<?xml version="1.0" encoding="UTF-8"?>
<KnowledgeBase xmlns="ID@NCSU"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	   xsi:schemaLocation="ID@NCSU 
	   newKnowledgeBase.xsd">

<!-- based on .5 -->
<!-- add implication between ehlo and turn -->

<!-- ================= Predicates ============== -->
<Predicates>
<Predicate Name="CiscoCatalyst3500XL">
  <Arg id="1" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="ActiveXEnabledBrowser">
  <Arg id="2" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="ExistFTPService">
  <Arg id="3" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="GainAccess">
  <Arg id="4" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="GainAdmindInfo">
  <Arg id="5" Pos="1" Attr="varchar(15)"></Arg>
  <Arg id="6" Pos="2" Attr="int"></Arg>
</Predicate>
<Predicate Name="GainInformation">
  <Arg id="7" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="GainOSInfo">
  <Arg id="8" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="GainServiceInfo">
  <Arg id="9" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<!--
<Predicate Name="GainSMTPInfo">
  <Arg id="10" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
-->
<Predicate Name="GainTerminalType">
  <Arg id="11" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="JavaEnabledBrowser">
  <Arg id="12" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="MailLeakage">
  <Arg id="13" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="ReadyToLaunchDDOSAttack"></Predicate>
<Predicate Name="SendMailInDebugMode">
  <Arg id="14" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="SMTPSupportEhlo">
  <Arg id="15" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<!--
<Predicate Name="SMTPSupportTurn">
  <Arg id="16" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
-->
<Predicate Name="SystemAttacked">
  <Arg id="17" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="SystemCompromised">
  <Arg id="18" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="VulnerableCGIBin">
  <Arg id="19" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="VulnerableAlMailPOP3Server">
  <Arg id="20" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="VulnerableSadmind">
  <Arg id="21" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="ExistService">
  <Arg id="22" Pos="1" Attr="varchar(15)"></Arg>
  <Arg id="23" Pos="2" Attr="int"></Arg>
</Predicate>
<Predicate Name="DNS_HInfo">
  <Arg id="24" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="OSSolaris">
  <Arg id="25" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="OSUNIX">
  <Arg id="26" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="DDOSAgainst">
  <Arg id="27" Pos="1" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="GainSMTPInfo">
  <Arg id="28" Pos="1" Attr="varchar(15)"></Arg>
  <Arg id="29" Pos="2" Attr="varchar(15)"></Arg>
</Predicate>
<Predicate Name="SMTPSupportTurn">
  <Arg id="30" Pos="1" Attr="varchar(15)"></Arg>
  <Arg id="31" Pos="2" Attr="varchar(15)"></Arg>
</Predicate>
</Predicates>

<!-- ================= Implications =================== -->
<Implications>
<!--
<Implication>
  <ImplyingName>GainAdmindInfo</ImplyingName>
  <ImpliedName>GainInformation</ImpliedName>
  <ArgMap>
    <ImplyingArg id="5"></ImplyingArg>
    <ImpliedArg id="7"></ImpliedArg>
  </ArgMap>
</Implication>
<Implication>
  <ImplyingName>GainOSInfo</ImplyingName>
  <ImpliedName>GainInformation</ImpliedName>
  <ArgMap>
    <ImplyingArg id="8"></ImplyingArg>
    <ImpliedArg id="7"></ImpliedArg>
  </ArgMap>
</Implication>
<Implication>
  <ImplyingName>GainServiceInfo</ImplyingName>
  <ImpliedName>GainInformation</ImpliedName>
  <ArgMap>
    <ImplyingArg id="9"></ImplyingArg>
    <ImpliedArg id="7"></ImpliedArg>
  </ArgMap>
</Implication>
<Implication>
  <ImplyingName>GainSMTPInfo</ImplyingName>
  <ImpliedName>GainInformation</ImpliedName>
  <ArgMap>
    <ImplyingArg id="10"></ImplyingArg>
    <ImpliedArg id="7"></ImpliedArg>
  </ArgMap>
</Implication>
<Implication>
  <ImplyingName>GainTerminalType</ImplyingName>
  <ImpliedName>GainInformation</ImpliedName>
  <ArgMap>
    <ImplyingArg id="11"></ImplyingArg>
    <ImpliedArg id="7"></ImpliedArg>
  </ArgMap>
</Implication>
-->
<Implication>
  <ImplyingName>GainAccess</ImplyingName>
  <ImpliedName>SystemCompromised</ImpliedName>
  <ArgMap>
    <ImplyingArg id="4"></ImplyingArg>
    <ImpliedArg id="18"></ImpliedArg>
  </ArgMap>
</Implication>
<Implication>
  <ImplyingName>SystemCompromised</ImplyingName>
  <ImpliedName>SystemAttacked</ImpliedName>
  <ArgMap>
    <ImplyingArg id="18"></ImplyingArg>
    <ImpliedArg id="17"></ImpliedArg>
  </ArgMap>
</Implication>
<Implication Phantom="Yes">
  <ImplyingName>GainOSInfo</ImplyingName>
  <ImpliedName>OSSolaris</ImpliedName>
  <ArgMap>
    <ImplyingArg id="8"></ImplyingArg>
    <ImpliedArg id="25"></ImpliedArg>
  </ArgMap>
</Implication>
<Implication Phantom="Yes">
  <ImplyingName>GainOSInfo</ImplyingName>
  <ImpliedName>OSUNIX</ImpliedName>
  <ArgMap>
    <ImplyingArg id="8"></ImplyingArg>
    <ImpliedArg id="26"></ImpliedArg>
  </ArgMap>
</Implication>
<Implication Phantom="Yes">
  <ImplyingName>GainSMTPInfo</ImplyingName>
  <ImpliedName>SMTPSupportTurn</ImpliedName>
  <ArgMap>
    <ImplyingArg id="28"></ImplyingArg>
    <ImpliedArg id="30"></ImpliedArg>
  </ArgMap>
  <ArgMap>
    <ImplyingArg id="29"></ImplyingArg>
    <ImpliedArg id="31"></ImpliedArg>
  </ArgMap>
</Implication>
</Implications>

<!-- ================ Hyper Alert Types ================= -->
<HyperAlertTypes>

<HyperAlertType Name="Admind">
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
<!--  <Prerequisite>
    <Predicate Name="ExistService">
      <Arg id="22" ArgName="DestIPAddress"></Arg>
      <Arg id="23" ArgName="DestPort"></Arg>
    </Predicate> 
    <Predicate Name="OSSolaris">
      <Arg id="25" ArgName="DestIPAddress"></Arg>
    </Predicate> 
    <Predicate Name="VulnerableSadmind">
      <Arg id="21" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="GainAdmindInfo">
      <Arg id="5" ArgName="DestIPAddress"></Arg>
      <Arg id="6" ArgName="DestPort"></Arg>
    </Predicate>
  </Consequence>
-->
</HyperAlertType>


<HyperAlertType Name="DNS_HInfo">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
    <Predicate Name="ExistService">
      <Arg id="22" ArgName="DestIPAddress"></Arg>
      <Arg id="23" ArgName="DestPort"></Arg>
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="GainOSInfo">
      <Arg id="8" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="Email_Almail_Overflow">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
    <Predicate Name="ExistService">
      <Arg id="22" ArgName="DestIPAddress"></Arg>
      <Arg id="23" ArgName="DestPort"></Arg>
    </Predicate> 
    <Predicate Name="VulnerableAlMailPOP3Server">
      <Arg id="20" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="GainAccess">
      <Arg id="4" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="Email_Debug">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
    <Predicate Name="ExistService">
      <Arg id="22" ArgName="DestIPAddress"></Arg>
      <Arg id="23" ArgName="DestPort"></Arg>
    </Predicate> 
    <Predicate Name="SendMailInDebugMode">
      <Arg id="14" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="GainAccess">
      <Arg id="4" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="Email_Ehlo">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
    <Predicate Name="ExistService">
      <Arg id="22" ArgName="DestIPAddress"></Arg>
      <Arg id="23" ArgName="DestPort"></Arg>
    </Predicate> 
    <Predicate Name="SMTPSupportEhlo">
      <Arg id="15" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="GainSMTPInfo">
      <Arg id="28" ArgName="SrcIPAddress"></Arg>
      <Arg id="29" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="Email_Turn">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
    <Predicate Name="ExistService">
      <Arg id="22" ArgName="DestIPAddress"></Arg>
      <Arg id="23" ArgName="DestPort"></Arg>
    </Predicate> 
    <Predicate Name="SMTPSupportTurn">
      <Arg id="30" ArgName="SrcIPAddress"></Arg>
      <Arg id="31" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="MailLeakage">
      <Arg id="13" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="FTP_Pass">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
<!--    <Predicate Name="ExistFTPService">
      <Arg id="3" ArgName="DestIPAddress"></Arg>
    </Predicate> -->
    <Predicate Name="ExistService">
      <Arg id="22" ArgName="DestIPAddress"></Arg>
      <Arg id="23" ArgName="DestPort"></Arg>
    </Predicate> 
  </Prerequisite>
</HyperAlertType>


<HyperAlertType Name="FTP_Put">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
<!--    <Predicate Name="ExistFTPService">
      <Arg id="3" ArgName="DestIPAddress"></Arg>
    </Predicate> -->
    <Predicate Name="ExistService">
      <Arg id="22" ArgName="DestIPAddress"></Arg>
      <Arg id="23" ArgName="DestPort"></Arg>
    </Predicate> 
    <Predicate Name="GainAccess">
      <Arg id="4" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="SystemCompromised">
      <Arg id="18" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="FTP_Syst">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
<!--    <Predicate Name="ExistFTPService">
      <Arg id="3" ArgName="DestIPAddress"></Arg>
    </Predicate> -->
    <Predicate Name="ExistService">
      <Arg id="22" ArgName="DestIPAddress"></Arg>
      <Arg id="23" ArgName="DestPort"></Arg>
    </Predicate> 
  </Prerequisite>
  <Consequence>
    <Predicate Name="GainOSInfo">
      <Arg id="8" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="FTP_User">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
<!--    <Predicate Name="ExistFTPService">
      <Arg id="3" ArgName="DestIPAddress"></Arg>
    </Predicate> -->
    <Predicate Name="ExistService">
      <Arg id="22" ArgName="DestIPAddress"></Arg>
      <Arg id="23" ArgName="DestPort"></Arg>
    </Predicate> 
  </Prerequisite>
</HyperAlertType>

<HyperAlertType Name="HTTP_ActiveX">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
    <Predicate Name="ActiveXEnabledBrowser">
      <Arg id="2" ArgName="SrcIPAddress"></Arg>
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="SystemCompromised">
      <Arg id="18" ArgName="SrcIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="HTTP_Cisco_Catalyst_Exec">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
    <Predicate Name="CiscoCatalyst3500XL">
      <Arg id="1" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="GainAccess">
      <Arg id="4" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="HTTP_Java">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
    <Predicate Name="JavaEnabledBrowser">
      <Arg id="12" ArgName="SrcIPAddress"></Arg>
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="SystemCompromised">
      <Arg id="18" ArgName="SrcIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="HTTP_Shells">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
    <Predicate Name="VulnerableCGIBin">
      <Arg id="19" ArgName="DestIPAddress"></Arg>
    </Predicate>
    <Predicate Name="OSUNIX">
      <Arg id="26" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="GainAccess">
      <Arg id="4" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="Mstream_Zombie">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
    <Predicate Name="SystemCompromised">
      <Arg id="18" ArgName="DestIPAddress"></Arg>
    </Predicate>
    <Predicate Name="SystemCompromised">
      <Arg id="18" ArgName="SrcIPAddress"></Arg>
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="ReadyToLaunchDDOSAttack">
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="Port_Scan">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Consequence>
<!--    <Predicate Name="GainServiceInfo">
      <Arg id="9" ArgName="DestIPAddress"></Arg>
    </Predicate> -->
    <Predicate Name="ExistService">
      <Arg id="22" ArgName="DestIPAddress"></Arg>
      <Arg id="23" ArgName="DestPort"></Arg>
    </Predicate> 
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="RIPAdd">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
</HyperAlertType>

<HyperAlertType Name="RIPExpire">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
</HyperAlertType>

<HyperAlertType Name="Rsh">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
    <Predicate Name="GainAccess">
      <Arg id="4" ArgName="DestIPAddress"></Arg>
    </Predicate>
    <Predicate Name="GainAccess">
      <Arg id="4" ArgName="SrcIPAddress"></Arg>
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="SystemCompromised">
      <Arg id="18" ArgName="DestIPAddress"></Arg>
    </Predicate>
    <Predicate Name="SystemCompromised">
      <Arg id="18" ArgName="SrcIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="Sadmind_Amslverify_Overflow">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
    <Predicate Name="VulnerableSadmind">
      <Arg id="21" ArgName="DestIPAddress"></Arg>
    </Predicate>
    <Predicate Name="OSSolaris">
      <Arg id="25" ArgName="DestIPAddress"></Arg>
    </Predicate> 
<!--    <Predicate Name="GainAccess">
      <Arg id="4" ArgName="SrcIPAddress"></Arg>
    </Predicate> -->
  </Prerequisite>
  <Consequence>
    <Predicate Name="GainAccess">
      <Arg id="4" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="Sadmind_Ping">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
    <Predicate Name="OSSolaris">
      <Arg id="25" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="VulnerableSadmind">
      <Arg id="21" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="SSH_Detected">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Consequence>
<!--    <Predicate Name="GainInformation">
      <Arg id="7" ArgName="DestIPAddress"></Arg>
    </Predicate> -->
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="Stream_DoS">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Prerequisite>
    <Predicate Name="ReadyToLaunchDDOSAttack">
    </Predicate>
  </Prerequisite>
  <Consequence>
    <Predicate Name="DDOSAgainst">
      <Arg id="27" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="TCP_Urgent_Data">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Consequence>
    <Predicate Name="SystemAttacked">
      <Arg id="17" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="TelnetEnvAll">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Consequence>
    <Predicate Name="SystemAttacked">
      <Arg id="17" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="TelnetTerminaltype">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Consequence>
    <Predicate Name="GainTerminalType">
      <Arg id="11" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="TelnetXdisplay">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Consequence>
    <Predicate Name="SystemAttacked">
      <Arg id="17" ArgName="DestIPAddress"></Arg>
    </Predicate>
  </Consequence>
</HyperAlertType>

<HyperAlertType Name="UDP_Port_Scan">
  <Fact FactName="SrcIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="SrcPort" FactType="int"></Fact>
  <Fact FactName="DestIPAddress" FactType="varchar(15)"></Fact>
  <Fact FactName="DestPort" FactType="int"></Fact>
  <Consequence>
<!--    <Predicate Name="GainServiceInfo">
      <Arg id="9" ArgName="DestIPAddress"></Arg>
    </Predicate> -->
    <Predicate Name="ExistService">
      <Arg id="22" ArgName="DestIPAddress"></Arg>
      <Arg id="23" ArgName="DestPort"></Arg>
    </Predicate> 
  </Consequence>
</HyperAlertType>

</HyperAlertTypes>

</KnowledgeBase>