CYBER Sim – DEC03-06

Design Report 04/15/03

Client:ISU Information Assurance Center

Faculty Advisor:Doug Jacobson

Team Members:Adam Straw

Ryan Applegate

Saddam Khattak

Dan Nguyen

1

Table of Contents

1Frontal Materials

1.1List of Figures

1.2List of Tables

1.3List of Definitions

2Introductory Materials

2.1Abstract

2.2Acknowledgement

2.3Problem Statement

2.3.1General Problem Statement

2.3.2General Solution-Approach Statement

2.4Operating Environment

2.5Intended Users and Intended Uses

2.5.1Intended Users

2.5.2Intended Uses

2.6Assumptions and Limitations

2.6.1Assumptions

2.6.2Limitations

2.7Expected End Product and Other Deliverables

3Approach and Design Results

3.1Approach Used

3.1.1Design objectives

3.1.2Functional requirements

3.1.3Design Constraints

3.1.4Technical approach considerations and results

3.1.5Testing approach considerations

3.1.6Recommendations regarding project continuation or modification

3.2Detailed Design

3.2.1Introduction

3.2.2Detailed Gameplay Description

3.2.3User interface and controls

3.2.4Game Data

3.2.5Logic

3.2.6Data Storage and Resource Files

3.2.7Multimedia

4Resources and Schedules

4.1Resource Requirements

4.1.1Personnel Effort Requirements

4.1.2Other Resource Requirements

4.1.3Financial Requirements

4.2Schedules

5Closure Materials

5.1Project Team Information

5.1.1Client Contact Information

5.1.2Faculty Advisor Contact Information

5.1.3Team Members Contact Information

5.2Closing Summary

5.3References

5.3.1Programming References

5.3.2Network Systems References

5.4Appendices

5.4.1APPENDIX A – Sample DirectX Code for GUI

1

1 Frontal Materials

This section contains information about the document including a list of figures, list of tables, and a list of definitions.

1.1 List of Figures

  • Figure 3.2.4.1 Relationship between company variables
  • Figure 3.2.5 Logic Diagram
  • Figure 3.2.7.1.3.1 – Sample screen from The Sims™
  • Figure 3.2.7.1 Texture mapped cube
  • Fig 3.2.7.1.2 .1 Topology Screen from CyberProtect™
  • Figure 4.2 – Gantt Chart

1.2 List of Tables

  • Table 3.2.5.4 - Attacks, defenses, and their effectiveness
  • Table 4.1.1a - Original personal efforts
  • Table 4.1.1b - Revised personal efforts
  • Table 4.1.2a - Original resource requirements
  • Table 4.1.2b - Revised resource requirements
  • Table 4.1.3a - Original financial requirements
  • Table 4.1.3b - Revised financial requirements
  • Table 5.1.1 - Client contact information
  • Table 5.1.2 - Faculty and advisor contact information
  • Table 5.1.3(a-d) - Team member contact information

1.3 List of Definitions

  • Buffer Overflow – Technique for crashing or gaining control of a computer by loading it with data sent to the buffer in a computer’s memory.
  • Crackers – Hackers on hire who break into computer systems to steal valuable information for their own financial gain.
  • Cyber Squatting – Buying domain names like or and then selling them for a big profit (just like a personalized number plate).
  • Denial of Service – Intentionally flooding a website with too many requests for information, an attacker can effectively clog the system, slowing performance or even crashing the site.
  • Dumpster Diving – Sifting through a company’s garbage to find information to help break into their computers.
  • Eavesdropping – An intruder reroutes all traffic through his/her machine
  • Hacker – A person who explores programming systems in detail and who seeks to extend his knowledge in this field. The term represents persons illegally introduced into computer systems. White-hat hackers are the good guys who are excited by the intellectual challenge of tearing apart computer systems to improve computer security. Black-hat hackers are desperadoes on the Net out to crash systems, stealing passwords, and generally wreaking as much havoc as possible.
  • Insiders – Disgruntled employees working solo or in concert with outsiders to compromise corporate systems.
  • Logic Bombs – An instruction in a computer program that triggers a malicious act.
  • Malicious Applets – Tiny programs, sometimes written in Java, which misuse a computer’s resources to modify files on the hard disk, send fake e-mail, or steal passwords.
  • Password Crackers – Those who possess software that can guess passwords.
  • Phreaking – An act of pirating telephone networks. Since they spend long hours trying to get access to phone lines the majority of the hackers are also phreakers. Moreover, since the modern telephone exchanges are computerized, it becomes possible for phreakers to control the network as easily as an employee of the telephone company.
  • Scans – Widespread probes of the Internet to determine types of computers, services, and connections. This way one can take advantage of the weaknesses in a particular make of computer or software program.
  • Script Bunnies – Amateur hackers with little technical savvy who download program-scripts that automate the job of breaking into computers.
  • Sniffer – A program that covertly searches individual packets of data as they pass through the Internet, capturing passwords of the entire contents.
  • Spoofing – Faking an e-mail address or a web page to trick users into passing along critical information like passwords or credit-card numbers.
  • Trojan horses – Software programs that hides another program. For example, if in addition to being a word-processing program, its programmer decides to make it search for the valid applications and erase all other word processing software, it is a Trojan horse. It is also possible to use a Trojan horse to introduce a virus on a computer.
  • Viruses – Programs that can reproduce in a computer and infect other programs. It is transmitted from one computer to another, on copying an infected program. The viruses can be programmed to be harmful, for example, by erasing all of the machine’s data on a precise date.
  • War Dialing – Programs that automatically dial thousands of telephone numbers in search of a way in through a modem connection.
  • Worms – A worm differs from a virus in that it transfers itself from one computer to the other through a network.

1

2 Introductory Materials

This section contains basic information about the project including the abstract, acknowledgement, problem statement, operating environment, intended users and uses, assumptions and limitations, and the expected end product and deliverables.

2.1 Abstract

When it comes to unsecured networks, robbers and thieves no longer need weapons to gain access to valuable information and financial assets. Despite the popularity of computers and networking, network security is still an obscure subject. The goal of this project is to develop an interactive computer game that shall introduce people to the theory and fundamentals of computer security. CYBER Sim shall be modeled after the Electronic Arts Sim games and shall allow the player to purchase equipment and attempt to protect a network. The game shall simulate attacks on the network and the player shall be evaluated on how well he/she has designed the protection system. It is our desire to create a game that will be entertaining yet will educate the user on the importance and the fundamentals of computer security.

2.2 Acknowledgement

Information Assurance Center

Dr. Doug Jacobson, Associate Professor

Iowa State University

2.3 Problem Statement

This section defines the problem and the solution in general terms.

2.3.1 General Problem Statement

The main problem is how to educate the general population about a concept that is both obscure and technical. Given the abstract nature of computer network security and its implementation, the task is to create an interactive game that will be both educational and entertaining for the user, such that he/she shall have a concrete understanding of the principles behind network security, as well as gain an interest in pursuing the subject in further depth.

2.3.2 General Solution-Approach Statement

The solution will be to model CYBER Sim after the popular Sim games. The Sim games have brought normally difficult and abstract topics—such as the building of a city or the genesis of life—and brought it down to a level that is easy to grasp and captivating for the player. Our goal is to do the same with computer network security.

In the product, CYBER Sim, the features that have made the Sim games so well-received shall be implemented, including:

  • Functional graphical interface
  • Strategic elements to the game play
  • Easy learning curve and intuitive controls
  • Compelling presentation of the theory and conceptual ideas

2.4 Operating Environment

CYBER Sim shall be distributed by compact disc (CD) so it must be able to withstand the usual wear and tear of CD. It will be created to run on all versions of the Windows operating system since Windows 95. Each of these operating systems has a different level of stability and different functionality that will need to be taken into account.

CYBER Sim will be used on a wide range of computer systems including relatively low-end computer systems. A low-end computer system could have one or more of: low memory, slow CPU speed, low hard disc space, or poor sound or video capabilities.

2.5 Intended Users and Intended Uses

This section identifies the intended users and uses of the project.

2.5.1 Intended Users

The intended users of CYBER Sim shall be those who are interested in computer security and who like to play games. This shall range from middle school students to engineers and professors in the computer industry. Its user friendly and self-explanatory game play shall make it easy for young adults to navigate, yet its strategic virus attacks shall make it challenging for older adults.

2.5.2 Intended Uses

CYBER Sim shall be a marketable product, and shall be distributed by Iowa State University to high schools and other environments where it may be utilized as an educational tool. Another use of CYBER Sim shall be to provide individuals and small business owners the opportunity to test their current virus protection against possible attacks before a real attack occurs. During a simulated attack in CYBER Sim, the program shall tell what was done well to protect against the viruses and what could be done different next time to be more effective. Ultimately, the use of this program shall be to save time, money, documents, and work that may have been destroyed with a virus attack.

2.6 Assumptions and Limitations

This section gives the assumptions and limitations for the project.

2.6.1 Assumptions

  • Users will possess basic knowledge of and have experience with computers
  • Users will have a CD-ROM drive
  • Users will have sufficient processor speed, disk space, and memory
  • Game will be played by only one player at a time
  • Users will have access to a Windows based PC

2.6.2 Limitations

  • Quality art and music for the game will be limited by time
  • The project must fit on a single CD-ROM (less than 700MB)

2.7 Expected End Product and Other Deliverables

  • Project plan
  • Project poster
  • Design report
  • Research
  • Game documentation
  • Game

Research conducted on the topic of network security shall be delivered to the client. The research will be included in the game so that the user can learn about network security by playing the game.

The game, CYBER Sim, shall be distributed by Iowa State University. CYBER Sim shall use technology and creativity to create a real-time network security environment through an interactive medium. The program shall be constructed in such a way that it will provide a framework that will be easy to build on by future attempts to expand the game.

3 Approach and Design Results

This section gives a detailed description of the approach used and the design for the project.

3.1 Approach Used

This section details the approach used to complete the project including design objectives, functional requirements, design constraints, technical approach considerations and results, testing approach considerations, and recommendations regarding project continuation or modification.

3.1.1 Design objectives

  • Functional graphical interface
  • Strategic elements to the game play
  • Easy learning curve and intuitive controls
  • Compelling presentation of the theory and conceptual ideas

3.1.2 Functional requirements

  • Allow purchase of computer equipment to prevent against network attacks

The user shall create a network and then attempt to protect it by buying computer equipment. The goal of the user is to prevent against network attacks simulated by the game.

  • Simulate network attacks

The game shall simulate network attacks such as viruses, worms, etc. against the network that the user is attempting to protect.

  • Report on success or failure of attacks

The game shall report on how well the user did in protecting the network against attack.

  • Provide descriptions computer equipment and software, and attacks

In order to help the user learn about computer security the game shall provide information about the computer equipment available for purchase and the network attacks that may be simulated.

3.1.3 Design Constraints

  • Cost-effective design
  • Flexible for future expansion

3.1.4 Technical approach considerations and results

This section details the process taken to select the technology for the project including technologies considered, advantages and disadvantages of each technology, the selected technology, and the reasons for selection.

3.1.4.1 Technologies considered
  • C / OpenGL
  • Java / Java3D
  • Macromedia
3.1.4.2 Advantages and disadvantages of each technology

This section gives the advantages and disadvantages of each technology that was considered for the project

C / OpenGL

Advantages

  • Excellent tutorials
  • Widely used
  • Small learning curve
  • Good development environment
  • Compatible with Microsoft Visual SourceSafe
  • Low level language – fast
  • Entire group has extensive experience

Disadvantages

  • Complexities of the language may be difficult to master
  • Low level language – more prone to error

Java / Java3D

Advantages

  • Small learning curve
  • Widely Used
  • Extremely fast for a Java 3D engine
  • Uses raycasting and texture mapping
  • Existing engine with source code available
  • First person look and feel
  • Typical advantages of code reuse (accelerated development, reduced process risk, and increased reliability)

Disadvantages

  • Slow at run-time
  • Poor development environment
  • Code reuse could be risky (the latest version still had some bugs and was not fully tested)
  • May not interface well with other code

Macromedia Director

Advantages

  • Good for creating movies
  • Simple to use once learned
  • Good tutorials
  • Can incorporate 3D graphics

Disadvantages

  • Poor for game development, but can be used for movies which a game can call if desired
  • Large learning curve
  • No built in 3D engine, possible problems with interfacing another language
3.1.4.3 Selected technology

The selected technology was C / OpenGL. The development environment will be Microsoft Visual Stuio.net.

3.1.4.4 Reasons for selection

Although each technology meets our needs, C and OpenGL have the most advantages. The group as a whole is already familiar with it. The development suites for it are excellent. And more importantly, the language is very flexible and powerful.

3.1.5 Testing approach considerations

This section details the approach for testing the project including how and where the testing will be performed, what will be tested, how testing accuracy will be determined, what information is required on the forms that will be used to record the test results, and who will do the testing and how the testing will be verified.

3.1.5.1 How and where will the testing be performed?

Anyone who wishes to test the game will have access through a website to one or more files that will install the game on a computer of their choice. They may then test the game, write down their results, and remove it from their computer.

3.1.5.2 Exactly what will be tested?
  • Able to install
  • Inputs and outputs function properly
  • Cosmetics
  • Accuracy and usefulness of documentation
  • User friendliness of GUI
  • Functionality of all GUI components
  • Virus free
3.1.5.3 How will testing accuracy be determined?

The accuracy of testing will be determined by a number of things:

  • The number of tests run

The more tests that are run the more likely any errors made during development will be caught and fixed.

  • Similarity between comments

If different people give similar comments during testing then the testing process is likely more accurate than if different people give opposing comments.

  • Results of automated testing

The game will be tested extensively through automated scripts. These scripts will be designed to test every line of code to see if given inputs produce the desired output.

3.1.5.4 What information is required on the forms that will be used to record the test results?
  • Who performed the test
  • Date and time of the test
  • Results of the test
  • Any pertinent comments

The results of the test will consist of comments on the items in the “Exactly what will be tested?” section.

3.1.5.5 Who will do the testing and how will it be verified?
  • Group Members – Make sure basic functionality works, check program against a basic set of requirements such as: installs properly, simple input and output work, no viruses, uninstalls properly, documentation is up to date, etc.
  • Outsiders to the Group – will try to “break” the game, and report their “success”
  • Faculty Advisor – Will be able to function as a group member or an outsider to the group because of only slight involvement with the development of the project.
  • Automated Testing – Scripts will be written to test every line of code to see if given inputs produce the desired output.

3.1.6 Recommendations regarding project continuation or modification

It is the team’s recommendation to continue with the project as originally envisioned. The project has a good design, is interesting, and will be beneficial to it creators, owners, and users.

3.2 Detailed Design

This section is a high-level description of Cyber SIM. Although no programming details are included, it does provide a comprehensive schematic of what the vision is for Cyber SIM.

3.2.1 Introduction

This sub-section describes the general idea behind the game play of Cyber SIM as well as the intentions behind this game—for example, what is intended for the user to learn.

This description is intended for both the programmers and client of this project, as well as the interested customer.

3.2.1.1 Game Overview

Cyber SIM places the player in the role of a system administrator of an up and coming business. The player is in charge of keeping the company’s networks secure from attacks and system failures, whether it is viruses accidentally downloaded from the Internet or hackers with malicious intent.

At the player’s disposal are a variety of defenses and countermeasures to place on the network. The player will also be responsible for deciding security policies and the maintenance of the network. If the player succeeds, the company will flourish and the budget will increase, giving the player greater purchasing power. If the player does poorly, the company and its budget will be stagnant or even shrink.