Skip to content

Commit

Permalink
Merge pull request #641 from ge-high-assurance/check_upd_2022_01
Browse files Browse the repository at this point in the history
Updates to ASSIST-DV checks
  • Loading branch information
kquick committed Jan 24, 2022
2 parents 00655dc + 9ff547c commit 823e9ea
Show file tree
Hide file tree
Showing 13 changed files with 655 additions and 132 deletions.
2 changes: 1 addition & 1 deletion RACK-Ontology/ontology/HARDWARE.sadl
Expand Up @@ -13,7 +13,7 @@
uri "http://arcos.rack/HARDWARE" alias hw.
import "http://arcos.rack/PROV-S".

HWCOMPONENT is a type of ENTITY.
HWCOMPONENT (note "A generic physical hardware component") is a type of ENTITY.
instantiates (note "What logical component (system) does this physical component instantiate or implement?")
describes HWCOMPONENT with values of type ENTITY.
componentType (note "Type of component")
Expand Down
4 changes: 2 additions & 2 deletions RACK-Ontology/ontology/SECURITY.sadl
Expand Up @@ -48,7 +48,7 @@ THREAT_IDENTIFICATION
Sec:author (note "AGENT(s) who work on this ACTIVITY") describes THREAT_IDENTIFICATION with values of type AGENT.
Sec:author is a type of wasAssociatedWith.

SECURITY_LABEL is a type of THING.
SECURITY_LABEL (note "A label to help categorize the associated SECURITY concern") is a type of THING.

// A few common instances: additional ones could be Authorization, Non-repudiation, Privacy, etc.
Confidentiality is a SECURITY_LABEL
Expand All @@ -63,7 +63,7 @@ Availability is a SECURITY_LABEL

CONTROL (note "CONTROLs mitigate THREATs") is a type of ENTITY.

CONTROLSET is a type of COLLECTION.
CONTROLSET (note "A set of CONTROLs that combine to mitigate a THREAT") is a type of COLLECTION.
content of CONTROLSET only has values of type CONTROL.

// A THREAT can be mitigated by a set of CONTROLs etc., mitigation by CONTROL is defined in CONTROL.sadl.
Expand Down
28 changes: 15 additions & 13 deletions assist/bin/README.md
Expand Up @@ -337,21 +337,23 @@ build tools can use a similar technique.
The following data is collected for processing a moderately large code
base (turnstile + ffmpeg) and a very large codebase.

| Codebase | Tool | Runtime | Notes |
|------------------|---------|---------|------------------------------------------------------|
| moderately large | ingest | 9m30s | Saved 38,880 triples about 6,649 subjects |
| | - | | |
| | analyze | 12.2s | 1,878 `http://arcos.rack/SOFTWARE#COMPILE` instances |
| | | | 4,756 `http://arcos.rack/SOFTWARE#FILE` instances |
| | | | 9 `http://arcos.rack/PROV-S#ACTIVITY` instances |
|------------------|---------|---------|------------------------------------------------------|
| huge | ingest | 14m7s | Saved 455,231 triples about 89,945 subjects |
| | - | | |
| | analyze | 15m36s | 1,880 `http://arcos.rack/SOFTWARE#COMPILE` instances |
| | | | 88,049 `http://arcos.rack/SOFTWARE#FILE` instances |
| Codebase | Tool | Runtime | Notes |
|------------------|---------|---------|---------------------------------------------------------------------|
| moderately large | ingest | 9m30s | Saved 38,880 triples about 6,649 subjects |
| | - | | |
| | analyze | 12.2s | 1,878 `http://arcos.rack/SOFTWARE#COMPILE` instances |
| | | | 4,756 `http://arcos.rack/SOFTWARE#FILE` instances |
| | | | 9 `http://arcos.rack/PROV-S#ACTIVITY` instances |
|------------------|---------|---------|---------------------------------------------------------------------|
| large | check | 33.6s | 69 core ontology classes, 120 overlay classes, 75583 data instances |
|------------------|---------|---------|---------------------------------------------------------------------|
| huge | ingest | 14m7s | Saved 455,231 triples about 89,945 subjects |
| | - | | |
| | analyze | 15m36s | 1,880 `http://arcos.rack/SOFTWARE#COMPILE` instances |
| | | | 88,049 `http://arcos.rack/SOFTWARE#FILE` instances |

---
Copyright (c) 2020, Galois, Inc.
Copyright (c) 2020-2022, Galois, Inc.

All Rights Reserved

Expand Down
3 changes: 2 additions & 1 deletion assist/bin/check
Expand Up @@ -17,13 +17,14 @@
:- use_module(library(optparse)).
:- consult(common_opts).
:- consult(rack(check)).
:- consult(rack(check_runner)).

main :-
help_banner(B),
(
(
parse_args([], _Opts, _PosArgs, B),
check_rack
run_checks
) ;
print_message(error, bad_arguments),
help_abort(none, B)
Expand Down
51 changes: 51 additions & 0 deletions assist/bin/checks/interfaceChecks.pl
@@ -0,0 +1,51 @@
% Copyright (c) 2022, Galois, Inc.
%
% All Rights Reserved
%
% This material is based upon work supported by the Defense Advanced Research
% Projects Agency (DARPA) under Contract No. FA8750-20-C-0203.
%
% Any opinions, findings and conclusions or recommendations expressed in this
% material are those of the author(s) and do not necessarily reflect the views
% of the Defense Advanced Research Projects Agency (DARPA).

:- module(interfaceChecks,
[
check_INTERFACE/1
]).

:- ensure_loaded('../paths').
:- use_module(rack(model)).


%! check_INTERFACE_no_dest_SYSTEM is det.
%
% Checks that no INTERFACE is lacking a destination SYSTEM.
% Always succeeds, emits warnings.
%
% Similar to "nodegroups/query/query dataVer INTERFACE without destination SYSTEM.json"
%
check_INTERFACE_no_dest_SYSTEM(IFACE) :-
check_has_no_rel('http://arcos.rack/SYSTEM#INTERFACE',
'http://arcos.rack/SYSTEM#destination',
'http://arcos.rack/SYSTEM#SYSTEM', IFACE).


%! check_INTERFACE_no_src_SYSTEM is det.
%
% Checks that no INTERFACE is lacking a source SYSTEM.
% Always succeeds, emits warnings.
%
% Similar to "nodegroups/query/query dataVer INTERFACE without source SYSTEM.json"
%
check_INTERFACE_no_src_SYSTEM(IFACE) :-
check_has_no_rel('http://arcos.rack/SYSTEM#INTERFACE',
'http://arcos.rack/SYSTEM#source',
'http://arcos.rack/SYSTEM#SYSTEM', IFACE).

%! check_INTERFACE is det.
%
% Performs all checks for INTERFACEs. Always succeeds, emits warnings.
check_INTERFACE(IFACE) :-
check_INTERFACE_no_dest_SYSTEM(IFACE);
check_INTERFACE_no_src_SYSTEM(IFACE).
64 changes: 64 additions & 0 deletions assist/bin/checks/sbvt_checks.pl
@@ -0,0 +1,64 @@
% Copyright (c) 2022, Galois, Inc.
%
% All Rights Reserved
%
% This material is based upon work supported by the Defense Advanced Research
% Projects Agency (DARPA) under Contract No. FA8750-20-C-0203.
%
% Any opinions, findings and conclusions or recommendations expressed in this
% material are those of the author(s) and do not necessarily reflect the views
% of the Defense Advanced Research Projects Agency (DARPA).

:- module(sbvt_checks,
[
check_SBVT/1
]).

:- ensure_loaded('../paths').
:- use_module(rack(model)).

%! check_Result_not_confirmed is det.
%
% Checks that no SBVT_Result is lacking a confirming TEST.
% Always succeeds, emits warnings.
%
% NOTE: this test is superfluous since it's already validated by the
% base checks for cardinality constraints, but it's included here as
% an example of how a higher-level check might be written.
%
% Similar to "nodegroups/query/query
% dataVer SBVT_Result without confirms_SBVT_Test.json"
%
check_Result_not_confirmed(I) :-
check_has_no_rel('http://arcos.AH-64D/Boeing#SBVT_Result',
'http://arcos.rack/TESTING#confirms',
'http://arcos.AH-64D/Boeing#SBVT_Test',
I).

%! check_no_Test_requirement is det.
%
% Checks that no SBVT_Test is lacking a Requirement to verify.
% Always succeeds, emits warnings.
%
% NOTE: the core ontology specifies that an SBVT_Test is a type of
% TESTING#TEST, and TESTING#verifies specifies it must describe an
% ENTITY. Here, there is a higher-level semantic assertion that an
% SBVT_Test must "verifies" a REQUIREMENT.
%
% Similar to "nodegroups/query/query dataVer SBVT_Test without REQUIREMENT.json"
% and "nodegroups/query/query dataVer SRS_Req without verifies SBVT_Test.json"
% where the latter additionally qualifies the target of the former.
%
check_no_Test_requirement(I) :-
check_has_no_rel('http://arcos.AH-64D/Boeing#SBVT_Test',
'http://arcos.rack/TESTING#verifies',
'http://arcos.AH-64D/Boeing#SRS_Req',
%% 'http://arcos.rack/REQUIREMENTS#REQUIREMENT',
I).

%! check_SBVT is det.
%
% Performs all checks for SBVT classes. Always succeeds, emits warnings.
check_SBVT(SBVT) :-
check_Result_not_confirmed(SBVT);
check_no_Test_requirement(SBVT).
52 changes: 52 additions & 0 deletions assist/bin/checks/software_checks.pl
@@ -0,0 +1,52 @@
% Copyright (c) 2022, Galois, Inc.
%
% All Rights Reserved
%
% This material is based upon work supported by the Defense Advanced Research
% Projects Agency (DARPA) under Contract No. FA8750-20-C-0203.
%
% Any opinions, findings and conclusions or recommendations expressed in this
% material are those of the author(s) and do not necessarily reflect the views
% of the Defense Advanced Research Projects Agency (DARPA).

:- module(software_checks,
[
check_SOFTWARE/1
]).

:- ensure_loaded('../paths').
:- use_module(rack(model)).


%! check_SOFTWARE_partOf_SOFTWARE is det.
%
% Checks every SOFTWARE partOf target is a SOFTWARE.
% Always succeeds, emits warnings.
%
% Similar to "nodegroups/query/query dataVer SOFTWARE without partOf SOFTWARE.json"
%
check_SOFTWARE_COMPONENT_contained(I) :-
check_has_no_rel('http://arcos.rack/SOFTWARE#SWCOMPONENT',
'http://arcos.rack/SOFTWARE#subcomponentOf',
'http://arcos.rack/SOFTWARE#SWCOMPONENT',
I).

%! check_SOFTWARE_COMPONENT_impact is det.
%
% Checks every SOFTWARE partOf target is a SOFTWARE.
% Always succeeds, emits warnings.
%
% Similar to "nodegroups/query/query dataVer SOFTWARE without partOf SOFTWARE.json"
%
check_SOFTWARE_COMPONENT_impact(I) :-
check_has_no_rel('http://arcos.rack/SOFTWARE#SWCOMPONENT',
'http://arcos.rack/PROV-S#wasImpactedBy',
'http://arcos.rack/REQUIREMENTS#REQUIREMENT',
I).

%! check_SOFTWARE is det.
%
% Performs all checks for SOFTWARE classes. Always succeeds, emits warnings.
check_SOFTWARE(SC) :-
check_SOFTWARE_COMPONENT_contained(SC);
check_SOFTWARE_COMPONENT_impact(SC).
111 changes: 111 additions & 0 deletions assist/bin/checks/srs_checks.pl
@@ -0,0 +1,111 @@
% Copyright (c) 2022, Galois, Inc.
%
% All Rights Reserved
%
% This material is based upon work supported by the Defense Advanced Research
% Projects Agency (DARPA) under Contract No. FA8750-20-C-0203.
%
% Any opinions, findings and conclusions or recommendations expressed in this
% material are those of the author(s) and do not necessarily reflect the views
% of the Defense Advanced Research Projects Agency (DARPA).

:- module(srs_checks,
[
check_SRS/1
]).

:- ensure_loaded('../paths').
:- use_module(rack(model)).


%! check_SRS_insertion_source is det.
%
% Checks that no SRS_Req is inserted by any activity other than
% "SRS Data Ingestion". Always succeeds, emits warnings.
%
% Similar to "nodegroups/query/query dataVer SRS_Req dataInsertedBy other than SRS Data Ingestion.json"
%
check_SRS_insertion_source(I) :-
T = 'http://arcos.AH-64D/Boeing#SRS_Req',
rack_data_instance(T, I),
rdf(I, 'http://arcos.rack/PROV-S#dataInsertedBy', A),
rack_instance_ident(A, AName),
\+ AName = 'SRS Data Ingestion',
rack_instance_ident(I, IN),
rdf(A, rdf:type, ATy),
print_message(warning, invalid_srs_req_inserter(T, I, IN, ATy, A, AName)).

%! check_SRS_Req_CSID_or_PIDS is det.
%
% Checks every SRS_Req satisfies only a CSID or PIDS.
% Always succeeds, emits warnings.
%
% Similar to "nodegroups/query/query dataVer SRS_Req without CSID or PIDS.json"
%
check_SRS_Req_CSID_or_PIDS(I) :-
T = 'http://arcos.AH-64D/Boeing#SRS_Req',
rack_data_instance(T, I),
rdf(I, 'http://arcos.rack/REQUIREMENTS#satisfies', R),
\+ is_CSID_or_PIDS(R),
rack_instance_ident(I, Ident),
rack_instance_ident(R, RIdent),
rdf(R, rdf:type, RTy),
print_message(warning, invalid_srs_req_satisfies(T, I, Ident, RTy, R, RIdent)).

is_CSID_or_PIDS(Inst) :- rdf(Inst, rdf:type, 'http://arcos.AH-64D/Boeing#PIDS_Req').
is_CSID_or_PIDS(Inst) :- rdf(Inst, rdf:type, 'http://arcos.AH-64D/Boeing#CSID_Req').


%! check_SRS_Req_description is det.
%
% Checks every SRS_Req has a PROV-S description
% Always succeeds, emits warnings.
%
% Similar to "nodegroups/query/query dataVer SRS_Req without description.json"
%
check_SRS_Req_description(I) :-
check_has_no_rel('http://arcos.AH-64D/Boeing#SRS_Req',
'http://arcos.rack/PROV-S#description',
I).


%! check_SubDD_Req_satisifies_SRS_Req is det.
%
% Checks every SubDD_Req satisifes an SRS_Req.
% Always succeeds, emits warnings.
%
% Similar to "nodegroups/query/query dataVer SubDD_Req without satisfies SRS_Req.json"
%
check_SubDD_Req_satisfies_SRS_Req(I) :-
check_has_no_rel('http://arcos.AH-64D/Boeing#SubDD_Req',
'http://arcos.rack/TESTING#satisifes',
'http://arcos.AH-64D/Boeing#SRS_Req',
I).


prolog:message(invalid_srs_req_inserter(ITy, Inst, InstIdent, InsTy, InsI, InsN)) -->
{ prefix_shorten(ITy, SIT),
prefix_shorten(Inst, SII),
prefix_shorten(InsTy, STT),
prefix_shorten(InsI, STI)
},
[ '~w instance ~w (~w) inserted by invalid ACTIVITY: ~w ~w (~w)'-[
SIT, SII, InstIdent, STT, STI, InsN ] ].
prolog:message(invalid_srs_req_satisfies(ITy, Inst, InstIdent, TgtTy, Tgt, TgtIdent)) -->
{ prefix_shorten(Inst, SI),
prefix_shorten(ITy, ST),
prefix_shorten(Tgt, SR),
prefix_shorten(TgtTy, SRT)
},
[ '~w instance ~w (~w) satisifes something not a PIDS_Req or CSID_Req: ~w ~w (~w)'-[
ST, SI, InstIdent, SRT, SR, TgtIdent ] ].


%! check_SRS is det.
%
% Performs all checks for SRS classes. Always succeeds, emits warnings.
check_SRS(SRS) :-
check_SRS_insertion_source(SRS);
check_SRS_Req_CSID_or_PIDS(SRS);
check_SRS_Req_description(SRS);
check_SubDD_Req_satisfies_SRS_Req(SRS).

0 comments on commit 823e9ea

Please sign in to comment.