Distributed - KBTA: A Distributed Framework for efficient
computation of Knowledge-based Temporal abstractions
User Manual
Maor Guetta
Arkady Mishiev
Introduction
The KBTA is an Automated Mechanisms that perform Derivation of context-specific, interval-based Abstract
Interpretations (also known as Temporal Abstractions) from raw time-stamped data, by using a domainspecific Knowledge-Base.
Using KBTA method in security domain involves extremely Large amount of computations on temporal raw
data.
The performance of these computations is limited by characteristics of specific machine that running the
KBTA framework.
The DKBTA is a reliable Distributed Framework that manage a parallel processing of KBTA on base of
standalone computation units.
This Framework will have a better performance characteristics and thus will provide the ability of process
KBTA Computations in relevant time periods.
The framework is divided to three parts:
Client
In the clients side lays the user.
The user can be a human or an automated user (computer) that sends KBTA Query to the server.
Server
Basicly, the Server is a coordinator that gets the KBTA Query from the Client, convert the query to several
Working Plans according to the number of the available Computational Units and distribute the Working
Plans to the Computational Units.
The Server waits until getting all the replies for the Working Plans, aggregate them and send the reply for
the KBTA query back to the Client.
Computational Units
The Computational Unit get it's Working Plan from the Server,
compute the KBTA computation and replies the server.
Each Computational Unit have the access to the main Data Base.
System configuration
1. KBTA Unit.
Main class: src.dkbta.DKBTA.java
Input parameters: N/A
Log file configuration: ./files/conf/unit.log4j.properties
Default log file: files/logs/unit.log
Main configuration file: ./files/conf/Conf.ini
Variables in configuration file used to interact with Server and other Units:
SERVER_IP – the IP of the server.
UNITS_REGISTRY_PORT – the port used by server to listen for connections from Units.
2. KBTA Server
Main class: src.dkbta.server.domain.Coordinator
Input parameters: N/A
Log file configuration: ./files/conf/server.log4j.properties
Default log file: files/logs/server.log
Main configuration file: ./files/conf/Conf.ini
Variables in configuration file used to interact with Units and Clients:
UNITS_REGISTRY_PORT – the port used by Server to listen for Units connections.
CLIENTS_REGISTRY_PORT – the port used by Server to listen for Clients connection.
3. KBTA Client
Main class: src. dkbta.client.domain.ClientKBTA
Input Parameters: N/A
Log file configuration: ./files/conf/client.log4j.properties
Default log file: files/logs/client.log
Main configuration file: ./files/conf/Conf.ini
Variables in configuration file used to interact with Server:
SERVER_IP – the IP of the server.
CLIENTS_REGISTRY_PORT – the port used by server to listen for connections from Clients.
Running components
1. KBTA Unit
1. Set configuration parameters as described in System Configuration section
2. Run the main class.
3. KBTA Server
1. Set configuration parameters as described in System Configuration section
2. Run the main class
3. Under File Menu choose Start item
4. KBTA Client
1. Set configuration parameters as described in System Configuration section
2. Run the main class
3. Under File Menu choose Connect item
Submitting a working Plan using KBTA Client
After the Client is started and connected to the Server, in order to submit a Plan press choose button, then
browse to the file representing the plan and click Open.
Once the Plan was submitted, the user will see the states of processing on State and Logs panels.
Using KBTA Server GUI for monitoring process
The Server Monitoring GUI has 3 panels:
1. Logs Panel – allows to low level operations performed by the Server
2. Plans Table – allows to see main details for each Plan received from the Client, such as: Plan_Id,
Client_Id, State, Start time, Finish time.
3. Units table – allows to see all available Units and they state using parameters: Unit_Id, Plan_Id (the
Plan that been processed now), State, Start time, Finish time.