J+ %R4B(0(+44 , ! .+b4> #Y c> d]\e89,W' G](fgh+(, ! ' `+ (`.+b( ! 44B >( %0 +,@(, ! .+Ki,,(,L4B2SCD' j,$S8/(' &,(64B,34B,k#6T('+ A>S ( 82:CD' -6(4,( (KA ,(- J# +%WdVT'+ -?>+K8M$,(A*4BP+* j ,(%+ 89,32 CD' T .S('+.U1? / &(' T .k+(M8#gS[O\S]^l1(, &U$+(E Ak*):('+ #,.(,.8Q' R$)$(m.+gS[O\S]Ê$ E8U #.,(D8Q('+:(4 ,E)0' ,.,4'*)@('+. nNT[L .>T J, D + , ! (F(4,( ('+.OgS[O\S]ô ( 8;*T+.LkJ4Bj (4 ,( )F k ) ! +$(.81(4 ,( )W((B62 gS[O\S]^p4. 4B -.i+A*#. /+(,-

,.a+ &dV?* )3k+$ ! VT'+,&64' ,4,@( 0.,(/(' O+$, ;kJ'#qA>+,21CD' S

,.a# S4> #; 4S 89,(0.( k#R(' 0#$, ! '+$(,(4 89,.(H.kJ:' F+(, ! (+4'Z N' 0* jkJ,P+ d .8T' 3E0$ ,4BF04'+ 6P89,rVT' 4'Z' #$,&'+&.$ (6Z % HK(' ](fg 1k 4?* $st(' >+jkJ,j8D(@6&+H' .(F+ #uVT' 4'5 +(,OVL $Ok 4?* $(6v2 ! .+i(FQ2SCD' &+$,-4" A* )Wa+ d4B>.+S44B > $.(4T89,- JO.8;4"(A*E)3 , %0('+jV?W89,S(' j(' ,j4 ((L.8 (,A*4F ! (+4'5 (+,4"sw%'>&4B >(,P('+.&. )Z. D $ u % # 89,x(+,4O04'+ 6D 364'.81(' :89 ,T +.,(( (#DB42 y +,$' ,, ! F4 J(ER+$,L

,.a+ RS4B+$(,+4"v2CD' S

,.a+ P4B,k#6 ' R$)$(zD&VT'+ ! >(' :* &k#,T.8NA . +F*Aq %+>(&(' Rg-{+fl89, 64'' , ! 89,TI .

2 CD' 6$T

,.a# 6/.,' F4 +,(6&%.+$;R$;.8=BI #,$M()|,( 2UCD' ( , 0V,i,Al89,}Z* jkJ,.8P $ ,4B2y1,$ ! +l89,> ! (4 ,( )HBI J,(&VT' ,>(,(A*V ! +H('+3(4 ,E)H J 4)`8L('+ .kJ, ,) VDT+4B63LF(BO.8UBI #,$-$)$(_, 62D{*4+ ! $ $(4 7+. )$D.8U('+ + M,(64B, 189,~(' -$)$(~VD/ J,(89, ! .+@' L,( EU89,' +. )$ VD'+,4B6>(@('+P$)$(_D, DW' RBI J,(S$)$(32 gS[O\S]^l% ,.(7V?* ):'+., 4B *)-, J,(7j' M89,(8#4B(A*E)P( 0., 6 89,M4'F ! +0A ., +;%,

'+M

$89,+(,4B(A> )@89,M('+. 2;CD' ( %,

'+7+k ('+D{ {# ! ,7, ' ,1' D{+{+Y(6.j' 14( ! -c> 4?* ):%,( j>) k ,0. E 6QR('+M

,.a+ 2Nw'+R' D{+{+l4 vL89 ,(('+,1 *A6 %> M.*)-.8 ' (:,( #,$ ! ' P4.%+, (-.' ,D, J,(('+P$ J. ! 89,(z (' ,T' ,4. ! ,P ,R,(6. F .+2CD' R' #PH(' F*A6 %> (`.8DkJ.('5 +$P >,(+(

L- LK " 6

>) - )$ (A )`(i(' 3.

+ 4.(Z.8 gO[S\O]^R2CD'+D('+,1.$,(k D(' 1(-('+,(Ea#@k# Ba+/kJ)+& #4B,( (4 ,E) pCD' R.

+ 4.(.8/gS[S\O]^ +4 A,W,,(,kJ.'(' P ( %j64'+. ( ! +0(' O.+ (6F()*$(0 ! ('*+'

%j()*$(|0 .%,(

, A-' ,L$)$(2 `CD' S

,.a# 6/

,* +4B60k*)@gO[S\O]^b' J0++,$.#* %'+ Vo(' $)$( J, (6v2:] `(A,. 7 +$+4B6L' .' ,SEa# J, P.8#(' T()o('# /VN+./VT'+ UVD1BI J4" ! ,1A&( #64B a+Q2 ! "#$ CD' -('+,M8 ( >( a+ 0 4B+k D + ( ,.k +(,k#'+qA* , ! (+4'b$A,K

,%,@ %H,,(,2 ] b(+4'b4(' . (' ,-V,?iVTE'd' 0+(,S3' d' hqAd(+4'G,,(,O G('+89 (+,(2UCD'+('+-(' ,>( 89)F'+qA* %P' J+4B,$L#$,D(

J,(M89, gS[O\S]^P2 CD'+&. (' ,S,(64B% $:'+ O(' @A . +.(K.8;>(,+( iB4" d()*$(0S F4B+ E ! kJ4+(O' :89,c> #4B)F81 J(E A& % 2 2' P4B(+ v* jkJ,T87,(#$ .$ ( 'D ?* VTQ2/CD' :* jkJ,T8Q8 . (- J( (A ! 2 2 %E 0.(:+(O'+ T (4 (( a+iS>(,+( AjO,(j$(,.%'>(89,V,('++ 2RgS[O\S]^~'+:c> ( ' %'i* &k#,O8;8 . (j J(E A-44, %0(E:.' ,* 2 )L VA, ! ( #4B&(' ) *A>( HgS[O\S]^ R' %' )d,4B(A@(* ! ' )`K j$&' j:0, +,

+,(k 32Wy ,(('+,@,( ! ' )G .('+.j$+4B' 0 $j.88 . (@ J( (APP(' ,$ +%'(0 J,@ Sc> 4?F,(A* V ! ('+.S. $@0.?6(' R +,(k ( ,k 2 CD'+S.' ,/$ T('# gO[S\O]^w'+; .;8 @PB4B.>(,+$0.$( '+ UVDN( k+(c> >( ): 4B A,-k*)-(' ,76.+2N[L ( ! gS[O\S]^5'+70.+%6-( B(64"L>(,+$ (( ('+.TV,(-.%6Fk*)F(4B+,( )0 F4B, ! V =*) , M>(,+$Y $ &(+4'5 .0 Z % # ! (+(W8T( J4B. +$W+$, * &k#, ! $ % +(+4489+. 'L %+L+( %W.+.('+,S J,( L+(,O* jkJ, ! .$ (6K %+D89,x(,(+. LK +.,(( (#D(FVT'+4'('+j+(,L'# W44B6( ! +W.$ (6F % +M(@4B@ +(, +.,(( (#;&VT' 4'0' O#$,F+.D'+qA 442 y+,(' d89(+,( ! ('+`(' ,W*A*( Y$)$(}'+ 3V t J, (G +, +.,O,(6. P4+$(,.> ! (' &,(6c> ,L 3S B(64" K i++, / (4++j89,e' 3 >(,+( 5 ((@

! +Z`4

>0gS[O\S]^mVTE'Yd(, 0 )w(4B( 4 J ('+. ,(#0('+GkJ'+qA* ,.8P' `+$,W.8R' ()32

4,

;:

i:

J= D= KLE QYv M GQALM TKLVWOPGDALV

CD'+jV,?W

,(>(6O >,$( %0 i('+.SE-Sk+(3i$ 3BI J, +4Bj 3' '#.+ %i.+`+.( ,0.8T(4B+,( )i+4B> ! Z`,(%>. (i('+.P?-' ( +4>j(,+( )d %'`(K'#qA # %> (6`*+. M4

,j(4 ,E)`.+

b w nura\1k8+k?s f |s4pag?n\nlfhs¡w-4 yrnhk nhg tZp3-w zPk nh}~pan }rw-z}Xz?p3s ik p3m4k y~panlkP uXkPq|e4p3w-s4kPm +uRjhnhy4e4w-mr

0

,A*VR2CD' :+.k+ 6-(' F(' ,O3 4B+:(( :, +%W'+ V('+() 4..&-$ (T(4 ,( )P 04,U&' 1$?j.8# E, +%S' L$)$( ! ( ( %R+ .:A*$+ ( ! .#&'+ Vl0 >(,+( 0B4" F$)$( 4.k#La+ W(+4' @0. +,L%.(' P(

J,(L.87(' R+(,D.81('+P$)$(32 CD' R4B (P 6:VTE'i('+@,(%>. (3'+ PgO[S\O]^~ #,.(OG- #,('+ +: ( ,4B:8UV?* LLV 2] OO F4 ES(W(,( PVT' (' ,L('+PBI J, +4B6 89, ('+O()*$(pV 0(,.+$89,M(& .' ,*A* ,+@> ! gS[S\O]^b #,('+ +M(* 4 >$ )0 6(@(' R](fg.LnQT[S TgS.(+ QnNk#,.(,2 y +,$' ,, ! ' T.' ,U4B ., )P4B#(1' D+ ,(D8+('+D(4 ,E)RA* (# ' )VT('WFB4B ! +F0VT'+ L%,-('+)WV,:.k :(00(+2

:

;:

L ) # L%' #! &J! ! L ! ) >% )+! # Z&(")+! = =?< @BADCFEHGJILKLM/CHO?GQA )S)> J,A* V 0 NL$)$( VT (':VT,+,N4 J 27CD' /a+,N4 J 7Q ](, #.,)W^ I* J,(1()('+.7+E,N.#E7(,. Q89,1$%+N.8 >(,+$#Q?* VT P('+-(4 ,( )4B& ) ! (' O.' ,P+ ,. # BV,?&k#(F4 # >('+. . A )K 6.,+-('+0k#'+qA* ,:.83#$,:+`,(:` ,( VT' `(' F+ , QA*.(89,z(' L. , ) $] ., 6Hj ^ kJ'#qA>+,2 CD' (% ,O.8;' 0$)$(_+.(6O('+.O' 0.+ -(,. 14 i+ j89,

* jkJ,:.8ER$ ,4B ! VTE'` E: A O.8 B 2Py ,: +$+4B v('+ ?)*k#>.,t A st(' `$)$(}k+(,AWA,)Y?),(?K0 Gk*)l(' `+(, ! ('+ 40.+R A Esl' ()o,4B,+QA,)-40.+:$ 6Pk*)RT+(, ! (' $6(( A Esl' S()*$( .%%,(%.(U(A,. +40.+ M( @89,|(' S(S.8v % ' @()_(('+j @.8M % ! +Ka+#. ) ! %,( i A EstVT' ,(&$A,. 7+(, ,(-%, JW(%(' ,L.+W(,.(3T@4 (81?* VT+(,2 CD' D.' ,N(' j (('+.7' ,(B. 6>s (,qV LE8+)PVT sb L0 qA . .k Lj' O>(,+( (4B($)$( ! ' OkJB((,D(' :4'+.#4B-.8Q' -() kJ %Gk 0(d4,,(64" )G,(W.u ,(32 )L VA, ! ' W,(F .K +,(6$` ' ()h(' F,(F +,(k 0 (4F$(,%0.+H +,(4B6(( %Kk#64B@62iCD'+F$ %%,%> i A .8L 3VT M+.j

@(+4'uK, Z`(' >(,+( ZB4" ()32|y+,F' d + ,( J(d8 )L)* J,A>V ! (' `.' ,W64Bw(5 +,( A*K('+ ()zVT ('K.K+ , N(' P40.+ A 2

] Z^

= =

LA ILYE ZOTA G>C LY\V¡Y\V {GDKJCKNV¡YE {Y JO?GQKZE "ALI C LY *KNILOPC CFE "O

CD' :64B$0&.$( D(j

)0& +, # V,(?&89,('+-$.(4. =. ) (64"(&89 +4B(.8+(' L()$(0189,~O* jkJ,/8#'*)* #(' 6$6U.kJ/VT'+. ' P.+ EL, vVT 74B>.Q2;CD' P89 + @>. N'>)* J.' (DD'+ L' P.#ES(,. 4+$( (Zj (A .,.(3 G(, ! VT'+,K(' d+$,4+$( (Z)*+.4

,4B6(@'+ F@ W`(c> >(. )u, ,l$,(8-A>2bCD' i+ F,(64B, '+ -,(

,(6$>S$+4'iiA>O4+($S.8/A .,k L8UV0)* J = ! ' jA . 6 8SVT' 4'545kJ4' >$Z89, Ka# E(B.8OAq +sl89,&+$.#4BF' 3+..8 ' F,@+ M' 40.+uVP(( u*st(' .' , ! d4>(* +jA . ! 89, +$.#4Bj f o+.%O,L$:(+4'Q2

,(

CD'+R@,(R 3'*)* #(' 6$6('+.T89 V89,z' :89 ++.> Q'*)* #(' 6$ 2TCD' D+(,U$+k E/4B0.# 7(:44

('&O%AP(?J21CD' (D4B0.# VT k#4B#$>Q A,=( ! v(' +$,N4c> ,Q

,(89,+4vA* A*=VT'+4' VDq)0(' P(?W(' + kJP #,$89,(6v2BV(?(' j4" +T.81('+R+$, VT =kJO M +,(64Bk ! ,AF +,(64Bk 2/CD'># ! VSVT =k#$,(AL + ( (,(#Q.8+.%;:(' .+ Q, ! Nc>+$ (#.,)L$6c++4 ! >(,( #,( VT ('3 #,( D.8U $.(+,()04"(A*E)2 2TCD' 3

,B89,(,5k#'+qA* ,&8S' 3+$,@89 VL`*4'#$(4W qV ! ('+i.+ (,. 1k# % %(WVT'+4' ! :W +,( +4" K.8;' : qVF' &A ,(.k O.8 ('+j.+ E-,(64B, ic> 6 Q2TCD' j.#EO(,. N43('*+Sk#PA*VKLF(B .8S.

&.8T' 3c#($.(+,()`

,*42`CD' ('+,P (F'+ @ F4B D(BI

,& qVw89,(z&(BD.8U(

6 ! AVT' ('+O #, )* %

,4B7Uc>+( $.(+,()2QCD' 1 qVZVT * #jk#(,.(6PULk+ 4?-kJqI ! .#i :VT 1kJ0.

+,(qI.(63k>)3' +, 7 V,(? ! VT (' RA,O'#qA> % kJ30 -I

4B 2 2TCD' ,(R.,:4B,, (#;kJBV('+RAq,(#6( ,(64> + (' R ,4,v2CD' W54B@b$+(d'*)* #(' 6$ ! (+4Bd(' ,(GV l89, +.+4"sb. $Fk>)l 64B(E)swk#iwB+,O89,P+.+4"sb.+GA +.(6-(' 0(

P.8 2SCD'+j.' ,OBI J,(-()*$(_4+T' &+ S, N89,S?* VTK # $,+L8M.k #$ ! +F%B('+,DVTE'W' :

T89,p' -a+,$TBI J,(T() %.+' #4B-89,( ('+ ,$Ea#4 Q , Q V,(? '89,0SK

K.kJOVT' B' ,S(F,.$Pi. .,x, 2/CD' S 4B( 0BI #,$D$)$( (P

, A*6U('+O.,(( a#4 + , + V,(?&VTE' $ (+.(KqVD., 6( &+ sw+ @'+ S(' j+ L(,. N ( 8;*S .O4> s 89,' L(

(4 ,(,>1(S.+@ .( ! -(:' L4B

I ($.(D.8v. ,( ! ,/ 81 %,D89,D('+P$)$( ! Ba++k*)0(' P( (P(4B+,( )0 F4B,2;{*:a+%+,( 2 2 ] PkJ4BR4B ,:89,( ('+F$)$( %,.

' ! ('+.-' F.,(( a#4 / ,. /+BV,? 4 # >M8=(' -$)$(p4B k#OA>VM:a+ (,;'+ a+ E,/' S.#E,(64B, $(, kJB89,(OEDM

,(>P('+-64B$WBI #,$T()*$(321CD' J,'+. + ( ,

,(( % ! $+4BT,$Ea#4 + ,. * V,(?1.,8 (@

US' U#$21CD' TA*( 8# .kJ ,/

,(>&' ,D'+sw44, +%L(-' L.' ,sl' TA .>.%('# /('+ * ,4jAq # (G.8;' 0.,(( a#4B. U ,. 1 BV,?3Rd F4 R

,4B6( ! ('+. *67+.;4B+$+@D- 18#,( ,4B6N&(,01.8# +,(4B6(( %S J V, ! VT'+ (' D, >(#$AS+ : +,(4B6(( %P+Lk*)j' O64B$0I #,$() 4B+4B,.(6& 5j+4',(6+4B6b(B3.8P' `+ , 2 CD' 4 w w(5(' H(4B(.8 >(,+$#D ,(6. = 2

]

] a^ ^

^

ì: ]

+:

= =

YExO SY\ADC EHY\VWK 8CHV

CD' P ( % ,

L' R +, v BV,?F4B@ J+>L.87(' P()&sl' R+ ) +.,( '+ PVD-89 )i89 +4B(+ M R' (F.8

k 4 *st(3('+($Pk*)i89 %K 3+ L(,. N( k $(6Kk*)3 *)*+D#$,LiF{ Og `V,(? (N2 CD' )R+(R' T44B+ +%La+ /Q' T$ ,4M8+('++ /+ ! VT' ,4'&,(64B, 4> +1' L+T.8=(' O4B0.# ! ' L.+;87 f w.#@4,T,)P+( ! +i' * jkJ,:.8 +

P J,(89,v2@CD' k#% % ! +d+ ! 864' ($VT(4, k+ -89, ' P.+ ET, 2 CD' Ma+,$NI* J,@>14B+(,(6O(' +UNR+ N4>(* #N(c> > $(, .8:A>2 CD' d,$EaJ4B. T , L V,(?ZVD% At4'l+ W,(64B,

6.

/

Model of the user’s behaviour 4

Expert system

3

ANN Analysis and control

Results Learning Control

Artificial Neural Network

Data Encoding

Data Decoding 2

Complementary Context dependand inputs

Intrusion detection expert system

Data formatting

Data aquisition

Adjust

5 Knowledge base Security policy

1

Expert system Analysis and decision

6

1

Retrieval and formatting of audit data

4

Supervised learning and output interpretation

2

Computation of complementary context dependant input

5

Input from the model of the behaviour of the user

3

Raw output of the ANN

6

Final secision and alarm generation

y1 % , 2 4?W.%, .8N' )L)* J,A* V () %989,(

0 '

(c> >(. ) ! .+@(?6RR

,(64"U(' D I*M4B0.#jj' L(c> #4B21w' j' +BI*S+-VDL

,(6$>(W('+P BV,?0VDD,B(,. 6F0,( 4BT(' P+Vo4B A,)2 CD'+S4B@0+ ! .8=VT' 4'@(' ,(LVT'+, / (W j( +R ,d4' ! ' @ 0. U,( -kJ % ,(iVT (' d* ,40A .8 2 /+! +H' W(' , ,#PVT ('5dAq +W.8 / 2 / 2dCD' , #,$.>L +,@(,Da+ -(' P(+44BD.81('+R BV,? J,(89,+4B CD' P0 Ij 4B(A (KO>+@,(4 )W .,% ! +3('+,PBIS 4B*A>+4 %@ #4B ! +R' &89P(' D V,(?-VTE'j' >(,(D(c> #4B21CD' ,( 7 *?:c> (

,(( +%+21f,(,4B( )S

,4"P40.++Q'+RT' %'j%,

8=4a# +4S.+&' T8 .,(('+,MqVDq)R89,' S4,,(64"/

,4" &' L(

M.8=('+ ,$Ea#4 v +, J+BV,?FV ! ' R V,' P4Ba#+4B2 w' w *?* %H4B (,F 0' K,( EEFkJ4.KA*>('# W(3)* #6.8 40.+ DV,:.8 K

,4",(,, ! 89,L+$+4B:' ( $ 40.+ ! ('+. (

q)N(' T4 ,(,>1(D+@ 2UCD' +BV,?R'+j 6., j' VA,Q(R4 ((E89) ' --.d ,,( A .>O4B+ ! OV,(('d4+( , %F89,S+4 +(dK' &#$,

,.a# 2l{*+4'l4B@0+ 4B YkJ34'#.,4",(5@ (5' KB, $(4 (c> +4B2 S('+,:4B0.# ! (+4'dL' (j(( 6iVT' d %VTE'GF +,((.)* Jj8 .k+(() % '+ /4B,(' 6R.8 ! +j.1,.#o,A . ' ! VT' ,0,(?P A,)0 + 4 (A:8N('+R+(%-.81('+.T +.,((4B .,D+(,62;CD' : V,(?F (&0+.% P.0 4. )j((4B 40.+ UVT ('F(@ .,;4B(+ ! (+4'0 ! .# ! 8 (K +,(64B( %F 89,S ,LA*4BRA, 2CD' P. (' ,T B8 OEL0('+P +, V,(?&4B>,( BI #,$M()~(P64BD('+. $,(,, L ?D(' 6$TV,D 8 4"; +4.(A:.8/$64B ,E)WA> ! k L+$(.81,(-k# %3?* +Q2

] a^

= =

GQALM TKLVWOPGDALV

CD' ,(OV,(- (' O(O + k 4 (.8v' -()z(A,. + +,(k 0MVT ('W(' -+( 8/,$EaJ4B. Q ,. Q V,(?2CD' ,(RV, ! .+FF4B,$.3BI*( ! $( U., ! 89V ' ,((4. N,(6$ S3,4B+,(,>L , Q V,(?2CD' &.' ,D89++3E- F4 E (, +P('+&4B,(,4BO( P89,S(' @ V,(? ! +3' j +,B(,LV i.8 ( '+qA/(Ok#D(, +Rk*):(,. +P,(,,Q('*+7 6 %LOL(@D4B+( %-(%

,4B6(2 y +,$' ,, ! $+4BK,4 ,,(F,$Ea#4 T +, T BV,?0.,3tBI .

3.8 ()0SVT ('G896k+4?' ,@V dk#$.k+ E)i4+4,+2:CD'+&,(,4' ,S(qV #.k R4B a+% , + ! '+ T' )4B ! .' :( ! 89 )W++,$.#v2

;:

= = KZE QYvXM GDALM ?KNVWOPGQANV

CD' M +. J,14B ., )O@+$(, (6v'+ 7,$EaJ4B. + ,. BV,?v4B+ :'+qAMT

4 Z('+(4B(u8S. 0. +P4

,$)$(r4" A* )2dCD'

,(>&. (' , 89 -('+.R4 ,,(:,$R H[SgOgS:

,k+k )K $VT' , ! 89 ,(('+,R,(.,4'i >(,+$&B4" &'#7 .U

)6j[SgOgS7(:.*)P( % a#4U%,(2/O 4 84B ,(P>A*$i(' @+(&8[SgOgSO89,- # 4B)Kk#(i(64"(ÒV ! k :('+

,(>L. (' ,T?>+ VL81+(+4'3.

+,(>4'Q2 CD' LV,?P

,(>@/89 ,$' ,,TA . +.k T&'+ E 4B+(U' LB+ / (,(6d+(, ! A> gL]\ %gLBV,?3]>Ea+,('S4B+4B ! VT' ,(&4'i+(,-S(,4?KO' $ A6 4B,('+d V,(? ! .#t %5( ! ( %YE>( (2~[L (' , $(,+%& J>D81\O]\-{('+.TES.$( ( AO('+- +,(k z.81' Vw@'#.+ '+$O3('+& V,(?VT' 4'dW+.O #.,((4B + P i(' &' $O %% %04'+ (32 \O]\:{K (( T0? (,4?F8U4"(#T #,$89,(6k*)W(' 6$R' >TA*@' PnN[Og 0+.%, ! (+4BK64'b4B(w(+4'bH' $F.?6 ! A>+. )YVT S0 E896E$ E8 3(' j BV,?F A ! E8/'+ S'+$LDW4Bj 4.(RA*@('+.S BV,?FVT ('3' (V, v2N\O]\-{jU( #64B a#4 )R(% 6:(- >VT ('0f 4

1' $7& '+B(,(% +U*A>, >62N] ('+T

,(()> JT@ + @> @(' L'+$1)*

4. ) , F{* =:{ #2 2 ! VTE'@(' T { % D$4T{*4 ,( ) i* '1 #. 6 ! . ('+ %'j' ('+,D,( #,$T3A + % +,$.8/\S]\:{(, 3 d{=2 \O]\:{b`.8j .8j(' ,`0 +,34B # >2mO 64'b'+$ ! ) ! J,(89,0T *4. 7 >(,+( KB4" ! +K( ,((D,( E ! .+3 #.,( 8Q('+-+ , #89,D4B@& 4.(0VT ('(' -\S]\:{W ,4B(,62Uy ,((' ,(,(O4' % k ,+4$( '7 V,(?P(%>1'++(U U VT ! ('+.;@ (,7(, F4 H(' nN[Sg ! +`,( #,$:Z P(3' W\O]\-{H,4",62y1+. ) ! ' W4>(,. ( ! ! +. )$6N0.(,. 89,((' ' >U (,U.#R('+Dn7[Sgl (, ! '+ L, J,(D(0 ! +4B& 4 -(' R,( (' j{ {+&2

]

9 5

9 5

a7 5

J= = GQVBC SGQALOPCWGQE

T^

~065

~:

CD'+' >@ (,& J,(89,0P' 4 >(,+$u B(64" Y.#u, J,(( %+2G] @ 0j G.8/a+Aj0+,O4 # > ! (' ,&.8;VT' 4'd,(P,( J+( k+ j89,O+. )$ 8U(' P+ O 2MCD'+j.+ ES .L.#. )*(3 +.,. 2CD' :a+AP4 J ,( * 5CD' @

,(

,*4$,O4*A,$L' &,qV.#E:, U4 +4. 89,0 D$ k L89,89 ,(('+,

,(4$ %+21] T. $Ra# E,;' -+ , #89,D(

J, #M.#E ! + +((/ %:(R' T' ,(L

,4B( %R >2 # " CD' 3' >0 (, #,$89,(00( %+ ,(3.#. )*( ! VT'+,k*)

+.$(,(#D.8U?>+ VTA* (#8U(4 ,E)0 J 4 6L.,:(4. 6F89,2 CD' .k+ A>&

,*4$ %`.+ )(j(' K4 +4. D.+ (,. A>&k*)ZA> % ,(64B,Hk*)Z,(64B, ':(HB,@ E8:.uA>@ l.+ .8/ ( 8 ! S( F4B> ) >(,(6 +%0(0kJP89,(VD.,W(F(' j\O]\:{K,(64"(, BI J,(() ,4B( )2 CD' W. VDq)*W d89,$+4'wAWW % + ! ,.j %+ ! B42J(' dd' 4B 4" i.8M(' 0gL]\p . ! k R. $W( 896(' P4>(,. (WBI J,(S$)$(m j'+ L LL@

,(,= >,$(Q2 XM4'0 +$+4BO.8v' O'+$ (,M, +j4 *)&8 )Sq)$4? ! (jk+ ($`

,.a+ :8+(,P+H$)$( k#'+qA* , ! .+GK *?i89,P$ $(4 .+0. 6TK %'>S8/(' 6$P +,(a+ 62TX4'K$#4'i. )L(,.+(E((6( ('+P\S]\:{3,(64"(,89,D89 ,((' ,S.#. )*(2 HCD' R' $L.%>TD,( #+( k -89,L4,,( .( %P' R 89,.(

,. +4Zk*)`('+W' ,(+. )$P4B # >2d] Y,,P(G G( ! @4B+( E k ('+. (' :' %'+, A =A>;'+ (' -' ,(-+. )$M4 J 4Z% , ! +HVT' 4'u.8D' (0(G$+`(K' \O]\:{Z,(64"(, RI* J,(

F:

= =

$)$( 89,S89+,$' ,R.#. )*(2:{*@.8/('+(&A>L'+ R.,P@ J,(>O89, (' P() D4+$(,+4" W8Q(' PgS]\ T.,:. Vq)/89,(VD.,6(@('+:\O]\:{ ,4B(,2

LY

CD' Ln7[Sgt+E,;;:$+k+$;.8J(' OgO{ ! (' SgSBV,?j{*4 ,E) K (, ! A #6@. -f5\OqA* ! f. E89,(+ ! O{[j2CD' Ln7[Sgw+E,;.#. )*(UA,()R +4?U ' O+BV,?&P89,(zjA>V .87( % a#4A>W('+. V,(?0(%@>2UCD' (

R.+ )(DEa#T4B,$.W)* JD81 V,(?0kJ'#qA>+, >('+R+$:8U4,(.

,.4B s $ & $ ! & 1sl, 04S('# S+ L89,(_K (,(63' $ ! +`(' ,(89,0j >,$( % ! B4.2 ! 427. %K.' ,j(' %P(iE89)H+(,P ' )K A&4B,T' @ BV,?=2-y+ ,$' ,,P' @n7[Sg| (,-4+$(,+4"S +,( a+ M.8Q' >k#'+qA* , >VT' 4'0' $.,L ? )jj4B@& 4.(LVT ('FVT'+4'F'+$ ! $ %iVT' 4'H

,.(4 RB4.23CD' WnN[Og (,P+(&$

W' ,4:(K,() +F4B,$.VT' B' ,DR +,$4 ,4 64" 0,(

,(6$>;>(,+( ATk#'+qA* ,M, 2

"! $#&%' )( *+

CD' P ,4B(,T('+Pk ,.87' P\S]\:{,(#$3B4B(K$)$(2;CD'+P ,4B(, 4> +&' K+(,0,(8 4k*)5VT'+4'Y(' d{+{+ 4.t4B a+% ,(' i() ! + VT' 4'' R+((F.$.?* VT %-k#L

,( >,(+(+D4.2 CD' ,(64"(,-4+(-.8/VW0.d +,$ ' 4B& 4 +O+.%, ! + ' 0BI J,(j$)$(32FCD' 04j +4 (#:+.%,:R,(6$ J#$k &89,P4B 4B( % ' F 3$:KER89, ' 0' >R0.+%, ! .+Hn7[Sgp0.+%, ! ,(6$ J4B(A ) ! +4j+ 4 O' L &(('+RBI #,$L()z89,D89 ,((' ,T

,(4$ %+2 CD' RI* J,(S()*$(x0.?89,+4Lk#T('+P$64B ,E) (:87' P$)$( ! +j64'@ # A*+ ' $ ! .+@.%%,%.(6Q' D 89,(0.(&89,/

,(>.(j(:('+ { {#&2UCD'+SBI J,(()*$(p.0,+,()&,( B k+$6 %9, 3k+( 'UBI J,( ()32] OT

>(63 GfnN] { ! Wfw .+%+%:BI J,(O$)$(x@ + @> 89,mgS[O{ [P2 CD' 0 V~ A ;A>:,( #,$Gk>)i(' 0' >j+HnN[Ogp@ (,R.,$,$ T8 4BO d(' &BI J,(-()*$( .k+$2OCD' &,( #,$8 4B-.,P+ J#>:.8 ' W()*$( 8

(89, ! 89,hVT' 4'H' )G, % # (6v2CD'+0BI #,$j()h(' ,(u$%tH$ % K>Ea+,0(Z64't+(,08O' d()*$( 0HVT' ! ('+ gS]\h4+4 ! .+b4'w#$, W4"(A*E 6W,(d.$,(k tu('+gL]\&2|XMA> ,(3' w

4lb4B>BI*2oCDVZ0, +,0)* J08R4>(I*0I*$ O( +.(. S+ #, 2y ,R #.+4 ! ' 0.' ,:%A&(' I

8(k#'+qA* ,-('+. V &k#D J,(894" )& + 4B +UVT' @ J,(89,@6& ,( %:k +( U' +, ! k /' %'+ ) (+( #64"LVT' K #,$89,(3(' R P.81(' R+ %' ! T.3BI .

R.81( #, kJ'+qA* ,62iCD' BI #,$$)$(h+(P(VT+ VLP(KG4B,(, 0A>P('+. 44 ,T J,. v

,qI )2 {* +.(. =A>M?O >(@44B+(' :( ,4BL8Q('+OA> ! 4,( FA;89, 0+(,j0q)Gk#@,(0+4.(A08D>(,+( A0k#'+qA* , ! ('#.H('+W(FA> ,(%+ +%j89,x .' ,T#$,2 CD' RgL]\S +$+4B-.81j+(, ! ,

,(>+( +%@j89 ,

T V + ' , d 4 b ' % w u ( + ' ` ( ) B 4 , . ( u+V ! +$.#4B.8DgS]\j20\O]\-{`4B,(, @ ER+(,OE)dVT' G(' )i,qA,$ ' ,( %'Y.u +@ (,u' $ ! ,jVT' ,($A, 4B 64"(#P89,e('+(

+,.-0/132547698:/

;

2>7@7-CHE8:1IFKJ/3>C6GHE8:13FL6G8NMO@A>B6ED3M,QP

=A@A>B>C8:/ >B6ED3-C6GF

V, wBI ! (5(,)YY(4,(.w 8j #6 .*)l.8R' (`4 +4" +W4 wkJ .' ,S +$+4Bj.8;+(,S ,)4 64"(0' j()32CD'+j.' ,L$.( '+ A@(' %'' ).,TV +' ,MVDq)PP$ AD(' O

,k 0/VT ('Fk+ % ' PgL]\- ! ('+,:,(R(R.,;'+ L,0.)BTk#P ,$6v2

% %

M,( #.,)K(, :VT ('`' F

,..)* #+4.(G'+ R' F$)$(

J,(89,@6G I #64"(6 ! E0.+%@R(,4?&+(,M;(' )@ A4,(>(/(' O BV,? ! .#04B,( ,4B( )@4 (( a+0( & (6@ >(,+( +MU('+)@*44B ,, ! ' VA, ! +P #,$89,(0+4B a#% ,.,SqA . k 27y+ ,$' ,, ! (' -.' ,;

.+@(@A ' >@ (, '+ RV K+E,:$ J4Ea#4&' > ! (+4'dOa+ &(,A, ! .+d BV,?(,A, ! ((,+,()0+(,TV,? +2

# v ( (

\O]\:{3 #4B, J, (6V0(' ,L$)$(0TK L6$% ! )Sq)$4? ! +3gO{ Z2J\S]\:{ ,$6(' uc> 6 8@' V (t'++ u$(,k (6 ! ' B,% +3$)$(02 CD'+,

,4 +@ $ KV,?Z Y('+a# Y8O' Vz(H'+.# 3' (,(%++()*$ 0 ! (08VT' 4'H0q)d jk#0VT %KK +.,((4B + 0 Z>(,+( H B(64" Q2 \O]\:{P ( 8+N 789+ )P,(k ! k 1, 6NPkJ.('@,(k j+P4>(,. ( ,(+,4T B(64": >,(+(+2:] -: F4 E:(,( &VT'+B('+,:\S]\:{i0 %6R(G0.?' 0. A>( Z.8L .kJ ,&VTE' .*)` #,$89,(0.#4B0a+% , + (' ,L #,$. %@(('+RB-('+,R*O .:?* V 8;('+R$.(:,%+ Ld J*,:

,*.8 , % ! ,Q 8>' ,;N(B' %T,M$+k+.>(. +,( )* %D' M,$ %+2 CD' :89,(,T(D,(: ? )J22B2 V " WO " # oCD' S J, ( %P()0 ! F.+8v(' ( A6 !

, A> H'* %K@ >F.8R `(ZkJK

,*4$6 ! .+Y89,,.%3.#Y F4B+4)

7; ?

7

,.-0@A>7@ @ 47698:/

,(6(+-' &.+P8L 3'+:Kk#4B 6v23CD' W. (' ,R ( k#V 5VT'+,@k*)d(' W{ {#z(,( :VT'+.j.+ Ej .('+ $)$( (' 34B 4Bswk# %4.,B89+ v(W4 64"L %'K @(FkJj.k+ : B,@ E8Su,(#$u'#R.?u

4"sb.+ ! VT'+,F('+ KP,(6+4B6` H' F (,j.#. )*(P.%2CD'+F.' ,P$ ('+.j j

,(k+.k+ )3VT$&(

)K$@(,(O.8$

@

,( 4B(i` U4$6 ! 6((R' k ,PR('++. )$N %,E' ! 89, %OE189,o ,, A .>7 .+2 ! " WO Q " $ , CD' D.' ,N$.(;'+ 1('+ >(,+( PB4B(j()o$' :k#,(+(k ! .+-' P%T:SBa# ;V E/4B $6Q8 ,(+(k M$)$( 2/f'#.,4",$(4 ! .# .8M' % ,4&$)$( -'+ :EP4.dkJ #.>( K89,RE:)* #6-.8 .+ j, ! VT' 0(' A,. ;>(,+( H B(64" 5$)$(hj

4.k (G*)H+ j, !

, A>6`(' j'#ja+,$jkJY4B*A,((6H >GK% ,(4 89,.2;CD' R(' ,D +S[O{ [ J@(' R ((,L4 (2 O bCD'+. (' ,& (W('+. S [L5+ ( %G() $'+ Z'+qAW $ k i+(,F>(,(8 4i. VT %Z(4B+,( )5 04,(u4*A,(3$ )YVTE' (' j()_.+(F.?RA .>.%:8U Q L89.( ,2 UHk+L('+3('+j(4 J +.,,( VL4+( ,.k )uVT' Y' )l%HYZVT,( (3'+ S M,4"4. ) ! ('+

, #>$-(30.?034B

,((jkJBVH J V,$89+ 1 .+%+%. VT % (WI

,(6(O4B@ + IKc> ,(O.+K(W+ J .(j(' $)$(m?* VT % ! .+K ()Fk L 6( J V,$89 v .+%+%-VT' 4'3*D+.T,(6c> ,O( +(,. %+2 U w' L' S ((,4B,$. )&0q)@k#S(, ! (' O

,(>. (' ,/89 M('+.;('+, /&+4',D(-(' S$+T.8Q{ {+b >(,4" ! ('+@(' O.' ,UV j'+qA +TkJ A2

,5/I>C6G>7@ @B476G8:/

@ @A-C8:4 O2 58 3@A-B>7D

G K M

#

(5 )( %

;

[-{+ [ Jxa+,$j4B*A,(-' W++, )> %% = ?'- J, %i() j.#Ej(,. 4. 4. =89,(0 $s +.6gO[S\-y5k*)0' P.' ,sw+F' 3

,4B6((('+ ,( ( %0.+ T(,. v : + ! k>)WA . + +%@, D(' P^ O{+{XMn` . %+.%2 CD' F+ R(,. U4*A,(dR.6dk*)K' 8 4BR('+. ! G(' F(' ,:V, ! gO[S\-yp3(

G+ I k d +%'wY. V -BI +%Y.#E(,. F5kJ ,+$ @FP, %'>$89,VD.,PVDq)2Uy ,((' ,(,( ! (' -$)$( qA6U 89,(0.( 89,p' -89,.,+( .(, BI*,+. Ja+ ! (

,(,AT' R4B+ 4B(WkJBV ' j,qV.+ -(,. ! .+K(' j(,.+( .(6i.+ EO(,. ! ('*+O+k % .(,-+. )$ c> ,(@kJP$ VT ('3,(89,+4S(' RI*(,+ =89,.2 CD' P^ O{+{XMn` . %+.% ! L@64B ., (A-, k#(F .+%+% ! '+ TT$ J4Ea 4. )j. ,j(P.#E/, #.+ )(27CD' L('+,; D('+. S -% ,.

+,( J( , B k+(& %#.%T(' + ; 4(,( )j. Vl#4B %R.8v.*)j?*+.8v64B .,( .(A-?>+ VT 6%O,D0.?* +%&@% ,. J,(6( %jk#D('+.T?>+ VT 6%2 UiCD'+D 4>(,$NVT ('j,(%+,. I #,$/$)$( ! (+4'j ; DX{C % ($64"(# 2 ! 2 +! + 2 ' ! '+ /' S. (' ,;$.(T;,T4B &k#,(D89,/(' -{ {+w(P+(2U^T 0('+-^ O{+{XMnd %+%S,(O.

j4'W.#E,(64B,0(c> ) ! ('+) 4. +( (; .(' ,( Aq>Q?>+ VT 6%/.kJ N +$N,( v8>' M+. )$= :' ;89,( 8 V~, 6 ! .+d(' )G,(4B(A@ )i#4B ! ,(6c+ , +%I* + 4B P,( +$.( VT' (' )F'+qA-a+,Q2 CD' @.' ,S4 m('+.S' O . %+.%P0q)$( 1kJP(*F +c> P89,L' &qA,( %-{+{+ ! .+W' +4-&' %' , A = . %+.% % ^ O{+{XMn ' ! '+ TVT =kJ:4*A,$

A

^ O{+{XMnZVDO$+%%6KS89 ,(('+,O A

>2 )+.( ,P.8; -(

4B ) ! .#0, %'(89,V, ! ' S(' ,;*A*( F. F4

*s ,(P(('+389,LI .

:('+.S.8 / DX{CswVT' ,(O(' jBI

,$+Di^ O{ { XMn ,(R4*A,$00. >(,(#. Q4B-'+ L4kJR F4 )BI4(6WW' :,(%B 04' +2:CD' )i (W( %%$O$! % ,(A*. 'L (.(K4' +c> 6 ! ('# R4B+ kJP. +

Q2

A

# Q ( ( ' LK M

L

CD'+ + #,& +,(6$PV,?d'+ VDj(VT'+ @ 0 ,( ! 89,( d()*$(0j J,( ( J4" A ! j(' 0 .8TEP

+k 4.(Q2KCD' W >(,+4B(,)G+. )$:'+P,E ! +&(' O$)$(|

,k+k )jV @. ( ! '+@E;kJFqAq .k+ 89,/A . + ! k*)R' ('+,T T 6$2 CD'+4B, (4B$0Q8 .' ,1.

,4' %9 .k+ )-('+ / DX{C`()*$( 'Q.,; 7V 89 +6RP.,% > ! +- R' ;

,(>N(' , v

+ R 4?S,E62UO ;4. +. 0?R$ J4EaJ4-4 0Tk#LE (

+,(6$' ,2

A ;

>

@F

! * % ( LK5K

LK

'*/

':)

'*"/21.8:%D'*% AT1

/21./26DI8:%8

-{C1[/C . ! d.( ,W +,((.)* JF@ + @> 58T(' 3 F(,.#$ ( +. )$0. +

,(>4'5(u>(,+$t(4B(Q2o{>.(3,+$ (t.#. )*(@.?@' A*V|('+.R(' F4

,P: E )dZ$(4 ,$.( ! .#GA*3* &k#,P.8

J+B(, + ! @ 6wF$.(K,+(E + ! ' d4B

(,W+ 0 bZ4@

+,(@(5.,%F (2 % '${C1[/C_,(6 0( #64B a#4.(+8S' i 3(,.+(E + +4B6(.,)&(j4

B(-.F>(,+( ! (

0k*)@(' :{ {+ ! .+0(' FA . +.(. + T(,. vVTE'3,(6$ J4BT(@(' 6$P( J4B a#4 (#2

G LK5K

* *'

C1.k+ 2

4"T i,(#$(4+,(PVT' 4'.$4?,%>.+ +$ ,.(AO

,(A* %Mk>)I* + E %@ qVl +,(6$ W(' +2 T{\ G,(k Q2 C1.k 2

{C1[/C U (, 4B#., % 89,

'

"! #%$ &'!( )*!+%(,!( '-.-/.! 01$2/.!2, -.-3

4657578 5 9;:2A@>?

B

)09-2CEDFG.GH!+%(, !.( '-.-./! 01$/!2, -.-23

I

N'

3 -+' )PO

Q: R S K %UT@9>?

V

R01$2/H, -.-23PWXO

I

Z

!+%( , !( '--./.! 01.$/.!2, --23

[]\

^ 8

b'

, -.-23.c

* *

2J.

5 K 8 =LM@9>L

2=?>Y:
?

5 K 8 =L_`:

57a

>?>

CD'+S$ J4EaJ4 qVl e dgf 'h;('+.M *M .;,(B;' S(B k MVT' F4'+.+%. %K VT ,:.8(' 00. a+ ! ('+.PEP'+ ++$j.

J+ G(' 0+VT )d A,G0. +2jCD'+.$4?,O4.dI

E-('+-k*)i4B >)* %(B(+`4B@0+i>(,

,B,O( ' :0. J,4",) ! '+qAS dif 'hd.

J+W$>(. ) (' %P& ! +W.M('+-.

0

R'+qAO S4'+.+%- VT ,T8N('+P$' =(' :+(, 21CD' P.$4?,'#('*+ %>. ,.(A %9,T,*. ( #,$ +(, '; +,(A* %2 C7& #('+D4B#., jj* jkJ,.8N$.(O(,.+(E + ! VLa+,$>( 89)('+ $,$0.+5%>. D (625] Y,,jHBI4((' a+,$$( lk# A ! 4. '+qAF30. ;a+ ! ('+.&:('+Fa+,j(( G'+ @j+$j' Q2[OPVF

,%, ' ,( %'P(' D +1P' I .

! Va++P('+.U ( q' >(,+,7&+$1'+qA;VT,E

J,$&(:' T0. A,)j,4",) ! '+&+$;k#Lk D:BI4( ! d ! %9,@KA .,.(`('+,.(8 'P.#H dgf 'hM23CD' (' ,P?0' Wk+(,Aq.( '+ 5u,+.,) $)$(e' Wa#,$jVG((,((+&. $@. VDq)*P' ,( ! .+`' )H4H('*+PkJW%+,v23gL(0'+ &(' F# (+,(F8D(' F J+B(, 3(' S4(:S .T' PBI64B 8U(' j(B * (' Q J,-$2XMA3 8U(' P>(,+, 4' >$j .LWI*64BR('+@40.+3>(,

,B, ! ('+,jV K 1k#@0A* .( 0('# M' ,L VtI*$.0BI64B.k O(B . ,(*./a# O('+O()*$( ('+.M('+ ( J,( +(& , % 'M S4B,

5

attacker mod_setuid(object) attacker creates(object) attacker mod_owneruid(object)

SR

S C-2

1. exists(object)=false 2. attacker=root

SC

S C-1

1. owner(object)=attacker 2. setuid(object)=enabled

1. owner(object)=attacker 2. setuid(object)=disabled

1. owner(object)=attacker 2. setuid(object)=enabled

object=/usr/spool/mail/root

y1% , 2 O

{C1[/C {> :(,.+(E %,. % 89,

'

CD' ,(#$H4B,k#6d.kJ A@ +S(' 0$ @(,.+(E G.%, Ga+% , 2 2~gL(d'+ V (' G >(,+( b(4+,(u.kJ Ad'+Wk#$(,

#6w.8P0>) (( (#M.kJ VT'+.;(' O+ ,S.8=' S>(,+$0 ! 2 %#2.' L8 4"M'+ (' Sa+ T04B >)W.8N' j40.+ >,

,((, 2/CD' T 89,( 0 3T+.L 64B.,)(F(4BL('+PA* .(Q2;CD' :a#,$S ! ('+.L.8/4B,.( % L +, >LiB4" +%0(' L>(,+( '+ VA, ! S S.8;A* N@ J,(+4Bj' V (' Ta+ jS4,(6 ! ,SVT'# S -4> +2TCD'*+ ! ('+ $.((,.+(E j.%,'+7k+$(,4"PqVDq)O89,(o(' >,(+(P&(+4'&SVq)R P. VY(' O%,.R,(

,(>;A .,.(+U8#' S.T >,(+(0(4+,( ! ('+. ,@$(,.%'>(89,V, ! (

$(4 ! $%# (+,(@k+(G,(#$`B4" `() 0q)08 =FB4"62

5 *

] Y,,&(H. +

)`' $.((,.+( (5.%,0P

,(>(6Z,( ,&(' 3.' , 0?-V

, A*(+ 2TCD' R>(,+$j#T'+qA:@A*$k - ,,F(' %*6Ww(Y #,$89,( .*)t.8@u* jkJ,.8 >(,+( .$ ! (0%>.W%,(6 (,D

,(A* % ! (:,+(E VT v'#qA-(' :

J,((+ E)&.8v4.4' %-' 32/CD' Of .#EU, +,(+4&k*)R(' L4

,//+( (' P(+,4-8789,0 k#T(' P() T (-,+$ (#2 CD'+ O{C1[/C5 +,((.)* JD/>(+/O, E (DBI #,$M()89,M(4B( % >(,+( +R`, E (2FCD' 0 +,((.)* J,( #Ru{* =:{ #2 2 ! VT ('`(' {* J:{ T { % $4$64B , )K@+ '- +$ Q2CD'+R

, A>6 -{C1[/C~VT ('Z 0( %545kJ A*Y >i89+,@0, +, S f UG4B

.>+ &, 2 O{C1[/C V " ,$ CD'+

+,( J(8 ('+U 7(:4B 4BU . ! +@(@,D('+. .:89,;89 ,(O,(89,+421] 0('+S

,..)* #L(' &, ! a+ (, ! .+i +$6L' D{ .#E:,4B,+T(('+&89,#4B +% 2:CD' -{C1[/C~4 +4. Q89,(0.O>( a+6L' @+ -,4,K44B,* %jP' S,(

! VT'+,S' O+, T { .#EL,4,W4>(T.,O0

#6>(@('+(:a+ 2 wCD' ?>+ VT 6%@k+(4B#$-.8MV34B J > ! (' , k+$ ! +Y(' 38 4"$ k+$2bCD' 38 4B$ k+(K4B>.+@ 89,(0.(w.kJ' k +4"- d(' 0()*$( ! 2 2=%,+ +S8;a+ -,:,(64", 6 %4. Ka# 6$-k*) ('+-(' ,( '1'+ D$'+,(O4B,( 4'+.,4B(,4U('+.0.?L' A* ,.k+ (H4B,$.Z)* #6@.8O.$4?2ZCD' ,(+ k+$4B>.+P' K F(,.#$ ( .%,O'+ j6(4,(kJ +,$4 .,: >,(+(H(4+,(+2CD' .$,R89,( 0 FD$(,(60 WVja+ ' ! .+F(' 25CD' K 6(4,( uk $(,(W(' K$ ((,((# !

4"0kJ Vl(' -4B,4 6;0a+%+,( 2 +! +('+O( %+ ,(L4" .k+ -, ('+P$%+.( ,:4" + !

4B6k# AS' P.,4a+% , 2 2 EO tCD' R 89,+4R % -' 3A +.(6(' P+V+ L,(64B, ! +( +%P 89,.(89,|(' O,(+ k+$ ! +@(' S8 4B$ k+( ! .+0+ J .( %R' 8 4B$ k+(KVT (' $.(i89,0 Q2CD' iA +.(tW i H89,VD., 4'+ %:8 $' ! 2 2 VY8 4B %.+ EM,4, ( 'N &(:('+LA . +.(.8v. , 6-('+.P4B+ ` J#Gd' 0 VT )d((,((6K8 4" ! .+d('+8 4"( k#(& = 44B, % ) ! .# q,& #>((k -,(#$FD, J,((Q21CD' :Aq # (W.8Q' S>(,+$(4+,(/*A .,k )@ 0(&j 8Q +.,((. #0 4'+ % ! ('+3$.(3.8OVT' 4'l'+jHk#K$(,5 Y('+8 4"( k+$89, J$k W89 ( , 0 4' +%H% +$0 V .#EF,4, ! ('# W4B Y4

B(3' K,(#$ 4B#., #2iCD' (F8 4"@.,W$(,(6H l3k 0.. uk>)`' W89,#4B +% 2 LK5K

+

;

3

;

;

< .2 7@B476:F 4A698:/ 5F 7@B4A6CP

D 47698:/ "6ED @

>B6ED36E@ 1?@C>747-C8 ,.698:/ 6ED @

>C8 D3692*-0@

tCD' &64B$K % & 89,(0S(' { {+~'+ O(' @ 89,+4P N

% G'#B4"u J$k d,(#$Q2 ] b' `

,(()> J ! (' H4( % @, J,(O(' (4B(6d>(,+$d((' 0{ {+ ! 89,(0O' VT' A, G$.(3.8O*)Z +$+4B.8S(' K4B#., G'+@kJt ($a+ ! .+l$+%%6

#>(( k+ W4" +:(3' { {# i

,@

ji (,.+(E `('+.&4Z 6 (Gd4B

,$6Z 2iCD' .' ,P( %%$P('+.@389 ,(('u4'#. $ 4B+ ZkJ3 6H(G0.?W(' 4(u % W,( J+u4" A )di('*VD.,( (' P.$4? ! D L

,(%,$62

K5K

V! "# $ ! #9 %& !'PV(*)+),-. ( #/- 012%&jV3.45) $"76 983 :! ;%&.2 + ! 2"945 ?5 !2@. .# ! 8A* B5;% C8(* . #/ 0>*"Pk .4-. )@;-%* !i? ! +:D "E)+! A0a )!* ! ! ; $"#C9- !:! )va )! 0>*.%6F* > $" .0>- $"G 5 -{ 1[HI! " **"J012:$"KK" &*%& !

;!2D " * $;%.+ %B01; %&$.6 L. #/ 01 %.BM8A! 1 N8 (OP + :)!18(- ;5+-K 59)! . #/ 0>*"Q R. " +S%.)!)+$%T ! ! $;' *;K+ "!%*5 $"U G2" . K)!!:G)!-" !

-{ 7[HI* PO8(*)+),8AVS;

*0W# " + $%&- " ! k 8A .P. "V!-. +4-)!!%*5 !23( %G- $"D1 $" ;0>= $%&- ",#/ 0E6

# 7` ( ( K5K

]MA?+ * $+ :9 " .) * .*" ! 8A +)!! %&- 5+:>+3!E 90> *015 ?%.)7#/ 0>.8 # L.

^&.6 % ]ML?CL58Ag * .C - L8A&. C )?5. C $;$ %8-L;*%.Ea2%*)!)+ ! + *"tkR O %R-.c* -6 'e\3* + K?D#k +*%& ! ! S % 2$ ( 1 \4-30>. + ! $;*%.!)+)!D + %.=VB)!. " AV;*)V#C 1 %&!.A&[ *% !^6 g . 8A! ! D8 G? * . $"J8AVu* ( ), - : * ! 8AV'. #/ ( 012%&##^ -: 01.67]M# ! #/ &[0>)! ! P . % :$_? - 8(- " ! 8A!)+>; ; *0j"0N!? - !R " !:E 1 ;8 "da )+ ! :a )+01\Fk)!&# B!EF! %. !; *A; -6 ! $ ??E;*%.!),%.-;># ; % !5+-G k)!.0E6F]M#A :- 0 -( -%&M%. " + ! \8 ! D5 %-. %.F5qr*%T( <. 5+-# g :- 0~k>2* ;#/- 0>!:9%&* ;!1. 5+- _" !:g.[$%B +-#r :- 0 6L?!g" %)VA10>+ - *6

)G LK

)( ( *'

]vO " * gkNk)!9 2$%&+#/E $;>" +q* *= c>! .0>.3G N&[ $%B +-G# !4+)!.:-*" % t &( S]\ '( :- 01H & "R#/ 1 + :G!)!: : ! + 8A?%R P;*%.V#/ %&-

*%& *% +k2*!: . 5 !F#sN :- 0E6 - 3#/ 01)!)+ ! . ; = 5B ! g%.( *( + * " $"k.2\4! #CN :- 0 ! ? *%& a $"Pk=0N$ s#B: 0>01 $6^?@:- 0>0> s" a $sB#/ 0>)-)? : : %pg & #( . * %&$3#H )!: : '8A- )+ .k&%&- ;?;3#, :- 0d-2* ! *6 K+ - !:ee -: 0 0>1 b;[ " !4*c ;!:P# O;6c . %.G# -: 0 -2* ! B&[ *% $"KkD( #k +$%T*6.2%&#_. 5 !2 % -%&N#/ 0W1&[ *% !O#( 1 -: 0 'B?=k!$"K#/ 0 " +=

!)!=!J $) +0>-6[BK $2%.%&$ ;#9)^2 ;!:15 .0> B! " ?%. $B>4+-)! ! #C -%&=)!!%. "F

+:-:* .0>*" ?)7 * **6 2* ! "K#/ 0W1* )!!*; )?5. **6;[BE&[0>)!=#LN *%& a2%*5 !F#/ 9X f d P?A!a2: 6 26 - D%.0>)!& .[ 0>)+-6 % ' ' ' ) +s!:

K

,

6

?" *- $;*-*"P2\4.-.*R!0>)!.0>. $"'!bG 2 0>$"0/ ,w 21 3/3!;

4- $" _ :- 0 wH[ $%B +- K+ - *65/ ,w ! -+20>G(::-*; ! 0> V g :- 01B&[ $%B *"K!S " ? 4- *"S; ; .0E6?)+? *"6- %.)!)+$%T !:A.[$%B +-=

%.*r#/ 0 (4\ !2r-; ! " %/- 7 -)! '7" ? 4 - _.0 -%& - &8 #/ 3 %.*;!:286 / ,w %. ?A#_ 9 ! ! ! " 0 -!$,=45 + _ -%&$_#/- 0 -; ; *0 8A!"1

%. ! - ?>*; $@ " -K> .'%& !412)! . *6 *8A +)! G 2$%&7 =2%. ! 01 :. 1%. ()+1+F"5A - -; ' +#e#-)+ ! &[0>)!#P; ; *0 25F +)!! *2-)+?%& 253?gD2-)+?%& 8A+ SD" &#Y)V=" .;2%&6W+ * 0>- ! * .*"18 N"!%B *H< 5 3#73!

+4-X-2* \4+ _ 5 30>& " %.)?"S"& $%T$6N1" ?%B ;!SJ %*)?A -!)!V ! "S58 ; ; *0 " !;

4 - $=! )! - :^61>*;9%.-;$%& )!^ " -10N- N :- ! - 9:!4*G%B . Y%\

7

; >#A5q7! ! ->0j ;#%. - ?=2*"K8A+ O>#Y%&$+ -)!g015%+ : $%)!:-N- ! 2"18A. ! + -*%&-0>*A\45!)! -)!6 A -2;$"0> " .) LL+ - -;?C !>#>.2" VA -)!.4-.*6L* *4*- \4: ! -)!"Q"5e -2 FJ.4-.*6 Bv

+- ;!:25( $F *%&7 = $"J8AV' S #/)!)!58B UF * 2P S !0>0>*" ?5.)!K#/)!)!58B UE .01 ?%. ! + . 01=#,>.4-.3 25= >015%. =8)?"O;*6 > g \4- *4!2;)! ?" *- =2*"R ;% >%& )!0 " -2K%.)!- =2*" ! #/ 0 J +:- 5 D. ;*%& !4 ! >=#/)!)+58A!:>%&)?;$= [\> ?A@B 56)6;1c(0>. L#Y%Ts s 0>&+ :B.4-. ^.[?; *"=?^*4!" * %&,#=!- (2;! !F 0>g! ;2%&**6 +- (.[ 0>)+ ! ;$ %+ :#/ ( ? ! A%.)?"D 54?" =.: .4?" . %.6 C8;1f A#Y%&_ .4-. ) +:_ .$">+;

!%&(

?>.2%&B?,( %&!. 1- . !

;!@6 DA'*#)6/'E-!F#&G9#FP.4-. )^*4*-g " = $"+K ?)s " . ! Z6 -6 01 )!)!.) N; ?>. ?)( *%&- " + ! 0j ;.[?;!P " . 9#/ D)?5. 9# !- (2;!E;*%. =%.5+-D1)?"76 NH8#'E)6 !, P-0N. !:1 .$"D#/- AA0> D NMO 9)+$ PMQ> !0>F5# . *4*- I 6.[ )+-V5 !P#BE -%&%&- " + ! ?%.)!)!:!4$( ?;AJ VF#L58AE+

+- ! #Y)+)^!F = ;g " ;$%&- "F%*5.:- -254-6

'

P ; *01

* 5 * ? % ! # %

v` M , N. g : 5<#_901\45!)!-)! $% ? *3#_ ; * G0>%!: ! %.)! *" UL.

2. ! Q NCU 3Z &,#/ ! 8)?" -g -*;(*% 4?>3 N)! ! +2%&+B)+* "F *01;*)+4-* 1N: !%*)r . * . !F&%6 ' -2;$" N(-)+ $" UL.

GL 015 NCUG . %.&#/ , " +q* E#/ 0

S *:)?( U2NCUG 9+'K> > 0 -. # * *%T ! .J)!-%S%. %

.2%&#/- 9&[0N )+-6 *J .!')!)( D#/*5 **%.* G#/ @ ;D+R+

+-'" &*%& !'58.4-. $6 + B !- "2%T !F NCUG3 $%&0>0>.2" \ Z6 +- C&[0>)!,# B 2$%&7 =2%. !# !- (2;!9 !: ( / +:g ( - *" UL.

7& ! . = : \6 Y6 K

s4 t4

F = true_name(this[OBJ])

s5

at

st

Intrusion scenario cp /bin/sh /usr/spool/mail/root chmod 4755 /usr/spool/mail/root touch x mail root < x /usr/spool/mail/root

t5

Invariant: same_uid

s6 e

am

un

s1

t1

s2

write this[PID] != 0 && true_name(this[OBJ]) = true_name("/usr/spool/mail/root") && FILE = this[OBJ]

t2

s3

chmod

t7

s7

exec

this[OBJ] = FILE

true_name(this[PROG]) = true_name("/usr/ucb/mail") && this[ARGS]= ~"\\"

+C+: \6 YEB/ B . !$"F ?.:-+ =%*F *2-2" 0>!%*)!)+-"" *"D 1 )+ *-"

+: B/WB ; ; .0 %&-0>2-.*6K )!;. >%&0>*9!9+0>)! 3 0>.*"R !:A C U 3 _8w PG.[. C .0 ; .)!)p6L?^?sA)?5. C4* +-=# U 3 _8w P 5*-B *()+ $"+E#/ g01A J B4-. ;! B#L N;# 8 ! *-%8AV

= .0>. ! - -;$"G-S! -2 O#/ -0W#9 * * * %G>NQP C3PVRB ! "d2;* ! $6,AJ A4-. ;! > %V*%&( )!)+K " ! +! 0> ")? B ".+- +)+g- >%&)!!. 3v;* 4-. A %+ $%T( -6

+ ;. 0> ! 8A+)!9 )! 3 - *"E!

+-K" &*%T+-G ; *0 *0>+ *"

0> ! P 01)!b"& $%T+-f#9 %& ! )++c8 % :-*"76 ?E% :-S%*0> -2 = E. -)! B/3wCPK" *)C )!K8A+ J;!0>)!. 0N. * ?;$"K" ? 4- *3 +- ! - )? 8AVK0j )VC0> ")C" ?;

7- ! ! ( %G-g%.)?"K ?;#/ 0 F2;* 5. #/ 0>g8 %.0>)!& *)+K"Vqr. .=-; 7>!. !F#/ 25g # 8 ! " 2+ ?"\10> + :-=! - 2;P2;!:A . !:! $ >;5!; ?%.)70>".)7 5A$( " +qr. . : = R2;* A!A! ! ! 1%*%&*6

/1 @A>

Y1

?

N

-':Q' '*)+; Q

V

;1)

!14-. ;!e8-1G *()+>#-2;* #/**"-2%e-9O . #/ 01 %.F# XB/. 45 ?A -)!* ! A8A + !:% :-+ :%&-= : !.= )+$.6 *3% :$,8. B01" N)!)+*4! g8A258- -.!:9.[ 2* : 3 * %&$"E- A2* ;#/- 01 %&2 d6AD; ?!%*), )! ;?%&-0>2-.; - $=+ #/- 01 !PA- > = )+ "P" : 3

*%T S-%.%&$ *9)+?.@ 6 BM8#/ "J 5 $;F)+?;N%& )!"J:- 58 ?>+ )? : 1 " #g*

+$ 1c+R;-0N %&! %01 %.**@ 6 BvR " . 9 J)!)+*4: 3 51 ! -)!.0 ! . *"* +:-*"OF )! ;?)!:- + 0 25 +g.$" B \4-. ;3 . ! )+?gB = !0N9#_. "VB *%. "D %&$ + : ! !A %&$ !:80>54-*"11 A = )!=:. . 5 ! :-3! ; *-"76 + ;. 0> ! V8-H#/ "1 50>N#7 = )!*, 8A* 3%&2;?" . *"+ 9 .4! g :- E8-B#, *0N D25( ! "E 53 * 8 )!" X -2! %.) "*"E!E =2 )^ = )+#s 5O ;* B8\-6 XB/ ;D = )+$ ! -O 0>!:G" ! $%T +$$ %'- ! ! &%6 -2.[ %.) 2" *"D#/ -0 #9 . A %&* +:26 \ R 6 G #/$5( 18-"" *"S:!4> 0 ;* D%?%&>#2\4!: $:) 3p+0> XB/*;0N2+2*"S# $)r !0>%&)! % ! .[%&) ;!4*)+-6 [R 6 GZ . C%&-= : -)+_(I -J$%T@ = )+_%*%,8-^""*" ! g .*"P %.*;!: !F 01)!" &*%& !E0>" )+-6 BvG " . AD 2**"KK".4*)+-0>.

?

N

9)+'

'20

!g * $;* *"E>01 J- B54* 2.)r#L XB/?;$" A = )!(; - : ( %&( 6 XB/ :-D#=; . 0 ! 2"e)!:S * 0 = )!**6 . N # XB/#/ 015,% :$ ! g - _8(* B -)+ $" %.A - .)!+ B :

?>! *0N*#C =8K = )!*Q -F-0j %E \ ] 6 VA$:) 3p+0>>%&I= : 5+-K# XB/N"& $%T+- ! 2" -25%E0> " " . *%& !^6 -&> .)!*-;=# B/3Cw PD!

" %&$" &[ **3 +4-(-;4 -!)++ !*C#/- L X PIP$ b %.= : )+0>-;H9 *%TH# )! ;? %&-0>2-. ! #/ 0I58R" . $%T $"N+

+- H *2- ;*" ! = A45 ! C 3

0>&. A 25=:54* E>-0>)+E" . *%& !O%&0>*3# XB/*"!E $:) 3p+0> ! 8A .XB/01 +$#C)+* ;A = *2- ;*". !"!%*)!)+-6 /3E01 :*0N* " 7 =2%. ! g+

" %.*"E! XB/-;_# * 8 =2)+$H8()?" -A+ %.) 2" *">!N T . H = )+#/- L ,$ -J*%&,93 8\ ! "A .0 -2*+ :9" .*0>*"1! +:- =%. - 2_.18)?"1)?5. %&-0Ng - " .1=5 ?; ?%.) A = )!g:-.* - *6C! * A-)!* " B/3Cw PF F %.* $;" %)V=%.-;$A+K0>;. g#H ! ! *-"E# -2- ;+:N %&* +:1)V:. * *6 01 J- .8Q#/*( *8. 1 Bv- "2%T !J#(D UL. )H %. ! f a AO 6 U_ .4! )+ED%.4* ;. 3#/ -0 -;= *%&7 =2%N. "V=

!)s F L XB/ 0 -. #0>)!D UL. )_%& + = ! * ;#Y-%&> . " + !:10>*%2?;01 B/3Cw PF8A. )?;> 54!" $"76 GBPf a b0>-V g#/ !%B gw_ * &3! * ;#Y-%&**6=@ -2N. -)! " &*%T+-E#C R =# S +q* *6 U wH[ 2" *"K " +3 *%. " #Y%T)! -6*"b -R - ! " %&-)+)!*%&1"O#/ 0 4\ !2 -;14?PO%.0> . &8 6f (%.)!)+$%TC " +C" ! #/ 0 45 ! @-; 3 - *"=)!: 1 . _!CB 54?;! K !)+? NCU SVXG U8U,w V YY_Z6 6 3 -2 *"S&8

%N)!:- 1f%&4-. .0 9 3%. ?%.$) XB/#/ 0> ! "N 0N+,V( 9 XB/$6C PIP$ !-. %&8A+ .0 :- XB/2-.#C B/3Cw PF .0 2

6ED3- @76.J/3>B6G>

3

Y

J/3>C6

DA9#5+ 56)6)L56)6!$#'F7$c?B%.0>2-.A 54!" $( *;A# XB/.%6 V 7$Ga f a K %&$ A B)!) XB/ ;5!; ?%.) ! "E )! 3 - *" )+ !A%.0>*-A" *01 "76 'hG ( F XB/ ")!=2* ;#/- 01( ; ?!%*)r+ ( !F"& $%T+-^6 BvE $:) 3p+0>= !2- 5%F0> " ! p6 6 *3M $) !0>6 8-/ 'E56G 'E'E- 0B5+ 5J?(0N " )+32* ;#/- 01, N =+^- %O0N " N#Y-;!@6K_G* >0>" )+$

. .!Q = "+: N $;-)+4-. $6 56!,- J,2#' !(%&0>*_!H * 7 - )+#/- _.45) !: ! ">%& !:Ng"

*%&*+4-*"=#/ 0 A5!; ?%.) " )! 3 - *"9 )+ !s0>" )+$.6L. ;5 5=F . PIPF Q!D!

.)!.45-)? 0> ! a 'h%a :-: .:5 $> .0 " 01* b%&0>2" " $%&?;!^6dE PIPF )! e - 9A -!)!VD 1 EqS . !:)+ -:&. #/- g 2$%&7 = *"(I -J$%T ! 5B#/- ! %. ! ?L. #/ 0N!:=;-0>58AN*8'-;.%65 / &CB 01)! " . *%& !^6 V #&; Q J,9#b f a ! $; 4 -)+N#/- 9 + :E " +9 *%&- " ! )! ;?= 3 ()V ! " )!. *6 '*)+; Q 'E'E- 0B5+ 5J - %2)! ?A%&0>*g)!)+58B> PIPF t1&[ 2* !0>. 8A+ 9 .8R%.=2: 5+- ^-)?" ! 58A " +L" 5 ! + )!)!.)8AV9 !: "2%T ! XB/'E;1Q . =+. #Y%&N?3 * 7 - )+#/ %&-0>0j?%. !: 8AVG PIPF 6L??D )!-%&1#/ 0 8A* 1 PPF %&-- -)!9)!),# B/3C w P ! " XB/?> 5 XB/2* !:)+-6 _E .4* . :: 3 *. + : =;%* ,8)?"D;.0> N)+$ # XB/B0> ")? %V*%&( AB# XB/.C0>+,0> 0>. 3Z * ? ! ">A -)! 8A+ 2 "> .4-. ;.*3 :-+*. + :%&)?"1+2%&) " 1 _ .2 5 !1#@ )!* ! ! . %&* "F;* 4-. ( . ?%. 3 +- ! " &*%T+-K# 1f2" $%T+-K:-+2 1c" *?)? 3M# 3v;* 4?%& ! +0> 54$" :. .0 !-.:- + 5\45!)! -!)++ ! f 'hc :.N -;> * ?%.5+- ! 0>$ %. *. " . $%T ! ! )!::-+ :'# B/3Cw Pw . E%& ! ! !0> 54-.0>.D# XB/ 54.0>*->#=)!. 1 *2- ;+:O!-.:- + ! . . ?%. !R# B/3Cw P3 . ! $ ?%T+- A-G NCU BUc;* 4?%&* ! *%& !#H ()! 3 - -; " # 8 g#/ 0 *4. 3*:!.* !:N&%6 C.+!:B 9::2:* ": *"2* / " " % 7 7D

;

Q

%c

# ^` ( ( ' LK

L

BMB?A! . *; !:N > ==2;+ !E# XB/!> AXB< / w8N P AJ $%T ! :. . )!! *" ! "1%* !*"54* s gw ]Kw8V43 G '/ J *%&*6 S #9 "+ *%& ! UF *%& !J! 7d _?! . *; !:E!S 5+9?=1#,

=2 ;, $%&-:?;B *5:-+2Hg!

;!"& $%T+-; ; .0

+ .)+# ! -_8.)!) - ( 3#Y%&( 5 3*0N )+50>.(#sF+ ( !D" . $%T !E ; *0 + V;*)V#C%& )!"

*()+B+F! %& *-;$" ! 1> %.0> . A! )!)! !^6 B/3Cw P'!bV;*)V#< * $;*NG01 J- > $;$ %P&qr ! ;

:G! * ! "! 3 % ;!#7&qr*%T+4-.$ ! +0>)!.0>.5 ! ! ">)?;8 - )+$; ! " %B0>*-5+-^6 1 $;$ %. g > *. NQP PVRBg J*%T= .#/. $"K!G?$ 4-.( B/1

3&)

'*)+!,'*%A>1

8

N - 3$ ::$=0>& "#/- 3%&- ;

%T+:F: 2B#HN&8 -%T+4+ !)? :.8(- ! ?"!!

;!1" . $%T ! YA[ Z6LB:- L?%.)+)!>%& " +#/ -;C9 .8(- Cs " * ! 2"9%&-$%T !2'-&8.*Ls*" :-*T-2.8(*. * N " **6 Sc!%G

%!..6Gc" .2 0>._%&- ;?;L#r;*4* ) -; ! "= " * 0>*-L%&*- )+)!=%&)!)!*%Ts " +L" 5g "%&0 -!,+s! 3". ;0N* :- ,-%.%. " + := =;*%. = $" )!g;.*6 BM#@&8 N.4*_!3". ;0N* !4)!4* + !* / B ;?" >" . ;0>. ! *K9.8(- : #H

* 2$%T+4-9" .2 0>.%&-> 0 -!$" ! -%.%. " + :> D )!*3;*%. = $"K!G )! &$69.8 : %. !;B#H " *A 3 = 8(" * 0>*- ! "E$" :$ 5 * $;*_ 0 -! !>!" -3 B.[(+:-. ,)+*4.) #7" . ;0>. ! 5,! %.) "A B8(- !:! )". ;0N**6 ? %&*A%. - .*5*" ! "EN+* %1#C" * 0>.!#/- 0>$"76

3

K

%

VA*2- ;+ :g)!)- &8 -!:- + !: . )+*4.) 0 - +$" 1f "OS" $%&?" D8A D G ! +#3 ! 8A .':- 9 F%&E3 ;

%T*" ! _%.> 0 - +$"76LA)!-_!_!_+ * $+ : ! -*%*. AV_?H!N ?,-%T !4V 5A. 015!%)+*0>. ! )!)+58B K ;* N ' 2$%&+#/'8A&. J%.$%T+- ! . * .*" - *%&7 =2%*5 !S! ! . 45) ! P" $ %. 4 -2=%. *%T+-E. " ! ! " ! " " $ %. 4 -*Lg%&-$%T !>6 Gg(%&-*%& !> :- $ *s :-N+(:-* ! Z6 -6_ ! )+-:! ! * ?%.5+- ! .%6 ! K;: ! "b;5 15

7 -+ $N#9 ;. % -%T. ! B%&-*%& !^6

D?4A698:/ 5>

<D D 47/ 698:/ F K698 1?@ @AF>7/36G2*8 -04B@ @AF 1?@C>C698 .D6G8:/ F ,.- /36E/4B/ F >B6ED @AF >B6ED3692>BF CP >7/32*- 4 @ 1 @A>C6G8 D3698:/ ., - /36E/3H

4B/

! ' S .0 %. ?=#A >A/ B6D-0@ D .D @7- ! -0D ,5J 72*8 138 @ 8 @ ! /1B2 )!)@K;4 /# 5869-0/ 1@A-!P! " 1 D 6 D >7P/32* -0 4B@A>.6 0 %&2;?#A%. 2: )!10> ")!*8AVe ; " " ?;$"D! * ;#Y-%&69 *%&?)!?;$" >7 / B6 D-0@ D .D ?@7 - 0> ")!901> :-3*0N " 3 ; <#^=+* % ! 2"1 ="!;

+ $"0> ")!**6_ 1?D36EDK>7/32*-04B@A< )!*D 25E0N-+ ! .8(- ! %& !4Vc2"f . D ?F 'O $ # 76 -0D ,5J 72*8 138 @ 8 @ ! *%..!4$" 5N#/ 0 "> %&$ ! )!+$ " +qr. .g )+;.A !)?"E : 2 ! "E . g(0>01 +$A#H:- K

B/ P

:

:

G

!: . B" * 0>..6

B/ P

=

:

7-

B/ P

D-

\

A-

# ^` ( ( LK

L

B/ PN; ; *0 L -2 S : !%*) UX- (V,?_" %B)+_%&. +WJ ; 8A25H B. L+. "K- 25,;5.0>.$6N(* ;!)+ ! +_!H _0>*-L" ! )?\ &8 +#/ 0> !N = PIPF !1=8\ 5_* A- )+$H!0t 90N- $ +)!9" . *%& 01)+ K -2* \4+ *6bE8(- P $;*-*"e!N#9 . 0N- E8*P+R K $ #,&qr*%& !4** ! "K %&!. %.6>. . VB! ?A * 2$%T*6

7

l

T

A

! % (

LK LK

A

)+"/

'*% 1.
D;*4. )!- (2;! "& $%T+-b:. ! -E5>*%b%&-0N+ * >%. *%T*"' O E.8(- ! %.-2* !RO" ? 4 - *"'#Y +- ! 8A* D E%&-0N+ * 9#/ 0 8A?%Rd ;*>

=2 ;*-. *" ; *0a!01-" = $; 4 -)+3#/ A)+)r 5T . (I -

?>*-B-%T !2.6L? ! s%.)!+0 ! *()VL! )!--" -.!:3*4*)+" ?;

7 - *"N0>-:B%.. 5 !: * + !**6 *)+J2"';!:25( - -;$" 1 -fS)! %.)= .0 ! 8(*)+)-F!

+4-@ -. \4! +:-+25 !: #/ 0t9 +:-+ )2;* s# 01%!-'6 BvN " . @ =%.%.0>)!! ()?5 * ! 01 :* s%&-)+)!*%&s+#/ 0> !#/ 0 * C%.0> . ^ ;* U " * s! . *; 01\ -g%.$%T*"N 26H!, $$ )V_!( %& 5g%.0> . ! 9 ;* = ;%& *%&3 ! 8A+)!)L \4> %&0>)!& *%. "#( R ;* %& !4V-D.8(- -*"D%.0> . g .0E6 \ Q 6 Sc* & . A%*%&* * -;(#/ 0 . ! =01 :* ,+2?>*; ! %&-$%T >*-%D * ! 2"F%.0>0j !%*5 =! #/ 015+-FA-: . ! " 1 5 >#, %& *%& !^61?=.)! !O

%!:D . ! - 0>- !0N )! ! . A%&)?!0 ! .)! A!E *4*-+ :N 2 = :15 % *6 [R 6 +C+2)!)+ ! 6 PIPF d29 EA -!)!VO O!V! E -%&D ?>$ ! 8A. . -P . H%. *%T+- _-%& -@B.8(- ( -%&$"7'6 BM#r !, $$)+L!> T ;* 2$ +:3 =%&-$%TL#/ -0 80j !%*5 8A+ K .0> ; ; .0 A R2;* A *-. *"76 H569# )6#&'E;B 7(50B56)6%os % 9d ;* N-9 D0>54$9%. .8(- r6S ;*

%+ :!(!-.:- *"8AV -2L . ,#/ -0tg .0> %&0> . ! ; ; *0 2K*.J -%S# +0E` 6 Bv #/- 01 !'A-9 ;* 3 5 : .0 ! ")!?9A - )+1 * 0>! 51 $ *%TN%& *%& !JV#B K%&-= : $" ! Z6 -6^!90>" )+12-%T !41 * %.2A -!)++ !**6H?,. 0>+ ! %..-2" )++25 FK$2;?%&!2 %& *%& !^6

;

;

K M

`

*

E

;

= 38*4\) 25 $"D- !:1N45 +.1#s * %-*".[ )+-VB%& +*6 $;8. #L8>2$.6A =2 ;g8B" $;!: *"F 1*;B 9; ; *0 g -!)++ " . $%TB!- (2;! Q-.!:1. #/ 0>*" )+ %*)!)+ ! "F ;$%&2"D8-A" * !:$" *;A -+)!+1 " . $%TB!- (2;!4 -2* \4+ A . A -;*6 G ;01)!)L*> 0 -. <#H* N !0j)?5*"!

;!2g8. 9. #/ 0>*" ! "K >.E 3 D . #Y\4- A -)!K *()+*6 N(. 5+ :e;$%B +b01 :-. 1. 5*"f- 2$%&7 = *" ! W PIPF 8_ -)!A .4-. ,%.$%T+- ! "N -%&T . _-%& -C B & 3 8 ! .4-.8A* _ 5 ^# 8(B( %R . ^%. *"76 + * 0>- ! $%=+2 %. # + ( !4 -.2\4! @8C%& *%T)+ ) !F#^= %-)!.0a# 58 10>!

;!" . $%T ! .0 %*)! ! 8A*+

" %.*" +>&8 *4! 0>.$6TBM#Y+)?( 1"" $ , = - )+*0 #@ 58c > " )! >58BN#3 S * * %P 51 - %. !**"E)+-:9)!+#s *-;-+ : * .*"76

/21

-.8

6

#.)6

8:)+!+-.")

&6%!

)+/

/

n

)1C% "AT1

)1T'

?BA>

-&1T':5-.8':)+3

'*% AT1.8

;

* 7d:+?s V 5E?D! .2" *"f

(. 4! = +:>#C. ?)!)+D 0N#9)^8 -2- 58B;!:N.)!2* g )+?%. ! *6 BM,"$C ?-* %&)!- + :3B )+?%. !+1< $ ?%T*".4+ 0N* ! -C %.)+)!*" - \[76 U@vB 8(- "#C+A - ! 0>+ ?" *O - .! "* ? S " 2

"!# $% '&( )*+&,&-'/.0)" 123 45 236&'1&''!7 &8 4549 '4 165&'9 ';: + -0 ?A;5.0>. = ". +4-g%& )!)? 9 5A)!?%.5+-D? * _)!)!58($"= =. #/ 0t9%& !NC)+-:s 25_" *LH.+)+4 %*5 ! #L> .0d%*)!)r N R " * )!+:>-2* !:1; ; .0E6 * ?)!?%& - -;$"-) ! 8A* ")!* ! %&-*%& $" :E#/ 0> 3 8 r60j?%. $_8A+ 3(. 4! *"1 -: 0 4?= #Y%.+)!V-6 P. \ & #/- g !- "2%T !F > S %&$ *-C = )+$ UN! . #Y%.6 ->2g#/ 0>*8(- 2 = ;= *-"E%&-= : !`=2)+> 59" = $ F0N:. . )_ )!*9 F%*%-*3 " = $6 @5 * ! 0> D;*%. =%

)!*01\54*

?" B* 6 N;$%B VF0>" )+$ p)?;%*)!)+$"E2-)+?%& 0>" )+$ B01\F)? %&!K;*%.!) %." 251! `J ;> ! S F-2* !:S .0 $%&*+4!:K .0 %*)!) 0>& * ! +E- " * 1%*% $; 0>& * (#/- A+)!)+*:-)r-%T+4+6

K

# )(

% '

`

P*4* )H2-)+?%&S0N " )+$9 >+0>)!.0>*-*" ! $%O $; 4-)+>#/- 9(2* 4?;!:- ;A#s2-)+?%&-6HwH[0>)!*#C( %E0N " )+$A 1 'E5+ ;b!s0> ")!()!!*C" &#Y)V^#/- ^ !0N )+; ; .0 %.)+)?@ @#/ s+2 %. )+8\ 9" *+$" ! ( %b a ! d ! &%6R * %*)!)!N )!8\ " *!*Z " -*%*. . 8()?" .+ * F. -S)!)!58($"ee Z-b +4!)+*:$" %.*1+f 6 =2 ;D)?%. ! *R4!)?5 K ` -2 !% S " -2\[ U -* (

+$ >.#/ %&6 8 )+JI aS0N " )+1+ .$g1 !:E)!?%.5+- 3*4! 0>. ! ;N 25g":* 4\ ?A - )+$( % S&%6_ = *0>54*"^6 )+; ;2!$;1)LG *%&?)r0> ")!&[ ?, 5g(. 4! *( =)!!%*5+- &8 %T+4+6a` . 0>\c- e015;. #9)!?%&c *;

!%&F8A+ 8A 0 )!?%.5+-F01\D%.0>0j !%*5 ! + :18A!% &%6 '*) Qa Qf Q0> ")!F? 0>-;N%&-0>)+.[P0N " )+-6 BM>(. 4? *9)+ ) Ta

? *; ! 2"1%*% Lg ?>$*"N 5 0N$ ! )+N)!)+58A!:%*%&$ L "E-\[P.4+ 0>*- ! "eG 0>)+)A &N#3%* )!)+P%;*e ; *0 = )+$ ! $ %K-B *" )!7 - !*$%&* #/ B +:D#L )!?%.5+- ! " ; ; .0 8A?" %.=2: 5+-2= )+$.63 Qf R0> ")!N" +qr. . ?5*X -&8.*

$"J "J8A + %*%&$ *. 6 Sc!)!V8()!"S#/- +2 %.D)!)+58I $"J%*%&$ .8 1" &*%& 5gN)!!%.D0> ")!8()!" " ? )+)!58Q>%.. ! .0 %.)!) ! +3A - B N; ; *0 %*)!)@8A+ G *

! -&#/- +32X -.* .[$%B *"76JsK (. 4? *"J :- 0 !?! " ?; !:? A -)!#/ 0 '+. 3

*"' .0 %.)!) ! "P 0> :- 0>9 " * +:-*"OG & G ; ; .0 %*)!) 8A*P !N%&- " + ! -*%&-0>*9

6 * " &*%&?N +( !P8A*d c%cE+*3 4-%*5+- #AE 0NF; ; .0 %*)!)( - -.*R" *+$" ! 2"J *'9 G!)+)( )!!%*5 !E%&-0>)+. *)+-6,. = 25A .D8 )!"F)+!=A - 9 3 ; *0 %.)!)8AV 90N- E#Y-%T %* -!)++ !**6 B58.4-. ! *c#/.*)%&I=2" .! \4!:e 54$" .! E%. %.. 8 5A -)!;-) !F N % -)+*01A5A 2"76 . - A)!?3 V : &+:444 *1: . ) .& 31 &#/. 3 * %&=#/- A0> )!.0>. !c?Db!

+- "& $%T+-f; ; .0 ! 8A+ fP" .#Y.)+ " *e)!!%. *%&7 =2%*5 ! ! "P -:K%& !41 * 2- 6.BM!9+ * $+ :E G .> 5D*3 B2\49-"" *;$"D9 % -)+*01B#_$ #; 9 ". #/ 0> %&-6B 2* $F8**;$9!'E *. !!:K ! S%.0>0>R+ !

+- " . $%T !E * * %D 1"56

@ @B476G8 3@ @C>B>

%

gn )

LKLK

/9A= )+"% 1.

'*#.)

;%1.?B"/98':5-.!,'"-.")

,. 7 \4-H" .4-.)!*"= 2H!0>)+*0>. !#- 3= 7dY ! &8 !

+->"& $%T+-> .0 +0>$"N_ $%T+: *50> " *)((0>* 5, 0> +:=*-V+$L+1 -0>! *" ! ".2%&Q -2*:!N 0>? 3 -. \4- ! - ,; 1 !:)+ -:&. $6s B 2B- (0>*L 5, B . %.0>0j !%*514?F PIU +f %&-)p611 A J$%T?.4-.( )+)!.4?;!$"S- "& $%T+:O-D&[. ) ! "! * ) ! !

;!F5;.0> (+ #/ 3 (2%T( ! !P%&0> . . +4- ! "J %*)?A -)! ! #Y +- ! ! * -2* !:E8AVO * !

+- " . $%T ! .01.6 3!

;! " &*%& !D!(- gN?(-2* $"0 +: ! . - %&)?!0 ! . "Vqr. .(2 " !:01 ! 0>!( X - *"1"& $%T+- ! 01)+ - *"1" . $%T ! ! "> 3 %&') - *" /0>?$ + "& $%T+-^6 * .A: !6.:!#"%$&5 C. "A ! +! : (E * *2+! : :A. ! 7 !+! +! D

# *

K `+ - 3 %.L-2D"+4?" *"O!-E8(E ; ! D)+ %.)_!- (2;!J" &*%& !P$- ; ; *0 !

"PE *0N + ( !R"& $%T+-e0> ")!**6R +. !R!N 51S .0 %.)?" - - +)+ -P%&-*%& !:K 4\ !2)!%*)(+ ; %&$9# gG !:K45 ! !*%.*g#L ?>!0>.g : ; *0E68Sc!)! 9 *0N *)+*0N* # ; ; .0 -".@ -" *4*)+-2$"5@( !0N#+I -)!!%*5 ! ! + s . ! .+-9 " -A%& -)+)!*"%&. )+)!4!3 P*W]Ù %.)Z6 g9 ; *0 !%&-0N ?;$"1'# ?>+ =#/*8f" +q* *-0> ")!* ! 5+0>)! 3 0>." +q* *-;*%&<#( >)! %.)H(I - .0 #, 6 - g !- (2;!O" &*%T+ .0E6

;

Remote Managment Application Statistical Analysis

Remote Managment Application

Protocol Analysis

Statistical Analysis

Managment I/F

Remote MIB agent

;

Local JiNao

Protocol Analysis

Managment I/F

Manager to manager

Remote MIB agent Local JiNao

Agent Extension Protocol

Local Decision Module Local detection module

Managment Information Base

Statistical Analysis

Protocol Analysis

Prevention Module (Rule-based)

Information Abstraction Module

Protocol data unit

SSO Protocol Engine

Interception Module

NETWORK

+C!: \ 6 E_)+ %D" ?:- 0a#s ")!+ * %.. %.)r+#/ 0> !D#/ -0a &8 ! +0> 3v;0> + ! " "3V<54. B N *4*-+-)!\-. $R 6 Sc.O;!:2)!*" #/ 0 .4* ! )?\* ! +A * .)!*-;$( -%. ! #/ #9 ;. B;( ". -1 %&-)7.:-+ 6 . C" !%B2 @ - )+*0>C %.! $"=8AV9.2%& *""5 ! 0>&!: 5901\3 -2$%&0>10> %&-0>0N-J+J1#9 D8AVJ D-" 4*Q # BU8P Q w N .%6 * = 3 .= +2%&! )7)?\* ,8A. 1%\98(*)+)2\4Q -2*.>)!-;,5 ?)+*4.) ! #/ ! %. ! ! #/ 015+-DA- A-D8A?%D "8 B &8 N! * ;#Y-%& ! #/ 015 !b.. *"e K .0 ! ?1)!0>-;%&. + )+')!-; -P E+0>E 2%.A *-%*" !: . A)!.4*)!#s %.)7;%r6

D#&9J$)+ !, %(!BG8-/

")!=-%T- = ; ! #Y;A%T+ : ! = )+ * ! :-! ;(%-4! ( *" 3

=2*"E *%B +4+-)! ! *6

3 .4-. !10> ")! "R NK" PO#/ 0> ! " )+) ! " +qr. .&8 " ..2" .9"F#/ 015 ")! ! "e E 3 .% )72)! ?,0> ")!6_; ?!%*)7 )+ !(0> ")! ")! )+ * ! 4? R2;#L; 01%!$ !

PIU + ! "*4. )!)+2 U AXB ! +:D %&-)! ! "EK PE ]Ù &8 F01*3 :*0N* %&-)! !

+:-:. !:8A .*4. %.)r.. AN( 2$%Tg; 6 )6'E)6 56)6/;1'E-A'E'E- 0B5+ 5H%(!BG8-/ N; ?!%*)L )+ !g0>" )+>" \8BB$\4+)! #/ 0 g8 " - - PVRBH-1 XB/)+ ! ^. 0 -. \4! ! s?@4-. S)!!.)!=)+-:A. 0 -.2\4! ! .)?5 !4g =0>#s" .4?5+-.-&8..D $;32$#s-%T !4V+$

;

5;

5=V= -

%N 25?:*. 5*" -F $; %&-)!D%&* ;!EV#, 0>9( !%.+ B-%T !4V ?A+:D)!-%&-6 %&)H )! ;?6 B - C -"8=;*%. =2%:--)! ! 8A.> 2$%&+#/!:*%E 3 ! 0 d-6A %&-) )! ;?s0N " )+A )?" - $%&-= : -)+(5L (9 !0> +

+- Q- *%&-0>N%. %.. ! " * A%.* 3 -6

! -s .8

\6RGg"" !:N*8U; =01%!; )?"D B ?>! < $%&-0N +)?5+-D#s 13

%&-)@ )+ !0> ")!6

- ?" .V#/ ;*4. )r * 0>$ #C- !0>! + :=&[ *% !E#@ ; 0>-%!* ! !e#9 4-. ;!2#3 E # 8 ! - 1 \4-F > "' !0N )!D#s.0d+ 6

!B;1'E-4G;1 5+ !,N%(!BG8-/

)! %.)g" *%.! ! 0>" )+G ")+$>8(O ! VF%. " +25 $N G+ #/- 01 ! #/ 0 ")!* ! 2"1VA? ($(%.0>01 "(&r" ! "\- H%T+45 A )+$H!N *4.+-0> ")!6LB)! %.)"*%&? +-N0> ")!*,)?;= - $;2;4 -!)++1 > . B$ *%T*" !- (2;! (> V;$%B +1 %&* *6 + %T+- )!)+OF)! %.)(" $%&?;!'0> ")!D! * ;#Y-%&*98AV'F" . $%T !e0N "3 )!* ! )! %.)g0> :-.0>.>+#/ 0> ! - -; ! 2"e %.)A*:!6f ! . #Y%.98A+ S N)!%*)L" &*%& !G0> ")!*#g E.8(- J -( qr. *"bK58(* #Y+) ! ?%&)!"D)+$" K -2 F =" &*%& !D0> ")!*( . ( 5A * (! 5 .:0>*-=#( >.8(- 8-2" . 5 -% ! - )+ %.)_" *%.! ! 0> ")!B8A* )+$ >-2 H B258. L#Y+) A4! *-%D"*%&? +- ! - %&)?!0 ! )+$"(>N%.)?A - )+ - g>0> ")!* ! 8.)!)^ * A&8 101 :*0N*A .01*6 +#/ 0> !PA-2 -%T !J0> ")! ! . #/ 0>V @ -O%.)!)+$%T+:K" 5 ! "F+

+-! " ?%.5+- (#/ -0 =)! %.)7" $%&?;!F0>" )+ ! :-: .:- !:+ ! *" % 3 !:+ ! %&-4. !:1+B D0> :-.0>.B! #/ 015+-6- =#/ 015 ! "%.0> *;!: +*6

B 'E!P%('E'E7,9% 9) :O>!F#&%('*)+ !,

'E5+

3 ")+$N%&-)+)!*%& !#@ 0N. * (&%6#/ ( =)! %.)!- (2;! " &*%T+-F .0 ! 5g =#s!-. *;A >. ! .0>*-3+ #/- 01 !2- 9-%T3BD " "- ;

%T+-F! * ;#Y-%& -&8.* - 3g:*-C "=,01 :-.0>.s)!!%*5 !2^ 5L _+. *; *"+ !)+?;!:F N!- (2;!G"& $%T+-S . 4?%&$B 54!"*6 " - g 6=N0> :-.0>. )!!%*5+- 1 +01 !)+Y 3 P* ]@U e%.0>0j !%*5 8A+ f K45 ! >01 :- 3 0>*-B! #/- 015+- -2 * : .0E6 BMB? R " . )!!:> -" +:-0 # PE ]Ù ! ';.1 "R $"R4\ !22 0>&. 9!b 012:$"e .01 ! 25 % - A -)!e -0N>G. - NP 0>!D%&0>* 01 :-.0>.!*3 #/- 01 !^- 6 '>45 ! = . 4?%&$3 %*^-21. #/ 0>*"G *0N *)+` -E 01 :-.0>.A+#/ 0> ! - 1 8-/ ;2!$7,8#'E)6 !, = ( )+$( "D=2Vg012:*0>.)!!%*5 !F$ *%T*"> 5A

. " -.* %.0> 0>! *"F+A%.)?"F+ ;

%&g .!: -2 1 g # 3 =2%= :-F9( 2$%T $"E * ! " .! (2%T3. A . ! " 58A ;

*0 #/ 0 A$2;*%& *"9 ! 3

! "9+0>0>*" ?5.)! . s.4* 25H8(8)?"9.[ 2$%TL#/ -0tB#9 )+)!9-2* ! )- . $'6 BM#2 $;.4-.s#Y+)!*" 01+#/*;,.01 .)!4*(5( g

!: . ! 8(g%.)?"%. %.) "A , !-. )+!: ! ( 2$%T*" ! * ! ?C+ ".*"N 58A+ : > -23 $%T $" ! ">-& ! . B! )!V )!!F8\#L8A!".)!F\45!)! -)!3 - 2A-)!" &*%& ! "F

% ! + ( ". 0>54+ : -%& -2-. 9.2A-)!B+D * 5Bw ]Gw VXG ' / - *, >0>..?N2*& .[. )9 :-!5+- ! =)!*- ! &[ * 2)HO;-0>N)!.4-.)Z6 g58(*4. ! 1 -2;$"G %+ $%T( >" *>)! :-(*-. ! ( &8 ! 0>-" D>#7" 0>!? !4.)!0> - )+$ 9;* 5>"01! *6 $;"01! = ( ;9-D2"S * SE: *5. - 01)!)+* _&[ *1 8(" -01! _%&)?">. 5 A!.* 3Z 1 3Z.* H *)! ! ! ! 8A!)! . A%&)?" ( ;A4+ ( )+)!13Z--" RE#s "#C* + !**6 w ]Gw VXG ' / 8)?"F. 5 =-D *" Vqr. .B)!.4-.)?8AV+ " 01+B 9#+JB/;1 'F'E- 0B56/5 - 9J$-N0>-;)+ %.)B)!.4*) ! 8A* K" ?;

7 - *" ! ; %&$># w ]K8w VXG / 8()?"D-2* =)+ %*)!)+ ! VA58AD :.*6 NH!$% 'E L GH- 9J$- Sc. KS)! %.)+)!c" !;

4 - $"f! ;2%&*F#98 w ]Kw V G ' / 8()!"K. 5 +O%&- %&* ; ! !:! #/ 015 !K F"& $%T" 01+K8A?" +*3

;!F5;.0> .6 U_?%T B#/ (+2 %. ! .8(- = )!3 . 4. ,0N-+ ! \

7

*%&*+4-*g =2%*5+-K#( 0>N-0>)+ / WPG.4-. ! "8A+ S 3! #/ 3 015+- %.)?"E" *"2%&= 25 ! + ".*"D ? *; > = )!;* 4-. 8()?".- !:)!D( !%.+ !F)!+:--A#s+#/ 0> ! $%&*+4-*"76 ? )69# #/56 /G-/9J$->Sc . E *()+># V ? "20>!%*)!)+J*0N )+5-*"O :P 9F .0 ! S0N-+ 2-+9#B+ * $$6 BM1%&-0>0j?%. $8A+ e * 9! ;2%&*#AD0>-V ! " !;

4 - $"P : 1.8(- ! 4! \ )+)H0>*%2?;0 ! 8A*

-KD0> V %.O(I - %& 7 - 7 =2%*5 !2,#@+. *;_#/ -0aV,.* *6 BM _;!: ( *:!N 54?" * - -;$"!- (2;! " . *%& !9%* -!)++6B58.4* ! (. - @2-+s @ 5L!013 * *%T > !: ( *:!>" .2 3#/ -0

" + !2)H;!:25( > )+ !3. :!* ! ! DV !D.4! !$"eP. 58AV P;01)+)#2 B - s 5H!L8A!)!). -)! %&!. ! "&qr*%& !4 +:- 5 - -;$"F!

+-F" . *%& !^6 H J$9#&5+'E-4#&95+!,- J$9#'= * )!4* ,?, S - ! U9#^w ]K8 w VXG /Q0>-V ! V# G8A!)+)ZK 6 BM=2 " )!*%. *)! !`-&8.*K1 $$ )V=#( >)!%*)H0> ")!* ! " $%&?" K8A. * D !- (2;! ?>!:P)?%. ! " $%&?" *18A & . 1P+4-

;

;

;

;

;

[

E $; ! %&-0N0&?%. !J8AVO .* 0>+ - ! !:* 9 "O)!58(* )+*4.)? ! 8AVG> $$ )V+:E. *-!%*5+-G&%6>> $;-)+4-. 3! ")!*. 5D)!:S" Vqr. .>" 3

*%& ! ! \E#/- ")!>8A+)!)H;$ %#/ " +q* * +:- 5 *_8A .D+A. 5*_!E9 . 4?%&" )+ ! D8A*D+-2* $ ! . * ?; 3Z8A?" = )+ !0> ")!6

! *

K#"

`

w ]Kw VXG '/W 2$%&7= *>8.)!)g" = $"e! . #Y%.*>-R01')!.4-.)? ! -2 !-. ) 8 Ow8]Kw V G '/j0>+ - ! "f&[ * )ge+ ! R. -)+S. &[ ?+:b!- (E3 +-b"& $%T+- %.0>*-> J! . . 5E8AVb+*6Q* K%&-0N .1%.)?" -D):-:*"'+e-9'+. )(0N " )+F+P 0N-+ ! 1!P !- (E 3 +-e" . *%& !R&qr 4!K .8(- J!-. #Y%.^ 6 Bve " * S $;-)+4-1 * D8 V 5+- Aw ]Gw VXG ' /t" = $BN8(>)?\* $" ! $I -2 %. ! ! - -;$" ! 0>* :0&?%.5+-O .0 ! "G! * ;#Y-%&6>>?" * ?)!& *)+F+0>)!.0>*-5+- )^ #H%&-0>0j?%. !1Z- E! . )+)!D! w ]K8w VXG / 0>+ - ! 2"D.[. )!)! 1Z-&8..F0>+ - ! +F " !;

4 - $" w ]Kw VXG ' / .0E6 8

K M

"L

45 ! N0> V N D013bKw ]K8w VXG / ; *0 ?>.4! !$"' -2* 1O1 *" Vqr. .9)!.4-.)? .4! )+G0N* !$" ! -O%&-0N0&?%. !: !

;!S" &*%T+-K *()V -@ -&8.* *01;*)+4-* ! 8A+ +G N)!\-. ! "K*3 8 " ! E +#/G!: . )?\. 3#,1 :!: + ( !S"& $%T+-J-%T+4+6>! )?5 .>

- !)!"E!. %#Bw ]K8w VXG /a0>+ - ! 5%*P" . *%&9)? :. ! " )? :* ! %*)!35 -%:! ;_ V +:26

K

# 7` ( (

D . A-w ]Kw8VXG / #%. ;1?4-. G:-.* )H+P+ --%^6F ;

%T G#G -2;$"f; ; *0 ? " !%B2 *" !Q" .+) ! 2"f* F; "76 ++ ;. 0> ! - *" %V*%&( =!A B!-. "*" - 9. ( 1.[?; !PF45-%B 0 ! 18 K" ? % ;$E -2;$"G- :?5 !2)s;

%&( ! "S - )+*0>1 F (2%T( G%.)?" \4- ! #/ -0 c+

+-c" &*%T+-f "2-+ ! "O58 D8w ]Kw V G ' /a#/ 0N*8(- G8()!"J )!4>* -)!.01*6 P* - ?) :-g g -4+ )+F: +58U 01= ; *0 %.)! -)! ! .[ .2"A -)! ! "D * ? > ;?" ! * %&-6

;

BML?@! . *; !:AB#/-)+)!58J ( $;$ %.. =#/)!)!58A+:1" $;!: :)? " ?>! *0N* #/ 0 9&> dQ 6 BM,8)?"0>A!:E3M 2**" ! )! :-4-)0>A0>+ - !:=#r&8 1%- 3 7 -)!6 \ Q 6 BML8()!"L" - -%& ! Z6 -6$+L8()!" -2A -)!_g %&$ @+ %.0>!:g -%. 5=( %&!.3 5 ! 3 D2\4= " ? %* "E++ F + D *% +G %&. 98AVP $:) 3p+0>1 7 =2%. !P# :!: ! - B5 .0> *" ! 5;% *6 6R_ 8()?" -2=%. .#9)2 >;* 5B0>*% ! 0 #/ -0a2-)+?%& ! ;9 +8 )!" - +0>)! J;*%.V#/P .8 *% +J2-)+?%&!* ! "e!"e+e $)!!5+-'# - +0>)!?%&+F2" .[ 7 -!)!VF+ ; ; .0E6 Y 6Ag .0 8()?O " -23&[ * ;4 -)! ! #/ .0>-; ! V(8()!O " -g$ 9"">58A:) 3 *":=#L.8 2$A#L5;%r6 Q6 BMF8 )!"b#Y-%&!)++ Kd2;* F! \4-!"+:P01!:e !0N )+S0N?;-*1!c 2$%&7 =2%. ! #C *% +1)!!%.6 B; ; .0 8()!"N \4- =. 5!1>.4! -0>.H+>8A?%>V_+ .)+#8 )!" %.0>@ " * =;%r> 6 P! %&N !)++#/+ :$0> +- g)!D- #H8(F; ; .013%&0>0&?%.5+ :18()!` " -29(I -4* ;*"76B . - B 53 ? - (0> +-18()!"1%.-;,4+ (2)!)+N!: ! ;! %.BV#7g!

" * , -O " -2 D .01 " . !=%&-

) ! N%.)?".O %..$"E *; -)+? G!- ?%. >%&54-. -0>! *"F01%!* ! 2"D. 2AN ?; *"F I -)!!%=!01:-6

;

"M

# ` *

C _ g; ; *0U?C" +4?" *"+ g ." ?+ %&C)?\* ! *%)?\* ^ *" %.*@ ,

% >-3 )! ;$" ! -N0>+:"*%&? +- _-$ %*%&$ +4-.)!9!: . ,)!.4-.)?_#7- ;

%T+- ! . = : \ ,6 6Jw,%P)?\* 9 %&$ * D

%:-.* *"E-OF!0>0>*" ?5.)! )!58. ,- ! 2"> $; " ->:. . 5 !:= 1%B .4-.( %.

))+58. )?\* *6 AY

Real-time notification Record to disk

Policy script

Policy Script Interpreter

Event control

Event stream

Event Engine Tcpdump filter

Filtered packet stream libpcap

Network

Packet stream

+C+: \6!*_ FL)?\. !: "E"5

"M

(

58 /#/ -0 2

_ 5 *D O#/ .*)+f\45!)?A -)!K -%&E%. ( O)+4 - h b f ! Q8A?%f )! d Q %5:9? - !)+ ! 0>: . .6 b f -3 -" 45: S?;-)! D E ;!%)! A- 1 \8a&8 O %-&N%* D#/ 0 E $N# _ ! "P)! F%* -+)!+GS" 58A)!--"J %-& =2)V. !-KD-. .)(#A -2* !:G ; *0 5O _ K 9 ! +#B D. 5+ :K; ; .0 ? ? +*"e8AV ( %>#/*( 6?B* A-)!*` h b f b" ? %* " +. *; !: -%&* )!D! B %&* +: ! 2"9* ,%. (0>A0j %1)!*H * %&$L+NR = )+ * !:# -%.*6

"M#"

= )+ . *"9 %-&L $0Q C *()+@#/ -0 h b fG!s 2" *"954. ^ 3 .4-. *:!6C_*4.@*:!=2 ;@. #/ 0>s%*% rg%&* ;!B)!) ! 01; * d R)+-: = )!= 25B+B.* *6 > %.)H2)! . A#/- NCU ! " / U % ! . #/ 0> - -;?%+ *: V %$% 9O . 5> F %D?>8(*)+)#/- 0>*"^6R?1%.R!e R:-.* D .8 *4. g 3! . *" ! N *4*-X?>6

"M M

( (

`

]- B *%&?)!?;$"2 " )!. _%*O-2B#/ 0j)?5*"N+> _ =%& ! !:)?: :-6s )?: :-(?H 2$%&7=2%.)+)!+)! *" = %.*;!:<#7 NCU $BUG

% ! 8AV1;*%.!)

" 5 3p* ! " . 5 - ! 1 ")+ BU 3M-"" *;$ ! )!?B#_( %E&%6 3!-. 3 $+ : " $;!:G#/*( #,)? : :9?3 V=)!-% B -2= 2*-+D&[ *% !: ;#C .0 !0>)+*0>. $"F! _ >)!: :-6 BvF1%. ! 5# . , - 54?" D)!?%&G8A + . 98AVJ D -!)++G *0>54>+. ),; 1#/ 0 _ ! )!*; _ %. (0>*g)!)@\45!)! -)+=0>.0>- ! 8AVK54\ ?A - )+$ 3 =)!:-. B" *.0>*" ! * $+:26 25 _( D? ! .[ .2;4 -!)++>!,+ %. $ *"76 Bv1 " . _ .[. "1 g .0 ! L2;* _?%.)!)!" " .8 %&) )+ . K F*4.N.:-+ ! "eK " )!. G * "JK *4*-:*. 5*" - %&)7 )! ;* *6

!

"M

GD E+0> .#/. . %.8->8A +;.Z_ P%. !; $"e#;-0N`\%\ ! cccS)!+$1# N %& " ! 8A+ P. 9%. )+1#( 2"S)!!*#X( _ E2-)+?%&O %. ! .62P23 %.!)s2 " )!. B2"6- .*G8A V .K#/ 3 >X a ! X ! difTa ! " 'a h a %&-)! ! 8A+ e0N- @- D-"" *"^6GF ?" . = $"' .4* )_ ;# .0 9%& )!"^- 1+0> 54$" ! 01!)!G!S%&- ;

%T+-S#%.0>!)+* " - !0>! . ,#/ H _ * ! * *%&?)!)! " " V+-E#@+0>* N _ >%& ! !:>)!:2: ! "Fq,3Z)!! )+ !*6

"M

M

(

. 9 $;* !:6_( E!+ * $+ :+J 5+9?= D= ;9 ; *0 59-"3 " $ *=1 -)!.0j#A8A ! "#A5;% =10>+ - 0j ;> -%. A-)!1# 8A+ 2 " !:2Q6 U, *4+ 8(- D+E!X = .)?" -A3;*%. =%.)!)!F" " $ *"D 9 3 ? %.#_ N!- (2;!G"& $%T+-G0>*% ?;0 :-! ;301)!?%&! %&)? = $+ - 3; 8 + :):3 :. * *6R!>%.)?"e. K -2" - -L = 2" + :O -: 0>0>+:S. - 9+R 0> V ! "O.[ )+-V+: * ! -G01!: 10> V %&- $ 0N 0>1%& + : 3 %*)H * %& ! 1!=#(.[2. ; !^6O_ E * !;3* N*=#;-% W - 54!"+:F85%2" :>+0>. ! W =2 $B+8# _ 2W -2*.#/ "#Y+)s F %.* -%&+8 %.*;!:;*4* ),;$%&- ": 6 D85% " -:E .0j * ; - > _ ! )+-:- ?#Y-%T ! "P01*92N0> .0 &[0N! !P#AF .0 -;4 -)!6 BM * ;

!:#/ 8 " 2d R)!::-+ :9#s +. >.8(- E % -1)!::-*"K#/ )?5 * )+ ! 1c *4?" * %&B#^01)!!%.+ _.8(- 9

%A8A!)+)r5()+$; -23)+-::-*"76L. B.[?;,8A+*3 " 58Q#L ( V -2.8(*. !0> _( ; 2#9 %T+-!: ! "F = !0N 2d O)+-::!:=?_ $" ! - ,5,)!*- ! )!)?H_)+ ! 8A+ > B01)+#9 %T+#@ _( >0>+ - *6

8 )69# >O 87, '*)6)6'E;B5

N5 %-. BF0>?;)!*-" N0>+ - *+ :D#H

% += )! ;$.6.W # _ G 32" . )+!:G.[ )+?%&+1 "e+0>)!!%.V - (0> !201" @ -bS .0 ! "f58 4!)?5+ :P *0 8()!" * A- )+G ;-%1 1:-0 " . $%T $" ! 8A%* )!)!D&[0N!$"76, - B)!!;B .4-. )^( % ;-% ! "E5H 8 _ "&#/.2"g:-! ;A *0 ! - 3#_%. ; _ 101$A%.)!+0 5B*4. ( % ;% -Q -2*.E?" . 7 = $" "E" *)VA8A+ ^6

"M

(

L

;

_ G -9 R-S ;N#B *% VP ; *0 #BE. N V +2%&2GB +) d ! "?3\45!)?A - )!!S %&9%. " #/- 0 ! i " %B0>*-*"S)! .)!*-; ! +0> #B8A V+:263A V *)+$ D! #/ 015+-P!N\45!)!-)+D4?D8 )?"J8A!" F8( -

#/ 0 +

"M

3 : +0:2 0 2: 3 45,2+$ : !< 6

# 7` ( (

N8 F * .*"?= -:D- >(I-J*%&<#,58 F01-!

+-G" 3 *%T+-c; ; .0 $;?;1'5;%e:-+ ;+ .)+#6 BMD?> K)!e *%.. 2* 5g" ?%B ;$ 9 5 =#s95 -%( 5B ; *0d%.)?" -2(I-J$%T $"F ! 8A 9$ 0N ! 2\4> 6 -01"A - * 5 -% ! "J58I .0 %. * -%TB.0E 6 G +0>!)! .L

! A - G * .5 !c? -:'8A*fV * . S * F )!!" .[ 2* !. %.*NK. > \4- #/ -0 ( !:O ; *0 ! O *) 3M8(- )?"P+)! *4! 0>.$6L --%F2$ ( 1 \4-30>. +*6

7d >/ BG 2" . ;- ! + !4-)!" ! "DG_)!"**6BB&[3Z:-.* !>+ ( !*3v" &*%& ! .[ 2* ;g .0 /X B/3NQPC3 Y&3 c ! N(0> . WP %. 3 * %& sA- 5 ! PVRBOBv . ! ) ! ]*)+EUH ! NCG c%\%Y3 [7 [ ! PG ! ]G\6d Y 6

\>/3 - Gg " . ! @* $ +6N ! g )?"6-\4+ ! GB s0> ( ! 2" GB)+#/ _)!"**6 /g. *%& !:3* ( )L :- 0 -. \4! - +:F >; ?!%*)H%&-0>213 .,#rB.[Z3 :-.* !N+ ( !1" &*%& ! ; *0 /XB/3 NQPB3 Y3 c1 ! N(-0N+ * P%&!. %. sA- 5 - ! PVRBXBv * 25 !2) ! ]K.)! UH ! NCG !F PG ! ]K\`d Y 6 [& 0>$TUL6%GB " * @6 N(0> . _ *% + $5H0>+ - !:2"N( 4*+)!)! %&-6 s*% !%*)VA*2- ; N(

%& +\ %c%c ! - 0N$UL6$Gg " * N( 6 ! _\[\ ! + SJ !: ! UG ! d c[7 !* PG ! + - (2 .\ ! .4?;$" Gg +) d$YDd %c6 P &#YFGB[*)! ! )V# @+2"I?4?; ! )V# 5#Y ! "'w, )?2" - ;-^6^Gg --%S X B J ;$%B +O)!:-:!: 63Bv ; ! :-*% \ u Y ! N( ;) N(+ ! GB 3 : ; : )!!: ! G ! PG !
* P*% V N(* . $6 Y _)!-$- 01!- ! ; 3 01 %.! 3 + . 2" ! /3\4?"2B -%&q ! wg6 6 P 5qr " ! "`/3!.:r 0 -2-Z6 GBO %V*%&( #/ ]G N( - -! ! _ 0/3)! ! s ""ew,)+)!! ! Bv45 = () ! "'w; :. P q- "^6 "!$#&% ('*),+.-0&/ 6>.N GWP 5U, J*%& ! /3. $6^#XN(0> . P %&!.2%& ! UM " +4-. ;+ ! SO*; s5#Y\.; ! B !* PG ! P . .0>-. .d 67@$%?%.) VB. ARV3 &3 c%YAc 6 !+ g. 4 /3 - ! ] ?> _*%-. ! "2/3!"+* P4-2-Z6QGt )@&8 D%&-0 3 .,#/- + ( !D" . $%T !F; ; .0E6Bv*132546/7/6-8+ 89:2 ;=/?A@A@A 2 :CB ),;D/E 1 F2G4E+./64H; ; ; :CB 2I9J+K) : 2 ML/J9E/6NO1747C6E@ > @B4A2*-C8N6 / A@7-0@ 4B@ - /4B@B@B138 > / 6J@ I>C6 =D6G8:/ .D

Q>7@A-B>

d

6

%c

9 / 6wB6%/3. + :9 " UL6 62B01@6 VB ?>! *0N*, "N0>".)#/- B/9!

+-G" &*%& !S .0E6=@$%?%.)C . ! N(0> . P %&!.2%& @A- 5 ! PVRBCBv . ! ) ! ]*)!OUH ! NCG !$ PG ! d %Y 6 7d c /g* wg6%/3.!:26 Gg1+

+-*3v" &*%T+->0N " *)p6 !,13N >9ENA4E; +.2 >9:2 Q2 6; UNO17 / A+ R/6/H1J+ ! H )Z6"P w 3 d W g 6I\1 \%\\ u \ W \ ! + - 6d 6 7dd N(. /358(*) "OUH. )IVB01; *" *6rB%&-0N+ * H8%1"5< $" %T+-N )Z6 Bv *132546/6/7-8+ 89M2 ";=/P ;=< NO; +.2 RN 2 : B ),; /H1 Q/64E),1J+K; ; 2 H/E13/ R46/ ! :-*

%T-. d c6*X BP ! g ! )Bv ; +( 9# \u d c ! SO-; +: -2/ N !$ PG ! < P " "A "Fs*% )!:- g ! )N(-0N+ * P*% + N(*-. $6 7d\& VA-. /O ; ! s. * %& N(20>! ! _ ?LSc+;. ! w, ?% ]!)+)!. ! " N+:- P :-*)! 69 2 :;=/ ! \F" Y W\u Id ! )+@d 6

VP #Y\4 ! g + ! "- U_!. .r6"Bv ( !" . *%& !BG ( 4*6 @ O0;K[[[[ +. 1\ ! :$#%c \u "d026B P2U_ * ! GB01. 3 "0 ! g & . )! " ! d Y 6 7d01 . KP %&!. %. ! !4* VS# N)!V#/- ! 5 /+ -: ! N( " 0P :- ! P (E+ .)!V[ S` ! " N()+$\4.)?2"ES Vg %.6FGg % V*%T E"* +:-e#=J %*)?A-)!F!

+-R" . *% 3

7d W

] Bv

w, 01!)+ !

!Q .0 #/ D O.0>* :-+:e&8 R! #/ ;

%T 6Is*% !%*) VA. NC/WV^ G c%c%Y ! /3. $6#TN(0> . RP %&!.2%& ! B- ; N )!! P !4* + ! VA.)!.!: ! *-#/- T

*" *)+. g)!!%*5+- =Y%.= +:>8A!)+F %-. T6 Bv*132546/6/7-8+ 892 :;K< / +0;=< % % Q/64H),1J+K; ; ; : B 2O96+K) : ! P (-- ! N)!V#/- ? E d 6 P w XB J $! P w XB J5Gg %.! !^6 ! PG ! )!` 7d ! -2* \4+ : 1G [-*3 099# : 3Z!

;!9 $% ? **6 Bv S132G46/6/6-O+ O9 2 C;K< /8;=< NO; +.2 RN H2O1 : N8; +.2 ; 9J; / : 9 Q/64H),1J+K; ; 2 H/E13/ R46/ ! :$ d+ W\u d:\ ! _)V+0>- ! ]`/ 2! PG !

Id

"b@$%-)+-:&35 !2) N(-0> * P *% V N(* . $6

\ds ""B -2* )!.! ! ! 3/ !- ! )@.4V ! _ ! 8 ]K. J. ! .q SO " ! "O/3\4?"OSS-)7-. $6 Gc&8 9 *% +90>-V $6"Bv S132G46/6/6-O+ O92 C;=/:8@0@ ; : B 2O9J+K) : 2 L /H9H/6N81347< + Q/64E),1J+K; ; N R- *1J+ ONA4 ; ! 2:$ \ u,W c 6 Bw(w,w ! Bw(w,wZN(0> $6"P %6IU, $ ! ^QGB)?0>V- ! NCG !$ PG ! d c6 \\& " + g%-. : ! 5 )+*.6--% ! N5OP)+)!!:- ! 2 6%+6]K%$N()! ! /0>?$ 6 2 : B ),; /H169 F/64H),1J+K; ; ! d$\E W \ W Y u \7 ! d AW 6 \ W = - )Bv)!:@6 P GHI GU *):Z3 !0N3+ ( !F"& $%T+-F ; *0 #/ B J96TBv S132G46/6/6-O+ O9 2 ";=/ A@A@ ; :CB 2I9J+K) : 2 Q/64E),1J+K; ; N Q- S1J+ IN04 ; ! :$ d+ u \ !
* * ! "6U_!)!)+!6G5UL -.6 P5

+ ! )! ;?6 G )! 3 - *"O!

;!'"& $%T+-e %^6 !>13N >9ENA4E; +.2 >9 2

Q2 6;UN813/ A+ R/6/E1J+ ! \d9 W 4d Id u d ! ]K %@d Y 6 \Y& )!.*`G % ! /0>U+*3 (2;! " &*%& !I#/ 0N*8(- r6 P*I-0>+;*" - )>#`N(-0N+ * P *%B + ! \45!)!-)!f :B + & +4 : *&: .) 4 &: . ) 4$ 4 & *& $ ) $ 4 :2& ! )+`d 6 \ = !)!)+?^6EU, %.*;$- = )!**6EBv*132546/7/6-8+ 892 (;=/ % ) :K: /H1 2 H/E13/ Q46/ ! :-*X\Ac \W u \Ac ! P)+ @>N(V !F ! d 7 6 P w B J5Gg; %.! 3 +-^6 \ >N)+4! = 26

/74E),; +.2 2 +K;D281J+ 2 F/64H),1J+K; ; 4H1J+K; +.46N S132 A13N : 9M+ N ?+ 9 ; 1J+E),;D/6- ; 69 ; / : B /64E+ 9 46NO; +.2 6NI9E/6- BAB 172GN047< 6CU,/ * ! ! /3. ;0N* #N(-0N+ * P %&!. %. !F !4. V#N)++#/ ?NX/3\4? !E PG ! d 6 W c >N)+4! = ! . : +C+ ! "P )%@.4V *6GL 01 *"E" . $%T ! #C4*)+ . 3 -!)++ !*(+F +4!)+*:*" -: 01 ->&[ $%B +-D0>+ - !:26Bv*132546/6/7-8+ 892 ;=/M ;=< ) N 2 :CB ),;D/E1 Q/64H),1J+K; ; BAB +.46NO; +.2 >9 2 H/H17/ Q47/ ! 4-) 0N9[ +! ! 2:$Kd W u d 6 Bw,w(w ! Bw,w(w5N(0> . >P %&!&Û_ * ! ^- Gg)!0>V- ! NCG ! PG ! d 6 W d>N)+4! = ! ]P6VT2 %+ *5 ! " ^*4+;$62w_[$%B +-0>-V + :3# *%B +93 %. + ?%.)H : 013+P" ?;

7- *"P .016 G ;*%. =2%*5+-*3 -2 *"G --%^6 Bv*132547/6/6-O+ O9?2 ;=/ 8@A@ ; : B 2O9J+K) : 2 F/64H),1J+K; ; N R-?*1J+ ONA4 ; ! 4-):3 0N=+[ ! :-* d:Y u d !
9T6U,/ $;? ! U; " +4-. ;+ ! SO*; @5#Y\-& ! Bv2" ! ! GS:2 d Y6 WAW > P "..M: 01 _ "Nw;:-.96P q- "^6GB)!!%*5 !N#r ; * N015%*3 +:+1!

+-" &*%T+-^6^s*%?%.)"VA*2- ;XNQP/ M3 RV43 13 cd +W ! N GWP U_ AJ*%& ! /3. $67#XN(0> . >P %.+* %&$ ! UM " !4. V ! SS$ s5#Y\.; ! B !F PG ! d.d 6 W 1>P ".. : 01 "Ow;:-.96 P q- "76DG 25;. J0>%!:E0> " .)H#/- 0N?( ;9+

+-K" &*%& !^6XBvS132G46/6/6-O+ O9M2 ?;=/M E;=< "NO; +.2 QN * 2 : B ),; /H1 Q/64H),1J+K; ; 2 H/E13/ R46/ ! :*Kd%d u \Id ! _)+ !0N- O]`/ ! PIG ! d 26, BP ! g 3 ! ) Bv2V #P " " "Ds*% )!:- g ! ) N(0> . XP$%B + N(. * *6

W &Y >P "..(:01 "Fw;:-. 6IP25qr "76

G # 8 g %+ *% g >$ *3 2- ;N0N?( ; !- (2;!'" . $%T !@6Os*% !%*) *2- ; ! 2N GWP U, J*%& ! /g* *6L# N(-0>^6P%&!. %.* ! U; " !4r6 ! SS$@#Y\.; ! B ! c u d W ! d:.d Y 6 PG ! ]K %3 W )+# ^! "I?4!;* 6 H9E/H1 ONO; +.2 9S2 M;K< / "NO; ),13/ 2 2 : B ),; /E1 F/74E),1J+K; ; ; 1J)9J+.2 >9T6 ^?%&.! ( $;? ! P%)#2w,)+$%T

?%.) "ON(0> . Lw_:-+ .. !: ! N( )+0>. !4* VD#Cs*% )!:- ! - : ! P8*" * ! d 6 W )+# @+ "?-4?_ "w, )?2"- ;-^6B58e ; ; *0> ?%.)+)!%&)?;+#/%&-0> * ;$%B V3+ ( ! *$6 Bv *132547/6/6-O+ O9S2 ;=/ A@A@ ; :CB 2I9J+K) : 2 Q/64E),1J+K; ; S1J+IN04 ; ! :*C d$Y u d6 W ! g4- ! _.)!:0 ! P* *> 0 -. d0 u d+ ! d 6 W VA!%2 F " UL6 @+ 0> ! B% 5# ! Pr66_6 = *) ! GQ 6 Pr6 - ! >86 V6 =. ")+) ! /6 286 ]G% N(): ! /96 C6 SO -. ! Pr6wB6 SO -2. ! /9Q6 Sc %:- " ! "`]'"6 G6 ? 01^6B . d O/XGWVXUG AG +V'$q 3M)!++ ( !K" . *%& ! .45) 5+-^6FU, $;* *"' P6 +C+ ;K Bv )Z6 SO ;-' VA$%&.DGg"4\ %&$ + Bv

+-E/g. $%T ! VXGXB/ 3 2 ! ^545!*3M)! 3>g4- ! _.)!:0 ! "2 B 1J+ ; /6B 132546/7/6-8+ 89 ! P. .0 -2* d0 u d+ ! d 6 %c @* $ O + N*C6 GL 015*"E. "VB +)^ )! ;?A2"F!

+- " . $%T ! G $ 4*6 Bv *132546/7/6-8+ 89:2 ;K< /A8;K< "N8; +.2 RN X 2 :CB ),;D/E1 F/74E),1J+K; ; 2 H/E13/ R46/ ! :-* %Y u W+! _)+ !0> ! ]K )? " ! 2 ! G $:) 3p+0>A!- (2;!" . $%T !F; ; .0E67s*%?%.") VA 3 2- ; PVRBRU_ A J$%T "d %Y&3 cd c ! PIVRB>3NQP C 3 &3 d\ ! NQP PVRBQBv . ! ) ! N(0 3 * P %&!.2%&@ -2- ! PVRBTBv )Z6 WAW0W VB\4-. 8( " Gg46 ! ]*)! UH ! NCG \Y&3 W AW+1! PIG ! ^6 G *) 3Z !0>e!- (2;!*3v" . *%& ! .[. O .0 B/3wCPET 6 s*% !%*) VA*2- ; U_ AJ*%& 7 ! NQP ! PVRBOBv * 25 !2) ! N(-0 3 + * .P %&!. %. @-2- ! PVRBKBv-)p6 WAWAW VB\4-. 8( "0Gg4-6 ! ]. )+ UH ! NCG \%Y3 W AW !2 PG ! + - 6d \ 6 W =9 6 ]K% GL)!+q ! SS-)!%.;$6 / ! P% .#/. $6 ! = .)!.0E66 ! SI-I- "^6 _ ! "g)+*6*=6 B3 =%&0> . -.!: 0N?( ;$" G ( 4-.E#%B *-6 Bv*132546/7/6-8+ 89?2 :;K< / G;K< % F/74E),1J+K; ; ; :CB 2I9J+K) : ! P GB -! ! J ! d 6 P w B J ! P w XB J G3 %&?5+-^6'N( $%T $">4* +- ! PG ! * . 54-. 5*">=

%- ! ]K )! " ! * P*% V N(* . $6 Y N( ?; ! >SJ . " * ! P.2! + *; ! " _ UL. )!0j . $6 /3&*%& !: +

+- v !:g ; *0U%*)!)!6 GB)+ * 25 !4("50N " *)!*A6 Bv ; : B 2O9J+K) : 2 F/64H),1J+K; ; N R- *1J+ONA4 ; ! :$ d WAW5u dY ! _. .)!. ! N)!V#/- ? ! ]G\6 d 6 Y 6 ScV1 " 96 UL%@6 N(-2* !:F *% +01 :* 6 X/g?;

7 - *"S!*3

;!" . $%T ! .01.6 2 :CB ),;D/E169 F/64H),1J+K; ; ! H)Z6 d$YE g 6 Y2 d u YAc ! d 6Lw_)?;*4+*R

P%&!. %. 7"^6

%Y