This commit is contained in:
Valentin Brandl 2022-04-22 18:09:22 +02:00
parent a8232b9b58
commit 78fd60fc12
25 changed files with 23440 additions and 313 deletions

Binary file not shown.

Before

Width:  |  Height:  |  Size: 44 KiB

BIN
assets/time_devi.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 29 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 40 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 38 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 24 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 30 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 18 KiB

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

View File

@ -0,0 +1,510 @@
1650563988672274608 , c0 , 2022-04-21 19:59:48.672274608 +0200 CEST m=+45.529809487
1650563991164525033 , c1 , 2022-04-21 19:59:51.164525033 +0200 CEST m=+48.022059902
1650563993666851131 , c2 , 2022-04-21 19:59:53.666851131 +0200 CEST m=+50.524386015
1650563996170135430 , c3 , 2022-04-21 19:59:56.17013543 +0200 CEST m=+53.027670374
1650563998676917621 , c0 , 2022-04-21 19:59:58.676917621 +0200 CEST m=+55.534452535
1650564001164238420 , c1 , 2022-04-21 20:00:01.16423842 +0200 CEST m=+58.021773175
1650564003668169422 , c2 , 2022-04-21 20:00:03.668169422 +0200 CEST m=+60.525704208
1650564006173976023 , c3 , 2022-04-21 20:00:06.173976023 +0200 CEST m=+63.031510762
1650564008676540105 , c0 , 2022-04-21 20:00:08.676540105 +0200 CEST m=+65.534074879
1650564011166821805 , c1 , 2022-04-21 20:00:11.166821805 +0200 CEST m=+68.024356564
1650564013672366318 , c2 , 2022-04-21 20:00:13.672366318 +0200 CEST m=+70.529901065
1650564016175917794 , c3 , 2022-04-21 20:00:16.175917794 +0200 CEST m=+73.033452556
1650564018682444633 , c0 , 2022-04-21 20:00:18.682444633 +0200 CEST m=+75.539979380
1650564021167768638 , c1 , 2022-04-21 20:00:21.167768638 +0200 CEST m=+78.025303386
1650564023673313099 , c2 , 2022-04-21 20:00:23.673313099 +0200 CEST m=+80.530847849
1650564026180837024 , c3 , 2022-04-21 20:00:26.180837024 +0200 CEST m=+83.038371772
1650564028686154134 , c0 , 2022-04-21 20:00:28.686154134 +0200 CEST m=+85.543688875
1650564031170677313 , c1 , 2022-04-21 20:00:31.170677313 +0200 CEST m=+88.028212092
1650564033677074010 , c2 , 2022-04-21 20:00:33.67707401 +0200 CEST m=+90.534608757
1650564036185780140 , c3 , 2022-04-21 20:00:36.18578014 +0200 CEST m=+93.043314887
1650564038690836809 , c0 , 2022-04-21 20:00:38.690836809 +0200 CEST m=+95.548371568
1650564041171640732 , c1 , 2022-04-21 20:00:41.171640732 +0200 CEST m=+98.029175480
1650564043681021118 , c2 , 2022-04-21 20:00:43.681021118 +0200 CEST m=+100.538555866
1650564046187557497 , c3 , 2022-04-21 20:00:46.187557497 +0200 CEST m=+103.045092236
1650564048694013254 , c0 , 2022-04-21 20:00:48.694013254 +0200 CEST m=+105.551548002
1650564051171534651 , c1 , 2022-04-21 20:00:51.171534651 +0200 CEST m=+108.029069388
1650564053685765107 , c2 , 2022-04-21 20:00:53.685765107 +0200 CEST m=+110.543300021
1650564056193527659 , c3 , 2022-04-21 20:00:56.193527659 +0200 CEST m=+113.051062533
1650564058695960342 , c0 , 2022-04-21 20:00:58.695960342 +0200 CEST m=+115.553495211
1650564061174791433 , c1 , 2022-04-21 20:01:01.174791433 +0200 CEST m=+118.032326402
1650564063689107136 , c2 , 2022-04-21 20:01:03.689107136 +0200 CEST m=+120.546642075
1650564066197373735 , c3 , 2022-04-21 20:01:06.197373735 +0200 CEST m=+123.054908694
1650564068696912561 , c0 , 2022-04-21 20:01:08.696912561 +0200 CEST m=+125.554447505
1650564071175436030 , c1 , 2022-04-21 20:01:11.17543603 +0200 CEST m=+128.032970894
1650564073693734752 , c2 , 2022-04-21 20:01:13.693734752 +0200 CEST m=+130.551269616
1650564076202997974 , c3 , 2022-04-21 20:01:16.202997974 +0200 CEST m=+133.060532720
1650564078733787502 , c0 , 2022-04-21 20:01:18.733787502 +0200 CEST m=+135.591322248
1650564081176337992 , c1 , 2022-04-21 20:01:21.176337992 +0200 CEST m=+138.033872738
1650564083696675364 , c2 , 2022-04-21 20:01:23.696675364 +0200 CEST m=+140.554210243
1650564086207237268 , c3 , 2022-04-21 20:01:26.207237268 +0200 CEST m=+143.064772222
1650564088704721141 , c0 , 2022-04-21 20:01:28.704721141 +0200 CEST m=+145.562256025
1650564091178081612 , c1 , 2022-04-21 20:01:31.178081612 +0200 CEST m=+148.035616496
1650564093701700194 , c2 , 2022-04-21 20:01:33.701700194 +0200 CEST m=+150.559235023
1650564096211142661 , c3 , 2022-04-21 20:01:36.211142661 +0200 CEST m=+153.068677545
1650564098707510595 , c0 , 2022-04-21 20:01:38.707510595 +0200 CEST m=+155.565045529
1650564101179986416 , c1 , 2022-04-21 20:01:41.179986416 +0200 CEST m=+158.037521330
1650564103705602660 , c2 , 2022-04-21 20:01:43.70560266 +0200 CEST m=+160.563137574
1650564106218879691 , c3 , 2022-04-21 20:01:46.218879691 +0200 CEST m=+163.076414525
1650564108713426730 , c0 , 2022-04-21 20:01:48.71342673 +0200 CEST m=+165.570961609
1650564111181960286 , c1 , 2022-04-21 20:01:51.181960286 +0200 CEST m=+168.039495125
1650564114769272462 , c2 , 2022-04-21 20:01:54.769272462 +0200 CEST m=+171.626807331
1650564116220270158 , c3 , 2022-04-21 20:01:56.220270158 +0200 CEST m=+173.077805067
1650564118717113326 , c0 , 2022-04-21 20:01:58.717113326 +0200 CEST m=+175.574648210
1650564121181784233 , c1 , 2022-04-21 20:02:01.181784233 +0200 CEST m=+178.039319107
1650564124715399352 , c2 , 2022-04-21 20:02:04.715399352 +0200 CEST m=+181.572934217
1650564126223529421 , c3 , 2022-04-21 20:02:06.223529421 +0200 CEST m=+183.081064305
1650564128721366826 , c0 , 2022-04-21 20:02:08.721366826 +0200 CEST m=+185.578901660
1650564131183781843 , c1 , 2022-04-21 20:02:11.183781843 +0200 CEST m=+188.041316727
1650564133714610194 , c2 , 2022-04-21 20:02:13.714610194 +0200 CEST m=+190.572145079
1650564136226630298 , c3 , 2022-04-21 20:02:16.226630298 +0200 CEST m=+193.084165227
1650564138725201502 , c0 , 2022-04-21 20:02:18.725201502 +0200 CEST m=+195.582736511
1650564141186490077 , c1 , 2022-04-21 20:02:21.186490077 +0200 CEST m=+198.044025016
1650564143718020128 , c2 , 2022-04-21 20:02:23.718020128 +0200 CEST m=+200.575554992
1650564146227607111 , c3 , 2022-04-21 20:02:26.227607111 +0200 CEST m=+203.085142010
1650564148729126418 , c0 , 2022-04-21 20:02:28.729126418 +0200 CEST m=+205.586661362
1650564151187373048 , c1 , 2022-04-21 20:02:31.187373048 +0200 CEST m=+208.044907850
1650564153721970870 , c2 , 2022-04-21 20:02:33.72197087 +0200 CEST m=+210.579505769
1650564156230254475 , c3 , 2022-04-21 20:02:36.230254475 +0200 CEST m=+213.087789354
1650564158735033808 , c0 , 2022-04-21 20:02:38.735033808 +0200 CEST m=+215.592568732
1650564161188578315 , c1 , 2022-04-21 20:02:41.188578315 +0200 CEST m=+218.046113214
1650564163726868023 , c2 , 2022-04-21 20:02:43.726868023 +0200 CEST m=+220.584402947
1650564166236129164 , c3 , 2022-04-21 20:02:46.236129164 +0200 CEST m=+223.093664033
1650564168737716792 , c0 , 2022-04-21 20:02:48.737716792 +0200 CEST m=+225.595251761
1650564171189267131 , c1 , 2022-04-21 20:02:51.189267131 +0200 CEST m=+228.046802080
1650564173730806069 , c2 , 2022-04-21 20:02:53.730806069 +0200 CEST m=+230.588340973
1650564176235115135 , c3 , 2022-04-21 20:02:56.235115135 +0200 CEST m=+233.092650014
1650564178741660184 , c0 , 2022-04-21 20:02:58.741660184 +0200 CEST m=+235.599195137
1650564181188156686 , c1 , 2022-04-21 20:03:01.188156686 +0200 CEST m=+238.045691555
1650564183732709928 , c2 , 2022-04-21 20:03:03.732709928 +0200 CEST m=+240.590244887
1650564186240338098 , c3 , 2022-04-21 20:03:06.240338098 +0200 CEST m=+243.097873037
1650564188747554217 , c0 , 2022-04-21 20:03:08.747554217 +0200 CEST m=+245.605089121
1650564191192136687 , c1 , 2022-04-21 20:03:11.192136687 +0200 CEST m=+248.049671621
1650564193736462738 , c2 , 2022-04-21 20:03:13.736462738 +0200 CEST m=+250.593997607
1650564196245984730 , c3 , 2022-04-21 20:03:16.24598473 +0200 CEST m=+253.103519644
1650564198752478874 , c0 , 2022-04-21 20:03:18.752478874 +0200 CEST m=+255.610013743
1650564201191770072 , c1 , 2022-04-21 20:03:21.191770072 +0200 CEST m=+258.049304991
1650564203740882417 , c2 , 2022-04-21 20:03:23.740882417 +0200 CEST m=+260.598417301
1650564206249812515 , c3 , 2022-04-21 20:03:26.249812515 +0200 CEST m=+263.107347356
1650564208755384406 , c0 , 2022-04-21 20:03:28.755384406 +0200 CEST m=+265.612919153
1650564211192706534 , c1 , 2022-04-21 20:03:31.192706534 +0200 CEST m=+268.050241418
1650564213743528131 , c2 , 2022-04-21 20:03:33.743528131 +0200 CEST m=+270.601063100
1650564216255737266 , c3 , 2022-04-21 20:03:36.255737266 +0200 CEST m=+273.113272061
1650564218759202231 , c0 , 2022-04-21 20:03:38.759202231 +0200 CEST m=+275.616737055
1650564221193833429 , c1 , 2022-04-21 20:03:41.193833429 +0200 CEST m=+278.051368290
1650564223745222655 , c2 , 2022-04-21 20:03:43.745222655 +0200 CEST m=+280.602757604
1650564226261733130 , c3 , 2022-04-21 20:03:46.26173313 +0200 CEST m=+283.119268034
1650564228763026306 , c0 , 2022-04-21 20:03:48.763026306 +0200 CEST m=+285.620561180
1650564231195544314 , c1 , 2022-04-21 20:03:51.195544314 +0200 CEST m=+288.053079237
1650564233759852068 , c2 , 2022-04-21 20:03:53.759852068 +0200 CEST m=+290.617386952
1650564236265686092 , c3 , 2022-04-21 20:03:56.265686092 +0200 CEST m=+293.123221026
1650564238766939283 , c0 , 2022-04-21 20:03:58.766939283 +0200 CEST m=+295.624474162
1650564241196662213 , c1 , 2022-04-21 20:04:01.196662213 +0200 CEST m=+298.054197107
1650564243753269778 , c2 , 2022-04-21 20:04:03.753269778 +0200 CEST m=+300.610804647
1650564246269272493 , c3 , 2022-04-21 20:04:06.269272493 +0200 CEST m=+303.126807261
1650564248771845770 , c0 , 2022-04-21 20:04:08.77184577 +0200 CEST m=+305.629380639
1650564251198452756 , c1 , 2022-04-21 20:04:11.198452756 +0200 CEST m=+308.055987705
1650564253757928190 , c2 , 2022-04-21 20:04:13.75792819 +0200 CEST m=+310.615463129
1650564256273229599 , c3 , 2022-04-21 20:04:16.273229599 +0200 CEST m=+313.130764468
1650564258774814677 , c0 , 2022-04-21 20:04:18.774814677 +0200 CEST m=+315.632349606
1650564261202305275 , c1 , 2022-04-21 20:04:21.202305275 +0200 CEST m=+318.059840059
1650564263763871280 , c2 , 2022-04-21 20:04:23.76387128 +0200 CEST m=+320.621406144
1650564266279200844 , c3 , 2022-04-21 20:04:26.279200844 +0200 CEST m=+323.136735713
1650564268780707947 , c0 , 2022-04-21 20:04:28.780707947 +0200 CEST m=+325.638242816
1650564271202544161 , c1 , 2022-04-21 20:04:31.202544161 +0200 CEST m=+328.060078946
1650564273765564985 , c2 , 2022-04-21 20:04:33.765564985 +0200 CEST m=+330.623099934
1650564276284078284 , c3 , 2022-04-21 20:04:36.284078284 +0200 CEST m=+333.141613121
1650564278780698675 , c0 , 2022-04-21 20:04:38.780698675 +0200 CEST m=+335.638233574
1650564281203954033 , c1 , 2022-04-21 20:04:41.203954033 +0200 CEST m=+338.061488795
1650564283768477012 , c2 , 2022-04-21 20:04:43.768477012 +0200 CEST m=+340.626011901
1650564286288252845 , c3 , 2022-04-21 20:04:46.288252845 +0200 CEST m=+343.145787608
1650564288782331390 , c0 , 2022-04-21 20:04:48.78233139 +0200 CEST m=+345.639866274
1650564291204633631 , c1 , 2022-04-21 20:04:51.204633631 +0200 CEST m=+348.062168399
1650564293773366737 , c2 , 2022-04-21 20:04:53.773366737 +0200 CEST m=+350.630901606
1650564296291687991 , c3 , 2022-04-21 20:04:56.291687991 +0200 CEST m=+353.149222772
1650564298786382375 , c0 , 2022-04-21 20:04:58.786382375 +0200 CEST m=+355.643917239
1650564301208279981 , c1 , 2022-04-21 20:05:01.208279981 +0200 CEST m=+358.065814753
1650564303776141058 , c2 , 2022-04-21 20:05:03.776141058 +0200 CEST m=+360.633675973
1650564306297170519 , c3 , 2022-04-21 20:05:06.297170519 +0200 CEST m=+363.154705428
1650564308791219405 , c0 , 2022-04-21 20:05:08.791219405 +0200 CEST m=+365.648754329
1650564311207685848 , c1 , 2022-04-21 20:05:11.207685848 +0200 CEST m=+368.065220622
1650564313780036413 , c2 , 2022-04-21 20:05:13.780036413 +0200 CEST m=+370.637571317
1650564316299553129 , c3 , 2022-04-21 20:05:16.299553129 +0200 CEST m=+373.157087992
1650564318794224184 , c0 , 2022-04-21 20:05:18.794224184 +0200 CEST m=+375.651759113
1650564321210367129 , c1 , 2022-04-21 20:05:21.210367129 +0200 CEST m=+378.067901907
1650564323783243929 , c2 , 2022-04-21 20:05:23.783243929 +0200 CEST m=+380.640778813
1650564326304480733 , c3 , 2022-04-21 20:05:26.304480733 +0200 CEST m=+383.162015549
1650564328799543785 , c0 , 2022-04-21 20:05:28.799543785 +0200 CEST m=+385.657078533
1650564331211302151 , c1 , 2022-04-21 20:05:31.211302151 +0200 CEST m=+388.068836976
1650564333784834177 , c2 , 2022-04-21 20:05:33.784834177 +0200 CEST m=+390.642368943
1650564336308376969 , c3 , 2022-04-21 20:05:36.308376969 +0200 CEST m=+393.165911732
1650564338799965632 , c0 , 2022-04-21 20:05:38.799965632 +0200 CEST m=+395.657500606
1650564341212329790 , c1 , 2022-04-21 20:05:41.21232979 +0200 CEST m=+398.069864729
1650564343788805626 , c2 , 2022-04-21 20:05:43.788805626 +0200 CEST m=+400.646340505
1650564346314875927 , c3 , 2022-04-21 20:05:46.314875927 +0200 CEST m=+403.172410695
1650564348803916134 , c0 , 2022-04-21 20:05:48.803916134 +0200 CEST m=+405.661451013
1650564351213216955 , c1 , 2022-04-21 20:05:51.213216955 +0200 CEST m=+408.070751821
1650564353792832748 , c2 , 2022-04-21 20:05:53.792832748 +0200 CEST m=+410.650367632
1650564356319475546 , c3 , 2022-04-21 20:05:56.319475546 +0200 CEST m=+413.177010295
1650564358807533625 , c0 , 2022-04-21 20:05:58.807533625 +0200 CEST m=+415.665068397
1650564361214087299 , c1 , 2022-04-21 20:06:01.214087299 +0200 CEST m=+418.071622092
1650564363796641929 , c2 , 2022-04-21 20:06:03.796641929 +0200 CEST m=+420.654176793
1650564366327421457 , c3 , 2022-04-21 20:06:06.327421457 +0200 CEST m=+423.184956223
1650564368813830500 , c0 , 2022-04-21 20:06:08.8138305 +0200 CEST m=+425.671365569
1650564371216819705 , c1 , 2022-04-21 20:06:11.216819705 +0200 CEST m=+428.074354574
1650564373796805384 , c2 , 2022-04-21 20:06:13.796805384 +0200 CEST m=+430.654340150
1650564376324920100 , c3 , 2022-04-21 20:06:16.3249201 +0200 CEST m=+433.182454859
1650564378817359275 , c0 , 2022-04-21 20:06:18.817359275 +0200 CEST m=+435.674894133
1650564381218202296 , c1 , 2022-04-21 20:06:21.218202296 +0200 CEST m=+438.075737138
1650564383799258496 , c2 , 2022-04-21 20:06:23.799258496 +0200 CEST m=+440.656793365
1650564386328784747 , c3 , 2022-04-21 20:06:26.328784747 +0200 CEST m=+443.186319510
1650564388821113597 , c0 , 2022-04-21 20:06:28.821113597 +0200 CEST m=+445.678648486
1650564391219649374 , c1 , 2022-04-21 20:06:31.219649374 +0200 CEST m=+448.077184263
1650564393803197935 , c2 , 2022-04-21 20:06:33.803197935 +0200 CEST m=+450.660732824
1650564396333549820 , c3 , 2022-04-21 20:06:36.33354982 +0200 CEST m=+453.191084583
1650564398826322848 , c0 , 2022-04-21 20:06:38.826322848 +0200 CEST m=+455.683857737
1650564401219588773 , c1 , 2022-04-21 20:06:41.219588773 +0200 CEST m=+458.077123637
1650564403808142770 , c2 , 2022-04-21 20:06:43.80814277 +0200 CEST m=+460.665677634
1650564406340941199 , c3 , 2022-04-21 20:06:46.340941199 +0200 CEST m=+463.198476123
1650564408827960658 , c0 , 2022-04-21 20:06:48.827960658 +0200 CEST m=+465.685495522
1650564411221492994 , c1 , 2022-04-21 20:06:51.221492994 +0200 CEST m=+468.079027879
1650564413811085603 , c2 , 2022-04-21 20:06:53.811085603 +0200 CEST m=+470.668620482
1650564416343641220 , c3 , 2022-04-21 20:06:56.34364122 +0200 CEST m=+473.201176119
1650564418832155794 , c0 , 2022-04-21 20:06:58.832155794 +0200 CEST m=+475.689690703
1650564421222462060 , c1 , 2022-04-21 20:07:01.22246206 +0200 CEST m=+478.079997004
1650564423816031378 , c2 , 2022-04-21 20:07:03.816031378 +0200 CEST m=+480.673566277
1650564426342293853 , c3 , 2022-04-21 20:07:06.342293853 +0200 CEST m=+483.199828722
1650564428835895528 , c0 , 2022-04-21 20:07:08.835895528 +0200 CEST m=+485.693430447
1650564431223141240 , c1 , 2022-04-21 20:07:11.22314124 +0200 CEST m=+488.080676149
1650564433818710271 , c2 , 2022-04-21 20:07:13.818710271 +0200 CEST m=+490.676245174
1650564436346243658 , c3 , 2022-04-21 20:07:16.346243658 +0200 CEST m=+493.203778632
1650564438839109243 , c0 , 2022-04-21 20:07:18.839109243 +0200 CEST m=+495.696644202
1650564441225435100 , c1 , 2022-04-21 20:07:21.2254351 +0200 CEST m=+498.082969989
1650564443821893146 , c2 , 2022-04-21 20:07:23.821893146 +0200 CEST m=+500.679428085
1650564446347184884 , c3 , 2022-04-21 20:07:26.347184884 +0200 CEST m=+503.204719788
1650564448839683208 , c0 , 2022-04-21 20:07:28.839683208 +0200 CEST m=+505.697218077
1650564451225975084 , c1 , 2022-04-21 20:07:31.225975084 +0200 CEST m=+508.083509844
1650564453826531612 , c2 , 2022-04-21 20:07:33.826531612 +0200 CEST m=+510.684066545
1650564456350135459 , c3 , 2022-04-21 20:07:36.350135459 +0200 CEST m=+513.207670348
1650564458844459695 , c0 , 2022-04-21 20:07:38.844459695 +0200 CEST m=+515.701994578
1650564461226909596 , c1 , 2022-04-21 20:07:41.226909596 +0200 CEST m=+518.084444373
1650564463831720346 , c2 , 2022-04-21 20:07:43.831720346 +0200 CEST m=+520.689255235
1650564466353957440 , c3 , 2022-04-21 20:07:46.35395744 +0200 CEST m=+523.211492329
1650564468849274891 , c0 , 2022-04-21 20:07:48.849274891 +0200 CEST m=+525.706809775
1650564471231312106 , c1 , 2022-04-21 20:07:51.231312106 +0200 CEST m=+528.088846975
1650564473834406370 , c2 , 2022-04-21 20:07:53.83440637 +0200 CEST m=+530.691941239
1650564476359158120 , c3 , 2022-04-21 20:07:56.35915812 +0200 CEST m=+533.216692989
1650564478854224116 , c0 , 2022-04-21 20:07:58.854224116 +0200 CEST m=+535.711758882
1650564481231463525 , c1 , 2022-04-21 20:08:01.231463525 +0200 CEST m=+538.088998280
1650564483839077171 , c2 , 2022-04-21 20:08:03.839077171 +0200 CEST m=+540.696612035
1650564486363838976 , c3 , 2022-04-21 20:08:06.363838976 +0200 CEST m=+543.221373860
1650564488855108712 , c0 , 2022-04-21 20:08:08.855108712 +0200 CEST m=+545.712643591
1650564491232910006 , c1 , 2022-04-21 20:08:11.232910006 +0200 CEST m=+548.090444885
1650564493843507186 , c2 , 2022-04-21 20:08:13.843507186 +0200 CEST m=+550.701042070
1650564496365520244 , c3 , 2022-04-21 20:08:16.365520244 +0200 CEST m=+553.223055128
1650564498861321094 , c0 , 2022-04-21 20:08:18.861321094 +0200 CEST m=+555.718855959
1650564501233383052 , c1 , 2022-04-21 20:08:21.233383052 +0200 CEST m=+558.090917916
1650564503848222204 , c2 , 2022-04-21 20:08:23.848222204 +0200 CEST m=+560.705757089
1650564506369484643 , c3 , 2022-04-21 20:08:26.369484643 +0200 CEST m=+563.227019537
1650564508865000255 , c0 , 2022-04-21 20:08:28.865000255 +0200 CEST m=+565.722535144
1650564512235363168 , c1 , 2022-04-21 20:08:32.235363168 +0200 CEST m=+569.092898122
1650564513850849954 , c2 , 2022-04-21 20:08:33.850849954 +0200 CEST m=+570.708384838
1650564516379440073 , c3 , 2022-04-21 20:08:36.379440073 +0200 CEST m=+573.236974997
1650564518867885412 , c0 , 2022-04-21 20:08:38.867885412 +0200 CEST m=+575.725420286
1650564521236181085 , c1 , 2022-04-21 20:08:41.236181085 +0200 CEST m=+578.093715861
1650564523854814503 , c2 , 2022-04-21 20:08:43.854814503 +0200 CEST m=+580.712349442
1650564526378347696 , c3 , 2022-04-21 20:08:46.378347696 +0200 CEST m=+583.235882665
1650564528869633658 , c0 , 2022-04-21 20:08:48.869633658 +0200 CEST m=+585.727168587
1650564531238134584 , c1 , 2022-04-21 20:08:51.238134584 +0200 CEST m=+588.095669473
1650564533859648153 , c2 , 2022-04-21 20:08:53.859648153 +0200 CEST m=+590.717182931
1650564536383264996 , c3 , 2022-04-21 20:08:56.383264996 +0200 CEST m=+593.240799895
1650564538875799406 , c0 , 2022-04-21 20:08:58.875799406 +0200 CEST m=+595.733334305
1650564541238070968 , c1 , 2022-04-21 20:09:01.238070968 +0200 CEST m=+598.095605862
1650564543862719547 , c2 , 2022-04-21 20:09:03.862719547 +0200 CEST m=+600.720254430
1650564546390747083 , c3 , 2022-04-21 20:09:06.390747083 +0200 CEST m=+603.248282022
1650564548879469504 , c0 , 2022-04-21 20:09:08.879469504 +0200 CEST m=+605.737004408
1650564551239003529 , c1 , 2022-04-21 20:09:11.239003529 +0200 CEST m=+608.096538408
1650564553881294528 , c2 , 2022-04-21 20:09:13.881294528 +0200 CEST m=+610.738829462
1650564556392578929 , c3 , 2022-04-21 20:09:16.392578929 +0200 CEST m=+613.250113813
1650564558884369525 , c0 , 2022-04-21 20:09:18.884369525 +0200 CEST m=+615.741904389
1650564561240675906 , c1 , 2022-04-21 20:09:21.240675906 +0200 CEST m=+618.098210770
1650564563869487491 , c2 , 2022-04-21 20:09:23.869487491 +0200 CEST m=+620.727022370
1650564566392766027 , c3 , 2022-04-21 20:09:26.392766027 +0200 CEST m=+623.250300891
1650564568888340741 , c0 , 2022-04-21 20:09:28.888340741 +0200 CEST m=+625.745875610
1650564571241671983 , c1 , 2022-04-21 20:09:31.241671983 +0200 CEST m=+628.099206887
1650564573874222740 , c2 , 2022-04-21 20:09:33.87422274 +0200 CEST m=+630.731757679
1650564576396001773 , c3 , 2022-04-21 20:09:36.396001773 +0200 CEST m=+633.253536658
1650564578891972575 , c0 , 2022-04-21 20:09:38.891972575 +0200 CEST m=+635.749507454
1650564581244533837 , c1 , 2022-04-21 20:09:41.244533837 +0200 CEST m=+638.102068701
1650564583877052882 , c2 , 2022-04-21 20:09:43.877052882 +0200 CEST m=+640.734587656
1650564586399172440 , c3 , 2022-04-21 20:09:46.39917244 +0200 CEST m=+643.256707274
1650564588896929518 , c0 , 2022-04-21 20:09:48.896929518 +0200 CEST m=+645.754464387
1650564591245520630 , c1 , 2022-04-21 20:09:51.24552063 +0200 CEST m=+648.103055534
1650564593881985083 , c2 , 2022-04-21 20:09:53.881985083 +0200 CEST m=+650.739519947
1650564596398366937 , c3 , 2022-04-21 20:09:56.398366937 +0200 CEST m=+653.255901821
1650564598902094242 , c0 , 2022-04-21 20:09:58.902094242 +0200 CEST m=+655.759629126
1650564601247637131 , c1 , 2022-04-21 20:10:01.247637131 +0200 CEST m=+658.105172105
1650564603885941085 , c2 , 2022-04-21 20:10:03.885941085 +0200 CEST m=+660.743476009
1650564606406518420 , c3 , 2022-04-21 20:10:06.40651842 +0200 CEST m=+663.264053409
1650564608905768399 , c0 , 2022-04-21 20:10:08.905768399 +0200 CEST m=+665.763303161
1650564611248655090 , c1 , 2022-04-21 20:10:11.24865509 +0200 CEST m=+668.106190049
1650564613888851331 , c2 , 2022-04-21 20:10:13.888851331 +0200 CEST m=+670.746386260
1650564616410141131 , c3 , 2022-04-21 20:10:16.410141131 +0200 CEST m=+673.267676015
1650564618908695954 , c0 , 2022-04-21 20:10:18.908695954 +0200 CEST m=+675.766230873
1650564621249001990 , c1 , 2022-04-21 20:10:21.24900199 +0200 CEST m=+678.106536934
1650564623893263787 , c2 , 2022-04-21 20:10:23.893263787 +0200 CEST m=+680.750798551
1650564626412880921 , c3 , 2022-04-21 20:10:26.412880921 +0200 CEST m=+683.270415810
1650564628913654213 , c0 , 2022-04-21 20:10:28.913654213 +0200 CEST m=+685.771189127
1650564631251102649 , c1 , 2022-04-21 20:10:31.251102649 +0200 CEST m=+688.108637501
1650564633896469440 , c2 , 2022-04-21 20:10:33.89646944 +0200 CEST m=+690.754004324
1650564636414599691 , c3 , 2022-04-21 20:10:36.414599691 +0200 CEST m=+693.272134570
1650564638917329765 , c0 , 2022-04-21 20:10:38.917329765 +0200 CEST m=+695.774864634
1650564641252848772 , c1 , 2022-04-21 20:10:41.252848772 +0200 CEST m=+698.110383656
1650564643901387342 , c2 , 2022-04-21 20:10:43.901387342 +0200 CEST m=+700.758922234
1650564646414966007 , c3 , 2022-04-21 20:10:46.414966007 +0200 CEST m=+703.272500876
1650564648923243521 , c0 , 2022-04-21 20:10:48.923243521 +0200 CEST m=+705.780778390
1650564651253819072 , c1 , 2022-04-21 20:10:51.253819072 +0200 CEST m=+708.111354011
1650564653904334193 , c2 , 2022-04-21 20:10:53.904334193 +0200 CEST m=+710.761869057
1650564656425441507 , c3 , 2022-04-21 20:10:56.425441507 +0200 CEST m=+713.282976476
1650564658925247748 , c0 , 2022-04-21 20:10:58.925247748 +0200 CEST m=+715.782782612
1650564661255803719 , c1 , 2022-04-21 20:11:01.255803719 +0200 CEST m=+718.113338588
1650564663908196332 , c2 , 2022-04-21 20:11:03.908196332 +0200 CEST m=+720.765731201
1650564666424342270 , c3 , 2022-04-21 20:11:06.42434227 +0200 CEST m=+723.281877159
1650564668929569040 , c0 , 2022-04-21 20:11:08.92956904 +0200 CEST m=+725.787103904
1650564671256917596 , c1 , 2022-04-21 20:11:11.256917596 +0200 CEST m=+728.114452580
1650564673911183474 , c2 , 2022-04-21 20:11:13.911183474 +0200 CEST m=+730.768718311
1650564676426522264 , c3 , 2022-04-21 20:11:16.426522264 +0200 CEST m=+733.284057198
1650564678934034773 , c0 , 2022-04-21 20:11:18.934034773 +0200 CEST m=+735.791569599
1650564681258315296 , c1 , 2022-04-21 20:11:21.258315296 +0200 CEST m=+738.115850185
1650564683915916571 , c2 , 2022-04-21 20:11:23.915916571 +0200 CEST m=+740.773451440
1650564686430745141 , c3 , 2022-04-21 20:11:26.430745141 +0200 CEST m=+743.288280085
1650564688937737302 , c0 , 2022-04-21 20:11:28.937737302 +0200 CEST m=+745.795272266
1650564691264234804 , c1 , 2022-04-21 20:11:31.264234804 +0200 CEST m=+748.121769668
1650564693921300181 , c2 , 2022-04-21 20:11:33.921300181 +0200 CEST m=+750.778835150
1650564696431357151 , c3 , 2022-04-21 20:11:36.431357151 +0200 CEST m=+753.288892050
1650564698942920016 , c0 , 2022-04-21 20:11:38.942920016 +0200 CEST m=+755.800454905
1650564701262217717 , c1 , 2022-04-21 20:11:41.262217717 +0200 CEST m=+758.119752591
1650564703924720298 , c2 , 2022-04-21 20:11:43.924720298 +0200 CEST m=+760.782255061
1650564706431248259 , c3 , 2022-04-21 20:11:46.431248259 +0200 CEST m=+763.288783208
1650564708948549365 , c0 , 2022-04-21 20:11:48.948549365 +0200 CEST m=+765.806084264
1650564711262113473 , c1 , 2022-04-21 20:11:51.262113473 +0200 CEST m=+768.119648342
1650564713928657801 , c2 , 2022-04-21 20:11:53.928657801 +0200 CEST m=+770.786192650
1650564716437713277 , c3 , 2022-04-21 20:11:56.437713277 +0200 CEST m=+773.295248251
1650564718951501664 , c0 , 2022-04-21 20:11:58.951501664 +0200 CEST m=+775.809036456
1650564721262811913 , c1 , 2022-04-21 20:12:01.262811913 +0200 CEST m=+778.120346782
1650564723933584586 , c2 , 2022-04-21 20:12:03.933584586 +0200 CEST m=+780.791119485
1650564726439218714 , c3 , 2022-04-21 20:12:06.439218714 +0200 CEST m=+783.296753583
1650564728957451461 , c0 , 2022-04-21 20:12:08.957451461 +0200 CEST m=+785.814986395
1650564731264898014 , c1 , 2022-04-21 20:12:11.264898014 +0200 CEST m=+788.122432893
1650564733933769049 , c2 , 2022-04-21 20:12:13.933769049 +0200 CEST m=+790.791303954
1650564736444096287 , c3 , 2022-04-21 20:12:16.444096287 +0200 CEST m=+793.301631150
1650564738959340514 , c0 , 2022-04-21 20:12:18.959340514 +0200 CEST m=+795.816875383
1650564741267048789 , c1 , 2022-04-21 20:12:21.267048789 +0200 CEST m=+798.124583638
1650564743937145745 , c2 , 2022-04-21 20:12:23.937145745 +0200 CEST m=+800.794680537
1650564746447727533 , c3 , 2022-04-21 20:12:26.447727533 +0200 CEST m=+803.305262417
1650564748964275139 , c0 , 2022-04-21 20:12:28.964275139 +0200 CEST m=+805.821810003
1650564751265635239 , c1 , 2022-04-21 20:12:31.265635239 +0200 CEST m=+808.123170214
1650564753942853653 , c2 , 2022-04-21 20:12:33.942853653 +0200 CEST m=+810.800388537
1650564756451657512 , c3 , 2022-04-21 20:12:36.451657512 +0200 CEST m=+813.309192381
1650564758969186114 , c0 , 2022-04-21 20:12:38.969186114 +0200 CEST m=+815.826720978
1650564761267485635 , c1 , 2022-04-21 20:12:41.267485635 +0200 CEST m=+818.125020514
1650564763946019432 , c2 , 2022-04-21 20:12:43.946019432 +0200 CEST m=+820.803554301
1650564766456565026 , c3 , 2022-04-21 20:12:46.456565026 +0200 CEST m=+823.314099890
1650564768974117648 , c0 , 2022-04-21 20:12:48.974117648 +0200 CEST m=+825.831652517
1650564771268402999 , c1 , 2022-04-21 20:12:51.268402999 +0200 CEST m=+828.125937883
1650564773948789985 , c2 , 2022-04-21 20:12:53.948789985 +0200 CEST m=+830.806324746
1650564776461060552 , c3 , 2022-04-21 20:12:56.461060552 +0200 CEST m=+833.318595437
1650564778977800046 , c0 , 2022-04-21 20:12:58.977800046 +0200 CEST m=+835.835334930
1650564781270371896 , c1 , 2022-04-21 20:13:01.270371896 +0200 CEST m=+838.127906765
1650564783953912159 , c2 , 2022-04-21 20:13:03.953912159 +0200 CEST m=+840.811447023
1650564786465739487 , c3 , 2022-04-21 20:13:06.465739487 +0200 CEST m=+843.323274371
1650564788981744546 , c0 , 2022-04-21 20:13:08.981744546 +0200 CEST m=+845.839279342
1650564791271055510 , c1 , 2022-04-21 20:13:11.27105551 +0200 CEST m=+848.128590404
1650564793959073403 , c2 , 2022-04-21 20:13:13.959073403 +0200 CEST m=+850.816608217
1650564796468441554 , c3 , 2022-04-21 20:13:16.468441554 +0200 CEST m=+853.325976453
1650564798987633921 , c0 , 2022-04-21 20:13:18.987633921 +0200 CEST m=+855.845168786
1650564801299219471 , c1 , 2022-04-21 20:13:21.299219471 +0200 CEST m=+858.156754340
1650564803961464530 , c2 , 2022-04-21 20:13:23.96146453 +0200 CEST m=+860.818999299
1650564806474064485 , c3 , 2022-04-21 20:13:26.474064485 +0200 CEST m=+863.331599438
1650564808991623109 , c0 , 2022-04-21 20:13:28.991623109 +0200 CEST m=+865.849157875
1650564811273963699 , c1 , 2022-04-21 20:13:31.273963699 +0200 CEST m=+868.131498668
1650564813965437045 , c2 , 2022-04-21 20:13:33.965437045 +0200 CEST m=+870.822971903
1650564816472971903 , c3 , 2022-04-21 20:13:36.472971903 +0200 CEST m=+873.330506852
1650564818995456005 , c0 , 2022-04-21 20:13:38.995456005 +0200 CEST m=+875.852990796
1650564821275859141 , c1 , 2022-04-21 20:13:41.275859141 +0200 CEST m=+878.133393981
1650564823970365145 , c2 , 2022-04-21 20:13:43.970365145 +0200 CEST m=+880.827899908
1650564826478446359 , c3 , 2022-04-21 20:13:46.478446359 +0200 CEST m=+883.335981258
1650564829002886960 , c0 , 2022-04-21 20:13:49.00288696 +0200 CEST m=+885.860421825
1650564831276814984 , c1 , 2022-04-21 20:13:51.276814984 +0200 CEST m=+888.134349918
1650564833973264545 , c2 , 2022-04-21 20:13:53.973264545 +0200 CEST m=+890.830799332
1650564836480838005 , c3 , 2022-04-21 20:13:56.480838005 +0200 CEST m=+893.338372964
1650564839005359250 , c0 , 2022-04-21 20:13:59.00535925 +0200 CEST m=+895.862894032
1650564841277504461 , c1 , 2022-04-21 20:14:01.277504461 +0200 CEST m=+898.135039440
1650564843977027565 , c2 , 2022-04-21 20:14:03.977027565 +0200 CEST m=+900.834562322
1650564846485555331 , c3 , 2022-04-21 20:14:06.485555331 +0200 CEST m=+903.343090265
1650564849009070931 , c0 , 2022-04-21 20:14:09.009070931 +0200 CEST m=+905.866605713
1650564851277419987 , c1 , 2022-04-21 20:14:11.277419987 +0200 CEST m=+908.134954911
1650564853980923650 , c2 , 2022-04-21 20:14:13.98092365 +0200 CEST m=+910.838458529
1650564856489468707 , c3 , 2022-04-21 20:14:16.489468707 +0200 CEST m=+913.347003572
1650564859013954290 , c0 , 2022-04-21 20:14:19.01395429 +0200 CEST m=+915.871489057
1650564861280586739 , c1 , 2022-04-21 20:14:21.280586739 +0200 CEST m=+918.138121608
1650564863983341168 , c2 , 2022-04-21 20:14:23.983341168 +0200 CEST m=+920.840876047
1650564866496203088 , c3 , 2022-04-21 20:14:26.496203088 +0200 CEST m=+923.353737982
1650564869017899099 , c0 , 2022-04-21 20:14:29.017899099 +0200 CEST m=+925.875433878
1650564871280191790 , c1 , 2022-04-21 20:14:31.28019179 +0200 CEST m=+928.137726654
1650564873985767713 , c2 , 2022-04-21 20:14:33.985767713 +0200 CEST m=+930.843302457
1650564876497269458 , c3 , 2022-04-21 20:14:36.497269458 +0200 CEST m=+933.354804327
1650564879022827157 , c0 , 2022-04-21 20:14:39.022827157 +0200 CEST m=+935.880362046
1650564881282363867 , c1 , 2022-04-21 20:14:41.282363867 +0200 CEST m=+938.139898736
1650564883991875875 , c2 , 2022-04-21 20:14:43.991875875 +0200 CEST m=+940.849410613
1650564886501810814 , c3 , 2022-04-21 20:14:46.501810814 +0200 CEST m=+943.359345703
1650564889026616984 , c0 , 2022-04-21 20:14:49.026616984 +0200 CEST m=+945.884151833
1650564891282848759 , c1 , 2022-04-21 20:14:51.282848759 +0200 CEST m=+948.140383593
1650564893994886700 , c2 , 2022-04-21 20:14:53.9948867 +0200 CEST m=+950.852421599
1650564896502187731 , c3 , 2022-04-21 20:14:56.502187731 +0200 CEST m=+953.359722660
1650564899032253488 , c0 , 2022-04-21 20:14:59.032253488 +0200 CEST m=+955.889788432
1650564901284685306 , c1 , 2022-04-21 20:15:01.284685306 +0200 CEST m=+958.142220088
1650564903998548539 , c2 , 2022-04-21 20:15:03.998548539 +0200 CEST m=+960.856083327
1650564906506000487 , c3 , 2022-04-21 20:15:06.506000487 +0200 CEST m=+963.363535238
1650564909036574058 , c0 , 2022-04-21 20:15:09.036574058 +0200 CEST m=+965.894108800
1650564911285614358 , c1 , 2022-04-21 20:15:11.285614358 +0200 CEST m=+968.143149165
1650564914003246756 , c2 , 2022-04-21 20:15:14.003246756 +0200 CEST m=+970.860781509
1650564916510977057 , c3 , 2022-04-21 20:15:16.510977057 +0200 CEST m=+973.368511813
1650564919041523784 , c0 , 2022-04-21 20:15:19.041523784 +0200 CEST m=+975.899058530
1650564921287575786 , c1 , 2022-04-21 20:15:21.287575786 +0200 CEST m=+978.145110543
1650564924003594795 , c2 , 2022-04-21 20:15:24.003594795 +0200 CEST m=+980.861129571
1650564926515648923 , c3 , 2022-04-21 20:15:26.515648923 +0200 CEST m=+983.373183670
1650564929048443565 , c0 , 2022-04-21 20:15:29.048443565 +0200 CEST m=+985.905978314
1650564931288456401 , c1 , 2022-04-21 20:15:31.288456401 +0200 CEST m=+988.145991160
1650564934006015060 , c2 , 2022-04-21 20:15:34.00601506 +0200 CEST m=+990.863549819
1650564936516650593 , c3 , 2022-04-21 20:15:36.516650593 +0200 CEST m=+993.374185337
1650564939051362730 , c0 , 2022-04-21 20:15:39.05136273 +0200 CEST m=+995.908897485
1650564941290226642 , c1 , 2022-04-21 20:15:41.290226642 +0200 CEST m=+998.147761389
1650564944012972418 , c2 , 2022-04-21 20:15:44.012972418 +0200 CEST m=+1000.870507203
1650564946520499122 , c3 , 2022-04-21 20:15:46.520499122 +0200 CEST m=+1003.378033878
1650564949055114130 , c0 , 2022-04-21 20:15:49.05511413 +0200 CEST m=+1005.912648878
1650564951291185411 , c1 , 2022-04-21 20:15:51.291185411 +0200 CEST m=+1008.148720166
1650564954012916286 , c2 , 2022-04-21 20:15:54.012916286 +0200 CEST m=+1010.870451063
1650564956525476382 , c3 , 2022-04-21 20:15:56.525476382 +0200 CEST m=+1013.383011241
1650564959059015501 , c0 , 2022-04-21 20:15:59.059015501 +0200 CEST m=+1015.916550505
1650564961293060953 , c1 , 2022-04-21 20:16:01.293060953 +0200 CEST m=+1018.150595892
1650564964015877703 , c2 , 2022-04-21 20:16:04.015877703 +0200 CEST m=+1020.873412582
1650564966530248148 , c3 , 2022-04-21 20:16:06.530248148 +0200 CEST m=+1023.387783032
1650564969063755938 , c0 , 2022-04-21 20:16:09.063755938 +0200 CEST m=+1025.921290822
1650564971294301773 , c1 , 2022-04-21 20:16:11.294301773 +0200 CEST m=+1028.151836736
1650564974020844956 , c2 , 2022-04-21 20:16:14.020844956 +0200 CEST m=+1030.878379835
1650564976536076171 , c3 , 2022-04-21 20:16:16.536076171 +0200 CEST m=+1033.393611055
1650564979068707450 , c0 , 2022-04-21 20:16:19.06870745 +0200 CEST m=+1035.926242324
1650564981294915312 , c1 , 2022-04-21 20:16:21.294915312 +0200 CEST m=+1038.152450087
1650564984023757376 , c2 , 2022-04-21 20:16:24.023757376 +0200 CEST m=+1040.881292315
1650564986534024566 , c3 , 2022-04-21 20:16:26.534024566 +0200 CEST m=+1043.391559430
1650564989070534204 , c0 , 2022-04-21 20:16:29.070534204 +0200 CEST m=+1045.928069073
1650564991297726723 , c1 , 2022-04-21 20:16:31.297726723 +0200 CEST m=+1048.155261607
1650564994027361696 , c2 , 2022-04-21 20:16:34.027361696 +0200 CEST m=+1050.884896580
1650564996538518786 , c3 , 2022-04-21 20:16:36.538518786 +0200 CEST m=+1053.396053715
1650564999074503491 , c0 , 2022-04-21 20:16:39.074503491 +0200 CEST m=+1055.932038395
1650565001298779683 , c1 , 2022-04-21 20:16:41.298779683 +0200 CEST m=+1058.156314469
1650565004030593379 , c2 , 2022-04-21 20:16:44.030593379 +0200 CEST m=+1060.888128273
1650565006544166479 , c3 , 2022-04-21 20:16:46.544166479 +0200 CEST m=+1063.401701438
1650565009079388490 , c0 , 2022-04-21 20:16:49.07938849 +0200 CEST m=+1065.936923454
1650565011300425951 , c1 , 2022-04-21 20:16:51.300425951 +0200 CEST m=+1068.157960835
1650565014034508732 , c2 , 2022-04-21 20:16:54.034508732 +0200 CEST m=+1070.892043616
1650565016547054186 , c3 , 2022-04-21 20:16:56.547054186 +0200 CEST m=+1073.404589130
1650565019084408395 , c0 , 2022-04-21 20:16:59.084408395 +0200 CEST m=+1075.941943349
1650565021300362184 , c1 , 2022-04-21 20:17:01.300362184 +0200 CEST m=+1078.157897063
1650565024039198634 , c2 , 2022-04-21 20:17:04.039198634 +0200 CEST m=+1080.896733523
1650565026549742846 , c3 , 2022-04-21 20:17:06.549742846 +0200 CEST m=+1083.407277730
1650565029087025960 , c0 , 2022-04-21 20:17:09.08702596 +0200 CEST m=+1085.944560839
1650565031302817488 , c1 , 2022-04-21 20:17:11.302817488 +0200 CEST m=+1088.160352392
1650565034043122688 , c2 , 2022-04-21 20:17:14.043122688 +0200 CEST m=+1090.900657557
1650565036553915932 , c3 , 2022-04-21 20:17:16.553915932 +0200 CEST m=+1093.411450901
1650565039090936308 , c0 , 2022-04-21 20:17:19.090936308 +0200 CEST m=+1095.948471087
1650565041302166383 , c1 , 2022-04-21 20:17:21.302166383 +0200 CEST m=+1098.159701152
1650565044046065920 , c2 , 2022-04-21 20:17:24.04606592 +0200 CEST m=+1100.903600749
1650565046559629131 , c3 , 2022-04-21 20:17:26.559629131 +0200 CEST m=+1103.417164110
1650565049095891409 , c0 , 2022-04-21 20:17:29.095891409 +0200 CEST m=+1105.953426282
1650565051304226992 , c1 , 2022-04-21 20:17:31.304226992 +0200 CEST m=+1108.161761760
1650565054050970490 , c2 , 2022-04-21 20:17:34.05097049 +0200 CEST m=+1110.908505364
1650565056560264720 , c3 , 2022-04-21 20:17:36.56026472 +0200 CEST m=+1113.417799649
1650565059100870069 , c0 , 2022-04-21 20:17:39.100870069 +0200 CEST m=+1115.958404953
1650565061304923125 , c1 , 2022-04-21 20:17:41.304923125 +0200 CEST m=+1118.162457901
1650565064056715026 , c2 , 2022-04-21 20:17:44.056715026 +0200 CEST m=+1120.914249975
1650565066564431466 , c3 , 2022-04-21 20:17:46.564431466 +0200 CEST m=+1123.421966370
1650565069105141951 , c0 , 2022-04-21 20:17:49.105141951 +0200 CEST m=+1125.962676830
1650565071305761042 , c1 , 2022-04-21 20:17:51.305761042 +0200 CEST m=+1128.163295814
1650565074059832681 , c2 , 2022-04-21 20:17:54.059832681 +0200 CEST m=+1130.917367555
1650565076568125679 , c3 , 2022-04-21 20:17:56.568125679 +0200 CEST m=+1133.425660578
1650565079108666694 , c0 , 2022-04-21 20:17:59.108666694 +0200 CEST m=+1135.966201578
1650565081307679271 , c1 , 2022-04-21 20:18:01.307679271 +0200 CEST m=+1138.165214046
1650565084062490139 , c2 , 2022-04-21 20:18:04.062490139 +0200 CEST m=+1140.920025002
1650565086575271500 , c3 , 2022-04-21 20:18:06.5752715 +0200 CEST m=+1143.432806303
1650565089113585825 , c0 , 2022-04-21 20:18:09.113585825 +0200 CEST m=+1145.971120690
1650565091319874136 , c1 , 2022-04-21 20:18:11.319874136 +0200 CEST m=+1148.177408923
1650565094065419443 , c2 , 2022-04-21 20:18:14.065419443 +0200 CEST m=+1150.922954342
1650565096577725601 , c3 , 2022-04-21 20:18:16.577725601 +0200 CEST m=+1153.435260570
1650565099120517210 , c0 , 2022-04-21 20:18:19.12051721 +0200 CEST m=+1155.978052094
1650565101309787631 , c1 , 2022-04-21 20:18:21.309787631 +0200 CEST m=+1158.167322399
1650565104070353425 , c2 , 2022-04-21 20:18:24.070353425 +0200 CEST m=+1160.927888289
1650565106581906484 , c3 , 2022-04-21 20:18:26.581906484 +0200 CEST m=+1163.439441348
1650565109119430100 , c0 , 2022-04-21 20:18:29.1194301 +0200 CEST m=+1165.976964969
1650565111311717857 , c1 , 2022-04-21 20:18:31.311717857 +0200 CEST m=+1168.169252791
1650565114077025369 , c2 , 2022-04-21 20:18:34.077025369 +0200 CEST m=+1170.934560318
1650565116586084641 , c3 , 2022-04-21 20:18:36.586084641 +0200 CEST m=+1173.443619550
1650565119120391297 , c0 , 2022-04-21 20:18:39.120391297 +0200 CEST m=+1175.977926181
1650565121312162946 , c1 , 2022-04-21 20:18:41.312162946 +0200 CEST m=+1178.169697715
1650565124079094699 , c2 , 2022-04-21 20:18:44.079094699 +0200 CEST m=+1180.936629578
1650565126592491124 , c3 , 2022-04-21 20:18:46.592491124 +0200 CEST m=+1183.450025988
1650565129123131612 , c0 , 2022-04-21 20:18:49.123131612 +0200 CEST m=+1185.980666491
1650565131314418868 , c1 , 2022-04-21 20:18:51.314418868 +0200 CEST m=+1188.171953752
1650565134081987424 , c2 , 2022-04-21 20:18:54.081987424 +0200 CEST m=+1190.939522363
1650565136591433279 , c3 , 2022-04-21 20:18:56.591433279 +0200 CEST m=+1193.448968158
1650565139124974956 , c0 , 2022-04-21 20:18:59.124974956 +0200 CEST m=+1195.982509819
1650565141315709381 , c1 , 2022-04-21 20:19:01.315709381 +0200 CEST m=+1198.173244163
1650565144086761781 , c2 , 2022-04-21 20:19:04.086761781 +0200 CEST m=+1200.944296650
1650565146595335567 , c3 , 2022-04-21 20:19:06.595335567 +0200 CEST m=+1203.452870431
1650565149128654156 , c0 , 2022-04-21 20:19:09.128654156 +0200 CEST m=+1205.986188985
1650565151316935909 , c1 , 2022-04-21 20:19:11.316935909 +0200 CEST m=+1208.174470778
1650565154087697945 , c2 , 2022-04-21 20:19:14.087697945 +0200 CEST m=+1210.945232824
1650565156601391733 , c3 , 2022-04-21 20:19:16.601391733 +0200 CEST m=+1213.458926617
1650565159134587317 , c0 , 2022-04-21 20:19:19.134587317 +0200 CEST m=+1215.992122186
1650565161317878693 , c1 , 2022-04-21 20:19:21.317878693 +0200 CEST m=+1218.175413562
1650565164108398297 , c2 , 2022-04-21 20:19:24.108398297 +0200 CEST m=+1220.965933060
1650565166625694778 , c3 , 2022-04-21 20:19:26.625694778 +0200 CEST m=+1223.483229662
1650565169141754090 , c0 , 2022-04-21 20:19:29.14175409 +0200 CEST m=+1225.999288974
1650565171325060297 , c1 , 2022-04-21 20:19:31.325060297 +0200 CEST m=+1228.182595176
1650565174097032414 , c2 , 2022-04-21 20:19:34.097032414 +0200 CEST m=+1230.954567185
1650565176629172129 , c3 , 2022-04-21 20:19:36.629172129 +0200 CEST m=+1233.486707013
1650565179142415858 , c0 , 2022-04-21 20:19:39.142415858 +0200 CEST m=+1235.999950727
1650565181324008680 , c1 , 2022-04-21 20:19:41.32400868 +0200 CEST m=+1238.181543564
1650565184133501250 , c2 , 2022-04-21 20:19:44.13350125 +0200 CEST m=+1240.991036047
1650565186613636271 , c3 , 2022-04-21 20:19:46.613636271 +0200 CEST m=+1243.471171160
1650565189153919174 , c0 , 2022-04-21 20:19:49.153919174 +0200 CEST m=+1246.011454028
1650565191325724440 , c1 , 2022-04-21 20:19:51.32572444 +0200 CEST m=+1248.183259324
1650565194108673137 , c2 , 2022-04-21 20:19:54.108673137 +0200 CEST m=+1250.966207916
1650565196614981444 , c3 , 2022-04-21 20:19:56.614981444 +0200 CEST m=+1253.472516323
1650565199160111893 , c0 , 2022-04-21 20:19:59.160111893 +0200 CEST m=+1256.017646857
1650565201342391751 , c1 , 2022-04-21 20:20:01.342391751 +0200 CEST m=+1258.199926578
1650565204105130440 , c2 , 2022-04-21 20:20:04.10513044 +0200 CEST m=+1260.962665339
1650565206618749918 , c3 , 2022-04-21 20:20:06.618749918 +0200 CEST m=+1263.476284812
1650565209156020383 , c0 , 2022-04-21 20:20:09.156020383 +0200 CEST m=+1266.013555287
1650565211324256681 , c1 , 2022-04-21 20:20:11.324256681 +0200 CEST m=+1268.181791510
1650565214110547289 , c2 , 2022-04-21 20:20:14.110547289 +0200 CEST m=+1270.968082188
1650565216623325222 , c3 , 2022-04-21 20:20:16.623325222 +0200 CEST m=+1273.480860101
1650565219159887292 , c0 , 2022-04-21 20:20:19.159887292 +0200 CEST m=+1276.017422216
1650565221327161666 , c1 , 2022-04-21 20:20:21.327161666 +0200 CEST m=+1278.184696457
1650565224114957807 , c2 , 2022-04-21 20:20:24.114957807 +0200 CEST m=+1280.972492732
1650565226626310069 , c3 , 2022-04-21 20:20:26.626310069 +0200 CEST m=+1283.483844896
1650565229175776622 , c0 , 2022-04-21 20:20:29.175776622 +0200 CEST m=+1286.033311486
1650565231329173653 , c1 , 2022-04-21 20:20:31.329173653 +0200 CEST m=+1288.186708542
1650565234119887725 , c2 , 2022-04-21 20:20:34.119887725 +0200 CEST m=+1290.977422594
1650565236631413578 , c3 , 2022-04-21 20:20:36.631413578 +0200 CEST m=+1293.488948464
1650565239168046701 , c0 , 2022-04-21 20:20:39.168046701 +0200 CEST m=+1296.025581590
1650565241330270277 , c1 , 2022-04-21 20:20:41.330270277 +0200 CEST m=+1298.187805231
1650565244123594354 , c2 , 2022-04-21 20:20:44.123594354 +0200 CEST m=+1300.981129323
1650565246635096368 , c3 , 2022-04-21 20:20:46.635096368 +0200 CEST m=+1303.492631114
1650565249176205293 , c0 , 2022-04-21 20:20:49.176205293 +0200 CEST m=+1306.033740277
1650565251342515004 , c1 , 2022-04-21 20:20:51.342515004 +0200 CEST m=+1308.200049888
1650565254135807732 , c2 , 2022-04-21 20:20:54.135807732 +0200 CEST m=+1310.993342616
1650565256643119020 , c3 , 2022-04-21 20:20:56.64311902 +0200 CEST m=+1313.500653989
1650565259177594819 , c0 , 2022-04-21 20:20:59.177594819 +0200 CEST m=+1316.035129683
1650565261332640065 , c1 , 2022-04-21 20:21:01.332640065 +0200 CEST m=+1318.190174934

View File

@ -1,5 +1,6 @@
#!/usr/bin/env python3 #!/usr/bin/env python3
import statistics
from collections import defaultdict from collections import defaultdict
from typing import Dict from typing import Dict
import matplotlib.pyplot as plt import matplotlib.pyplot as plt
@ -18,13 +19,18 @@ def load_log(path: str) -> Dict[datetime, str]:
def plot_deriv(data: Dict[datetime, str]): def plot_devi(data: Dict[datetime, str]):
diffs = [] diffs = []
per_crawler = defaultdict(list) per_crawler = defaultdict(list)
sor = list(sorted(data.items(), key=lambda kv: kv[0])) sor = list(sorted(data.items(), key=lambda kv: kv[0]))
# c = 0
per_diff = defaultdict(list)
for prev, next in zip(sor, sor[1:]): for prev, next in zip(sor, sor[1:]):
diffs.append(abs(2.5 - (next[0].timestamp() - prev[0].timestamp()))) diff = abs(2.5 - (next[0].timestamp() - prev[0].timestamp()))
diffs.append(diff)
per_crawler[prev[1]].append(prev[0]) per_crawler[prev[1]].append(prev[0])
per_diff[prev[1]].append(diff)
# c = (c + 1) % 4
# expected = [2.5] * len(diffs) # expected = [2.5] * len(diffs)
@ -32,15 +38,34 @@ def plot_deriv(data: Dict[datetime, str]):
# x = [] # x = []
x = [2.5 * x for x in range(len(diffs))] x = [2.5 * x for x in range(len(diffs))]
fig, ax = plt.subplots() fig, ax = plt.subplots()
ax.set_title('Timedelta between crawl events in seconds') ax.set_title('Deviation between crawl events')
# ax.set_ylabel() # ax.set_ylabel()
ax.set_xlabel('Time passed in seconds') ax.set_xlabel('Time passed in seconds')
ax.set_ylabel('Deviation in seconds') ax.set_ylabel('Deviation in seconds')
# ax.plot(x, expected, label='Expected difference') # ax.plot(x, expected, label='Expected difference')
ax.plot(x, diffs, label='Deviation from the expected value') ax.scatter(x, diffs, label='Deviation from the expected value', s=10)
fig.legend() fig.legend()
# plt.show() # plt.show()
plt.savefig('./time_deriv.png') plt.savefig('./time_devi.png')
plt.close()
# x = [2.5 * x for x in range(len(diffs))]
fig, ax = plt.subplots()
ax.set_title('Deviation between crawl events')
# ax.set_ylabel()
ax.set_xlabel('Time passed in seconds')
ax.set_ylabel('Deviation in seconds')
# ax.plot(x, expected, label='Expected difference')
for c, vals in per_diff.items():
# if not c in ['c0', 'c3']:
# continue
x = [10 * x for x in range(len(vals))]
n = int(c[1:])
ax.scatter(x, vals, label=f'Deviation between c{n} and c{(n+1)%4}', s=10)
fig.legend()
# plt.show()
plt.savefig('./xxx.png')
plt.close() plt.close()
for c in per_crawler.keys(): for c in per_crawler.keys():
@ -50,20 +75,22 @@ def plot_deriv(data: Dict[datetime, str]):
devi.append(abs(10 - (nex.timestamp() - pre.timestamp()))) devi.append(abs(10 - (nex.timestamp() - pre.timestamp())))
x = [10 * x for x in range(len(devi))] x = [10 * x for x in range(len(devi))]
fig, ax = plt.subplots() fig, ax = plt.subplots()
ax.plot(x, devi) ax.scatter(x, devi, s=10)
ax.set_title(f'Timedeviation for {c}') ax.set_title(f'Timedeviation for {c}')
ax.set_xlabel('Time passed in seconds') ax.set_xlabel('Time passed in seconds')
ax.set_ylabel('Deviation in seconds') ax.set_ylabel('Deviation in seconds')
plt.savefig(f'./time_deriv_{c}.png') plt.savefig(f'./time_devi_{c}.png')
plt.close() plt.close()
print(f'{c}: {statistics.mean(devi)}')
# for ts in per_crawler[c]: # for ts in per_crawler[c]:
def main(): def main():
data = load_log('./dummy.log') data = load_log('./dummy.log')
plot_deriv(data) plot_devi(data)
if __name__ == '__main__': if __name__ == '__main__':

Binary file not shown.

Before

Width:  |  Height:  |  Size: 46 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 41 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 25 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 26 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 46 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 29 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 38 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 24 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 30 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 18 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 42 KiB

View File

@ -27,7 +27,7 @@ A coordinated operation with help from law enforcement, hosting providers, domai
The monetary value of these botnets directly correlates with the amount of effort botmasters are willing to put into implementing defense mechanisms against take-down attempts. The monetary value of these botnets directly correlates with the amount of effort botmasters are willing to put into implementing defense mechanisms against take-down attempts.
Botnet operators came up with a number of ideas: \acp{dga} use pseudorandomly generated domain names to render simple domain blacklist-based approaches ineffective~\cite{bib:antonakakis_dga_2012} or fast-flux DNS entries, where a large pool of IP addresses is randomly assigned to the \ac{c2} domains to prevent IP based blacklisting and hide the actual \ac{c2} servers~\cite{bib:nazario_as_2008}. Botnet operators came up with a number of ideas: \acp{dga} use pseudorandomly generated domain names to render simple domain blacklist-based approaches ineffective~\cite{bib:antonakakis_dga_2012} or fast-flux DNS entries, where a large pool of IP addresses is randomly assigned to the \ac{c2} domains to prevent IP based blacklisting and hide the actual \ac{c2} servers~\cite{bib:nazario_as_2008}.
Analyzing and shutting down a centralized or decentralized botnet is comparatively easy since the central means of communication (the \ac{c2} IP addresses or domain names, Twitter handles or \ac{irc} channels), can be extracted from the malicious binaries or determined by analyzing network traffic and can therefore be considered publicly known. Analyzing and shutting down a centralized or decentralized botnet is comparatively easy since the central means of communication (the \ac{c2} IP addresses or domain names, Twitter handles, or \ac{irc} channels), can be extracted from the malicious binaries or determined by analyzing network traffic and can therefore be considered publicly known.
A number of botnet operations were taken down by shutting down the \ac{c2} channel~\cite{bib:nadji_beheading_2013, bib:msZloader} and as the defenders upped their game, so did attackers---the concept of \ac{p2p} botnets emerged. A number of botnet operations were taken down by shutting down the \ac{c2} channel~\cite{bib:nadji_beheading_2013, bib:msZloader} and as the defenders upped their game, so did attackers---the concept of \ac{p2p} botnets emerged.
The idea is to build a distributed network without \acp{spof} in the form of \ac{c2} servers as shown in \Fref{fig:p2p}. The idea is to build a distributed network without \acp{spof} in the form of \ac{c2} servers as shown in \Fref{fig:p2p}.
@ -92,8 +92,8 @@ This is achieved by periodically querying their neighbor's neighbors in a proces
\Ac{mm} can be distinguished into two categories: \emph{structured} and \emph{unstructured}~\cite{bib:baileyNextGen}. \Ac{mm} can be distinguished into two categories: \emph{structured} and \emph{unstructured}~\cite{bib:baileyNextGen}.
Structured \ac{p2p} botnets have strict rules for a bot's neighbors based on its unique ID and often use a \ac{dht}, which allows persisting data in a distributed network. Structured \ac{p2p} botnets have strict rules for a bot's neighbors based on its unique ID and often use a \ac{dht}, which allows persisting data in a distributed network.
The \ac{dht} could contain a ordered ring structure of IDs and neighborhood in the structure also means neighborhood in the network, as is the case in the Kademila botnet~\cite{bib:kademlia2002}. The \ac{dht} could contain an ordered ring structure of IDs and neighborhood in the structure also means neighborhood in the network, as is the case in the Kademila botnet~\cite{bib:kademlia2002}.
In \ac{p2p} botnets that employ unstructured \ac{mm} on the other hand, bots ask any peer they know for new peers to connect to, in a process called \emph{peer discovery}. In \ac{p2p} botnets that employ unstructured \ac{mm}, on the other hand, bots ask any peer they know for new peers to connect to, in a process called \emph{peer discovery}.
To enable peers to join a unstructured \ac{p2p} botnets, the malware binaries include hardcoded lists of superpeers for the newly infected systems to connect to. To enable peers to join a unstructured \ac{p2p} botnets, the malware binaries include hardcoded lists of superpeers for the newly infected systems to connect to.
The concept of \emph{churn} describes when a bot becomes unavailable. The concept of \emph{churn} describes when a bot becomes unavailable.
@ -111,7 +111,7 @@ There are two types of churn:
%{{{ formal model %{{{ formal model
\subsection{Formal Model of \Acs*{p2p} Botnets} \subsection{Formal Model of \Acs*{p2p} Botnets}
A \ac{p2p} botnet can be modelled as a digraph A \ac{p2p} botnet can be modeled as a digraph
\begin{align*} \begin{align*}
G &= (V, E) G &= (V, E)
@ -363,7 +363,7 @@ Load balancing allows scaling out, which can be more cost-effective.
This strategy distributes work evenly among crawlers by either naively assigning tasks to the crawlers rotationally or weighted according to their capabilities\todo{1 -- 2 sentences about naive rr?}. This strategy distributes work evenly among crawlers by either naively assigning tasks to the crawlers rotationally or weighted according to their capabilities\todo{1 -- 2 sentences about naive rr?}.
To keep the distribution as even as possible, we keep track of the last crawler a task was assigned to and start with the next in line in the subsequent round of assignments. To keep the distribution as even as possible, we keep track of the last crawler a task was assigned to and start with the next in line in the subsequent round of assignments.
For the sake of simplicity only the bandwidth will be considered as a capability but it can be extended by any shared property between the crawlers, \eg{} available memory or processing power. For the sake of simplicity, only the bandwidth will be considered as a capability but it can be extended by any shared property between the crawlers, \eg{} available memory or processing power.
For a given crawler \(c_i \in C\) let \(cap(c_i)\) be the capability of the crawler. For a given crawler \(c_i \in C\) let \(cap(c_i)\) be the capability of the crawler.
The total available capability is \(B = \sum\limits_{c \in C} cap(c)\). The total available capability is \(B = \sum\limits_{c \in C} cap(c)\).
With \(G\) being the greatest common divisor of all the crawler's capabilities, the weight \(W(c_i) = \frac{cap(c_i)}{G}\). With \(G\) being the greatest common divisor of all the crawler's capabilities, the weight \(W(c_i) = \frac{cap(c_i)}{G}\).
@ -517,7 +517,7 @@ Those crawlers must be scheduled \(o = \frac{\SI{1}{\request}}{\SI{24}{\request\
As can be seen in~\Fref{fig:crawlerTimelineEffective}, each crawler \(C_0\) to \(C_3\) performs only \SI{6}{\request\per\minute} while overall achieving \(\SI{24}{\request\per\minute}\). As can be seen in~\Fref{fig:crawlerTimelineEffective}, each crawler \(C_0\) to \(C_3\) performs only \SI{6}{\request\per\minute} while overall achieving \(\SI{24}{\request\per\minute}\).
Vice versa given an amount of crawlers \(n\) and a request limit \(l\), the effective frequency \(f\) can be maximized to \(f = n \times l\) without hitting the limit \(l\) and being blocked. Vice versa, given an amount of crawlers \(n\) and a request limit \(l\), the effective frequency \(f\) can be maximized to \(f = n \times l\) without hitting the limit \(l\) and being blocked.
Using the example from above with \(l = \SI{6}{\request\per\minute}\) but now only two crawlers \(n = 2\), it is still possible to achieve an effective frequency of \(f = 2 \times \SI{6}{\request\per\minute} = \SI{12}{\request\per\minute}\) with \(o = \frac{\SI{1}{\request}}{\SI{12}{\request\per\minute}} = \SI{5}{s}\): Using the example from above with \(l = \SI{6}{\request\per\minute}\) but now only two crawlers \(n = 2\), it is still possible to achieve an effective frequency of \(f = 2 \times \SI{6}{\request\per\minute} = \SI{12}{\request\per\minute}\) with \(o = \frac{\SI{1}{\request}}{\SI{12}{\request\per\minute}} = \SI{5}{s}\):
@ -568,7 +568,7 @@ With \(v \in V\), \(\text{succ}(v)\) being the set of successors of \(v\) and \(
For the first iteration, the PageRank of all nodes is set to the same initial value. \citeauthor{bib:page_pagerank_1998} argue that when iterating often enough, any value can be chosen~\cite{bib:page_pagerank_1998}. For the first iteration, the PageRank of all nodes is set to the same initial value. \citeauthor{bib:page_pagerank_1998} argue that when iterating often enough, any value can be chosen~\cite{bib:page_pagerank_1998}.
The dampingFactor describes the probability of a person visiting links on the web to continue doing so, when using PageRank to rank websites in search results. The dampingFactor describes the probability of a person visiting links on the web to continue doing so when using PageRank to rank websites in search results.
For simplicity---and since it is not required to model human behavior for automated crawling and ranking---a dampingFactor of \(1.0\) will be used, which simplifies the formula to For simplicity---and since it is not required to model human behavior for automated crawling and ranking---a dampingFactor of \(1.0\) will be used, which simplifies the formula to
\[ \[
@ -584,8 +584,8 @@ Based on this, \emph{SensorRank} is defined as
Since crawlers never respond to peer list requests, they will always be detectable by the described approach but sensors might benefit from the following technique. Since crawlers never respond to peer list requests, they will always be detectable by the described approach but sensors might benefit from the following technique.
The PageRank and SensorRank metric are calculated over the sum of the ranks of a node's predecessors. The PageRank and SensorRank metrics are calculated over the sum of the ranks of a node's predecessors.
We will investigate, how limiting the number of predecessors helps producing inconspicuous ranks for a sensor. We will investigate, how limiting the number of predecessors helps produce inconspicuous ranks for a sensor.
% By responding to peer list requests with plausible data and thereby producing valid outgoing edges from the sensors, we will try to make those metrics less suspicious. % By responding to peer list requests with plausible data and thereby producing valid outgoing edges from the sensors, we will try to make those metrics less suspicious.
To counter the SensorBuster metric, outgoing edges to valid peers from the botnet are required so the sensor does not build a \ac{wcc}. To counter the SensorBuster metric, outgoing edges to valid peers from the botnet are required so the sensor does not build a \ac{wcc}.
@ -636,11 +636,11 @@ In theory, it would be possible to detect churned peers or peers behind carrier-
\begin{itemize} \begin{itemize}
\item A peer might blacklist a sensor which looks exactly the same as a churned peer from the point of view of an uncoordinated sensor. \item A peer might blacklist a sensor that looks exactly the same as a churned peer from the point of view of an uncoordinated sensor.
The coordination backend has more knowledge and can detect this, if another sensor is still contacted by the peer in question. The coordination backend has more knowledge and can detect this if another sensor is still contacted by the peer in question.
\item The coordination backend can include different streams of information to decide which peers to place in the sensor's neighborhood. \item The coordination backend can include different streams of information to decide which peers to place in the sensor's neighborhood.
Knowledge about geolocations, \ac{as} and their IP rotation behavior can be consulted to make better informed choices for neighborhood candidates. Knowledge about geolocations, \ac{as} and their IP rotation behavior can be consulted to make better-informed choices for neighborhood candidates.
\end{itemize} \end{itemize}
@ -659,83 +659,109 @@ To evaluate the strategies from above, we took a snapshot of the Sality~\cite{bi
To evaluate the real-world applicability of IP based partitioning, we will partition the dataset containing \num{1595} distinct IP addresses among \num{2}, \num{4}, \num{6}, and \num{10} crawlers and verify if the work is about evenly distributed between crawlers. To evaluate the real-world applicability of IP based partitioning, we will partition the dataset containing \num{1595} distinct IP addresses among \num{2}, \num{4}, \num{6}, and \num{10} crawlers and verify if the work is about evenly distributed between crawlers.
We will compare the variance \(\sigma^2\) and standard derivation \(\sigma\) to evaluate the applicability of this method. We will compare the variance \(\sigma^2\) and standard deviation \(\sigma\) to evaluate the applicability of this method.
%{{{ fig:ipPartC02 \begin{landscape}
\begin{figure}[H] \begin{figure}[H]
\begin{subfigure}[b]{.6\textwidth}
\centering \centering
\includegraphics[width=1\linewidth]{ip_part_c02.png} \includegraphics[width=1\linewidth]{ip_part_c02.png}
\caption{IP based partitioning for 2 crawlers}\label{fig:ipPartC02} % \caption{IP based partitioning for 2 crawlers}\label{fig:ipPartC02}
\begin{align*} \end{subfigure}%
n &= 2 \\ \begin{subfigure}[b]{.6\textwidth}
\mu &= \frac{1595}{n} = 797.5 \\
s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
&= {(808 - 797.5)}^2 + {(787 - 797.5)}^2 \\
&= 220.5 \\
\sigma^2 &= \frac{s}{n} = 110.2 \\
\sigma &= \sqrt{\sigma^2} = 10.5
\end{align*}
\end{figure}
%}}}fig:ipPartC02
%{{{ fig:ipPartC04
\begin{figure}[H]
\centering \centering
\includegraphics[width=1\linewidth]{ip_part_c04.png} \includegraphics[width=1\linewidth]{ip_part_c04.png}
\caption{IP based partitioning for 4 crawlers}\label{fig:ipPartC04} % \caption{IP based partitioning for 2 crawlers}\label{fig:ipPartC02}
\begin{align*} \end{subfigure}%
n &= 4 \\ \hfill
\mu &= \frac{1595}{n} = 398.8 \\ \begin{subfigure}[b]{.6\textwidth}
s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
&= {(403 - 398.8)}^2 + {(369 - 398.8)}^2 + {(405 - 398.8)}^2 \\
&+ {(418 - 398.8)}^2 \\
&= 1312.8 \\
\sigma^2 &= \frac{s}{n} = 328.2 \\
\sigma &= \sqrt{\sigma^2} = 18.1
\end{align*}
\end{figure}
%}}}fig:ipPartC04
%{{{ fig:ipPartC06
\begin{figure}[H]
\centering \centering
\includegraphics[width=1\linewidth]{ip_part_c06.png} \includegraphics[width=1\linewidth]{ip_part_c06.png}
\caption{IP based partitioning for 6 crawlers}\label{fig:ipPartC06} % \caption{IP based partitioning for 2 crawlers}\label{fig:ipPartC02}
\begin{align*} \end{subfigure}%
n &= 6 \\ \begin{subfigure}[b]{.6\textwidth}
\mu &= \frac{1595}{n} = 265.8 \\
s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
&= {(258 - 265.8)}^2 + {(273 - 265.8)}^2 + {(257 - 265.8)}^2 \\
&+ {(264 - 265.8)}^2 + {(293 - 265.8)}^2 + {(250 - 265.8)}^2 \\
&= 1182.8 \\
\sigma^2 &= \frac{s}{n} = 197.1 \\
\sigma &= \sqrt{\sigma^2} = 14.0
\end{align*}
\end{figure}
%}}}fig:ipPartC06
%{{{ fig:ipPartC10
\begin{figure}[H]
\centering \centering
\includegraphics[width=1\linewidth]{ip_part_c10.png} \includegraphics[width=1\linewidth]{ip_part_c10.png}
\caption{IP based partitioning for 10 crawlers}\label{fig:ipPartC10} \end{subfigure}%
\begin{align*} \caption{IP based partitioning}\label{fig:ipPart}
n &= 10 \\
\mu &= \frac{1595}{n} = 159.5 \\
s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
&= {(140 - 159.5)}^2 + {(175 - 159.5)}^2 + {(186 - 159.5)}^2 \\
&+ {(166 - 159.5)}^2 + {(159 - 159.5)}^2 + {(152 - 159.5)}^2 \\
&+ {(172 - 159.5)}^2 + {(148 - 159.5)}^2 + {(151 - 159.5)}^2 \\
&+ {(146 - 159.5)}^2 \\
&= 1964.5 \\
\sigma^2 &= \frac{s}{n} = 196.4 \\
\sigma &= \sqrt{\sigma^2} = 14.0
\end{align*}
\end{figure} \end{figure}
%}}}fig:ipPartC10 \end{landscape}
%%{{{ fig:ipPartC02
%\begin{figure}[H]
%\centering
%\includegraphics[width=1\linewidth]{ip_part_c02.png}
%\caption{IP based partitioning for 2 crawlers}\label{fig:ipPartC02}
%\begin{align*}
% n &= 2 \\
% \mu &= \frac{1595}{n} = 797.5 \\
% s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
% &= {(808 - 797.5)}^2 + {(787 - 797.5)}^2 \\
% &= 220.5 \\
% \sigma^2 &= \frac{s}{n} = 110.2 \\
% \sigma &= \sqrt{\sigma^2} = 10.5
%\end{align*}
%\end{figure}
%%}}}fig:ipPartC02
%%{{{ fig:ipPartC04
%\begin{figure}[H]
%\centering
%\includegraphics[width=1\linewidth]{ip_part_c04.png}
%\caption{IP based partitioning for 4 crawlers}\label{fig:ipPartC04}
%\begin{align*}
% n &= 4 \\
% \mu &= \frac{1595}{n} = 398.8 \\
% s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
% &= {(403 - 398.8)}^2 + {(369 - 398.8)}^2 + {(405 - 398.8)}^2 \\
% &+ {(418 - 398.8)}^2 \\
% &= 1312.8 \\
% \sigma^2 &= \frac{s}{n} = 328.2 \\
% \sigma &= \sqrt{\sigma^2} = 18.1
%\end{align*}
%\end{figure}
%%}}}fig:ipPartC04
%%{{{ fig:ipPartC06
%\begin{figure}[H]
%\centering
%\includegraphics[width=1\linewidth]{ip_part_c06.png}
%\caption{IP based partitioning for 6 crawlers}\label{fig:ipPartC06}
%\begin{align*}
% n &= 6 \\
% \mu &= \frac{1595}{n} = 265.8 \\
% s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
% &= {(258 - 265.8)}^2 + {(273 - 265.8)}^2 + {(257 - 265.8)}^2 \\
% &+ {(264 - 265.8)}^2 + {(293 - 265.8)}^2 + {(250 - 265.8)}^2 \\
% &= 1182.8 \\
% \sigma^2 &= \frac{s}{n} = 197.1 \\
% \sigma &= \sqrt{\sigma^2} = 14.0
%\end{align*}
%\end{figure}
%%}}}fig:ipPartC06
%%{{{ fig:ipPartC10
%\begin{figure}[H]
%\centering
%\includegraphics[width=1\linewidth]{ip_part_c10.png}
%\caption{IP based partitioning for 10 crawlers}\label{fig:ipPartC10}
%\begin{align*}
% n &= 10 \\
% \mu &= \frac{1595}{n} = 159.5 \\
% s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
% &= {(140 - 159.5)}^2 + {(175 - 159.5)}^2 + {(186 - 159.5)}^2 \\
% &+ {(166 - 159.5)}^2 + {(159 - 159.5)}^2 + {(152 - 159.5)}^2 \\
% &+ {(172 - 159.5)}^2 + {(148 - 159.5)}^2 + {(151 - 159.5)}^2 \\
% &+ {(146 - 159.5)}^2 \\
% &= 1964.5 \\
% \sigma^2 &= \frac{s}{n} = 196.4 \\
% \sigma &= \sqrt{\sigma^2} = 14.0
%\end{align*}
%\end{figure}
%%}}}fig:ipPartC10
\begin{table}[H] \begin{table}[H]
\centering \centering
@ -746,89 +772,116 @@ We will compare the variance \(\sigma^2\) and standard derivation \(\sigma\) to
\num{6} & 265.8 & 197.1 & 14.0 & 5.3\% \\ \num{6} & 265.8 & 197.1 & 14.0 & 5.3\% \\
\num{10} & 159.5 & 196.4 & 14.0 & 8.8\% \\ \num{10} & 159.5 & 196.4 & 14.0 & 8.8\% \\
\end{tabular} \end{tabular}
\caption{Variance and standard derivation for IP-based partitioning on \num{1595} IP addresses}\label{tab:varSmall} \caption{Variance and standard deviation for IP-based partitioning on \num{1595} IP addresses}\label{tab:varSmall}
\end{table} \end{table}
\Fref{tab:varSmall} shows that the derivation from the expected even distribution is within \SI{10}{\percent}. \Fref{tab:varSmall} shows that the deviation from the expected even distribution is within \SI{10}{\percent}.
Since the used sample is not very big, according to the law of big numbers we would expect the derivation to get smaller, the bigger the sample gets. Since the used sample is not very big, according to the law of big numbers we would expect the deviation to get smaller, the bigger the sample gets.
Therefore, we simulate the partitioning on a bigger sample of \num{1000000} random IP addresses. Therefore, we simulate the partitioning on a bigger sample of \num{1000000} random IP addresses.
%{{{ fig:randIpPartC02 \begin{landscape}
\begin{figure}[H] \begin{figure}[H]
\begin{subfigure}[b]{.6\textwidth}
\centering \centering
\includegraphics[width=1\linewidth]{rand_ip_part_c02.png} \includegraphics[width=1\linewidth]{rand_ip_part_c02.png}
\caption{IP based partitioning for 2 crawlers on generated dataset}\label{fig:randIpPartC02} % \caption{IP based partitioning for 2 crawlers}\label{fig:ipPartC02}
\begin{align*} \end{subfigure}%
n &= 2 \\ \begin{subfigure}[b]{.6\textwidth}
\mu &= \frac{1000000}{n} = 500000 \\
s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
&= {(499322 - 500000)}^2 + {(500678 - 500000)}^2 \\
&= 919368 \\
\sigma^2 &= \frac{s}{n} = 459684 \\
\sigma &= \sqrt{\sigma^2} = 678
\end{align*}
\end{figure}
%}}}fig:randIpPartC02
%{{{ fig:randIpPartC04
\begin{figure}[H]
\centering \centering
\includegraphics[width=1\linewidth]{rand_ip_part_c04.png} \includegraphics[width=1\linewidth]{rand_ip_part_c04.png}
\caption{IP based partitioning for 4 crawlers on generated dataset}\label{fig:randIpPartC04} % \caption{IP based partitioning for 2 crawlers}\label{fig:ipPartC02}
\begin{align*} \end{subfigure}%
n &= 4 \\ \hfill
\mu &= \frac{1000000}{n} = 250000 \\ \begin{subfigure}[b]{.6\textwidth}
s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
&= {(249504 - 250000)}^2 + {(250451 - 250000)}^2 + {(249818 - 250000)}^2 \\
&+ {(250227 - 250000)}^2 \\
&= 534070 \\
\sigma^2 &= \frac{s}{n} = 133517.5 \\
\sigma &= \sqrt{\sigma^2} = 365.4
\end{align*}
\end{figure}
%}}}fig:randIpPartC04
%{{{ fig:randIpPartC06
\begin{figure}[H]
\centering \centering
\includegraphics[width=1\linewidth]{rand_ip_part_c06.png} \includegraphics[width=1\linewidth]{rand_ip_part_c06.png}
\caption{IP based partitioning for 6 crawlers on generated dataset}\label{fig:randIpPartC06} % \caption{IP based partitioning for 2 crawlers}\label{fig:ipPartC02}
\begin{align*} \end{subfigure}%
n &= 6 \\ \begin{subfigure}[b]{.6\textwidth}
\mu &= \frac{1000000}{n} = 166666.7 \\
s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
&= {(166430 - 166666.7)}^2 + {(166861 - 166666.7)}^2 + {(166269 - 166666.7)}^2 \\
&+ {(166937 - 166666.7)}^2 + {(166623 - 166666.7)}^2 + {(166880 - 166666.7)}^2 \\
&= 372413.3 \\
\sigma^2 &= \frac{s}{n} = 62068.9 \\
\sigma &= \sqrt{\sigma^2} = 249.1
\end{align*}
\end{figure}
%}}}fig:randIpPartC06
%{{{ fig:randIpPartC10
\begin{figure}[H]
\centering \centering
\includegraphics[width=1\linewidth]{rand_ip_part_c10.png} \includegraphics[width=1\linewidth]{rand_ip_part_c10.png}
\caption{IP based partitioning for 10 crawlers on generated dataset}\label{fig:randIpPartC10} % \caption{IP based partitioning for 2 crawlers}\label{fig:ipPartC02}
\begin{align*} \end{subfigure}%
n &= 10 \\ \caption{IP based partitioning for crawlers on generated dataset}\label{fig:randIpPart}
\mu &= \frac{1000000}{n} = 100000 \\
s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
&= {(100424 - 100000)}^2 + {(99650 - 100000)}^2 + {(99307 - 100000)}^2 \\
&+ {(100305 - 100000)}^2 + {(99403 - 100000)}^2 + {(100562 - 100000)}^2 \\
&+ {(100277 - 100000)}^2 + {(99875 - 100000)}^2 + {(99911 - 100000)}^2 \\
&+ {(100286 - 100000)}^2 \\
&= 1729874 \\
\sigma^2 &= \frac{s}{n} = 172987.4 \\
\sigma &= \sqrt{\sigma^2} = 415.9
\end{align*}
\end{figure} \end{figure}
%}}}fig:randIpPartC10 \end{landscape}
%%{{{ fig:randIpPartC02
%\begin{figure}[H]
%\centering
%\includegraphics[width=1\linewidth]{rand_ip_part_c02.png}
%\caption{IP based partitioning for 2 crawlers on generated dataset}\label{fig:randIpPartC02}
%\begin{align*}
% n &= 2 \\
% \mu &= \frac{1000000}{n} = 500000 \\
% s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
% &= {(499322 - 500000)}^2 + {(500678 - 500000)}^2 \\
% &= 919368 \\
% \sigma^2 &= \frac{s}{n} = 459684 \\
% \sigma &= \sqrt{\sigma^2} = 678
%\end{align*}
%\end{figure}
%%}}}fig:randIpPartC02
%%{{{ fig:randIpPartC04
%\begin{figure}[H]
%\centering
%\includegraphics[width=1\linewidth]{rand_ip_part_c04.png}
%\caption{IP based partitioning for 4 crawlers on generated dataset}\label{fig:randIpPartC04}
%\begin{align*}
% n &= 4 \\
% \mu &= \frac{1000000}{n} = 250000 \\
% s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
% &= {(249504 - 250000)}^2 + {(250451 - 250000)}^2 + {(249818 - 250000)}^2 \\
% &+ {(250227 - 250000)}^2 \\
% &= 534070 \\
% \sigma^2 &= \frac{s}{n} = 133517.5 \\
% \sigma &= \sqrt{\sigma^2} = 365.4
%\end{align*}
%\end{figure}
%%}}}fig:randIpPartC04
%%{{{ fig:randIpPartC06
%\begin{figure}[H]
%\centering
%\includegraphics[width=1\linewidth]{rand_ip_part_c06.png}
%\caption{IP based partitioning for 6 crawlers on generated dataset}\label{fig:randIpPartC06}
%\begin{align*}
% n &= 6 \\
% \mu &= \frac{1000000}{n} = 166666.7 \\
% s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
% &= {(166430 - 166666.7)}^2 + {(166861 - 166666.7)}^2 + {(166269 - 166666.7)}^2 \\
% &+ {(166937 - 166666.7)}^2 + {(166623 - 166666.7)}^2 + {(166880 - 166666.7)}^2 \\
% &= 372413.3 \\
% \sigma^2 &= \frac{s}{n} = 62068.9 \\
% \sigma &= \sqrt{\sigma^2} = 249.1
%\end{align*}
%\end{figure}
%%}}}fig:randIpPartC06
%%{{{ fig:randIpPartC10
%\begin{figure}[H]
%\centering
%\includegraphics[width=1\linewidth]{rand_ip_part_c10.png}
%\caption{IP based partitioning for 10 crawlers on generated dataset}\label{fig:randIpPartC10}
%\begin{align*}
% n &= 10 \\
% \mu &= \frac{1000000}{n} = 100000 \\
% s &= \sum\limits_{i=1}^{n} {(x_i - \mu)}^2 \\
% &= {(100424 - 100000)}^2 + {(99650 - 100000)}^2 + {(99307 - 100000)}^2 \\
% &+ {(100305 - 100000)}^2 + {(99403 - 100000)}^2 + {(100562 - 100000)}^2 \\
% &+ {(100277 - 100000)}^2 + {(99875 - 100000)}^2 + {(99911 - 100000)}^2 \\
% &+ {(100286 - 100000)}^2 \\
% &= 1729874 \\
% \sigma^2 &= \frac{s}{n} = 172987.4 \\
% \sigma &= \sqrt{\sigma^2} = 415.9
%\end{align*}
%\end{figure}
%%}}}fig:randIpPartC10
\begin{table}[H] \begin{table}[H]
@ -840,11 +893,11 @@ Therefore, we simulate the partitioning on a bigger sample of \num{1000000} rand
\num{6} & 166666.7 & 62069.9 & 249.1 & 0.15\% \\ \num{6} & 166666.7 & 62069.9 & 249.1 & 0.15\% \\
\num{10} & 100000.0 & 172987.4 & 415.9 & 0.42\% \\ \num{10} & 100000.0 & 172987.4 & 415.9 & 0.42\% \\
\end{tabular} \end{tabular}
\caption{Variance and standard derivation for IP-based partitioning on \num{1000000} IP addresses}\label{tab:varBig} \caption{Variance and standard deviation for IP-based partitioning on \num{1000000} IP addresses}\label{tab:varBig}
\end{table} \end{table}
As expected, the work is still not perfectly distributed among the crawlers but evenly enough for our use case. As expected, the work is still not perfectly distributed among the crawlers but evenly enough for our use case.
The derivation for larger botnets is within \SI{0.5}{\percent} of the even distribution. The deviation for larger botnets is expected to be within \SI{0.5}{\percent} of the even distribution.
This is good enough for balancing the tasks among workers. This is good enough for balancing the tasks among workers.
%}}} eval load balancing %}}} eval load balancing
@ -853,7 +906,7 @@ This is good enough for balancing the tasks among workers.
\subsection{Reduction of Request Frequency} \subsection{Reduction of Request Frequency}
To evaluate the request frequency optimization described in \Fref{sec:stratRedReqFreq}, crawl a simulated peer and check if the requests are evenly distributed and how big the deviation from the theoretically optimal result is. To evaluate the request frequency optimization described in \Fref{sec:stratRedReqFreq}, crawl a simulated peer and check if the requests are evenly distributed and how big the deviation from the theoretically optimal result is.
To get more realistic results, the crawlers and simulated peer are running on different machines so they are not within the same LAN. To get more realistic results, the crawlers and simulated peer are running on different machines so they are not within the same LAN\@.
We use the same parameters as in the example above: We use the same parameters as in the example above:
\begin{align*} \begin{align*}
@ -899,17 +952,64 @@ To recap, this is what the optimal timeline would look like:
\end{center} \end{center}
The ideal distribution would be \SI{2.5}{\second} between each two events. The ideal distribution would be \SI{2.5}{\second} between every two events.
Due to network latency and load from crawling other peers, we expect the actual result to deviate from the optimal value over time. Due to network latency and load from crawling other peers, we expect the actual result to deviate from the optimal value over time.
With this experiment we try to estimate the impact of the latency. With this experiment, we try to estimate the impact of the latency.
If it is existent and measurable the crawlers have to be rescheduled periodically to keep the deviation at an acceptable level.
\begin{figure}[H] \begin{figure}[H]
\centering \centering
\includegraphics[width=1\linewidth]{time_deriv.png} \includegraphics[width=1\linewidth]{time_devi.png}
\caption{Derivation from the expected interval}\label{fig:timeDeriv} \caption{Deviation from the expected interval}\label{fig:timeDevi}
\end{figure} \end{figure}
\begin{landscape}
\begin{figure}[H]
\centering
\begin{subfigure}[b]{.6\textwidth}
\centering
\includegraphics[width=1\linewidth]{time_deviation/time_devi_c0.png}
\end{subfigure}%
\begin{subfigure}[b]{.6\textwidth}
\centering
\includegraphics[width=1\linewidth]{time_deviation/time_devi_c1.png}
\end{subfigure}%
\hfill
\begin{subfigure}[b]{.6\textwidth}
\centering
\includegraphics[width=1\linewidth]{time_deviation/time_devi_c2.png}
\end{subfigure}%
\begin{subfigure}[b]{.6\textwidth}
\centering
\includegraphics[width=1\linewidth]{time_deviation/time_devi_c3.png}
\end{subfigure}%
\caption{Derivation from the expected interval per crawler}\label{fig:perCralwerDeviation}
\end{figure}
\end{landscape}
The deviation between crawl events per crawler is below \SI{0.01}{\second} most of the time, with occasional outliers due to network latency or server load.
\begin{table}[H]
\centering
\begin{tabular}{rr}
\textbf{Crawler} & \textbf{Average Deviation} \\
c0 & \num{0.0005927812081134085} \\
c1 & \num{0.0003700713297978895} \\
c2 & \num{0.0006121075253902246} \\
c3 & \num{0.0020807891511268814} \\
\end{tabular}
\caption{Average deviation per crawler}\label{tab:perCralwerDeviation}
\end{table}
The average deviation per crawler is below \SI{0.002}{\second} even with some huge outliers. In general it is below \SI{0.0007}{\second}, which is a surprisingly accurate result.
In real-world scenarios, crawlers will monitor more than a single peer and the scheduling is expected to be less accurate.
Still, the deviation will always stay below the effective frequency \(f\), because after exceeding \(f\), a crawler is overtaken by the next in line.
The impact of the deviation when crawling real-world botnets has to be investigated and if it shows to be a problem, the tasks have to be rescheduled periodically to prevent this from happening.
% \begin{figure}[H]
% \centering
% \includegraphics[width=1\linewidth]{time_devi_overtake.png}
% \end{figure}
%}}} eval redu requ freq %}}} eval redu requ freq
@ -920,8 +1020,8 @@ If it is existent and measurable the crawlers have to be rescheduled periodicall
\subsubsection{Use Other Known Sensors} \subsubsection{Use Other Known Sensors}
By connecting the known sensors and effectively building a complete graph \(K_{\abs{C}}\) between them creates \(\abs{C} - 1\) outgoing edges per sensor. By connecting the known sensors and effectively building a complete graph \(K_{\abs{C}}\) between them creates \(\abs{C} - 1\) outgoing edges per sensor.
In most cases this won't be enough to reach the amount of edges that would be needed. In most cases, this won't be enough to reach the number of edges that would be needed.
Also this does not help against the \ac{wcc} metric since this would create a bigger but still disconnected component. Also, this does not help against the \ac{wcc} metric since this would create a bigger but still disconnected component.
% TODO: caption, label % TODO: caption, label
\begin{figure}[H] \begin{figure}[H]
@ -988,7 +1088,7 @@ For the \ac{wcc} metric, it is obvious that even a single edge back into the mai
\subsubsection{Effectiveness against Page- and SensorRank} \subsubsection{Effectiveness against Page- and SensorRank}
In this section we will evaluate how adding outgoing edges to a sensor impacts it's PageRank and SensorRank values. In this section, we will evaluate how adding outgoing edges to a sensor impacts its PageRank and SensorRank values.
Before doing so, we will check the impact of the initial rank by calculating it with different initial values and comparing the value distribution of the result. Before doing so, we will check the impact of the initial rank by calculating it with different initial values and comparing the value distribution of the result.
\begin{table}[H] \begin{table}[H]
@ -1075,173 +1175,102 @@ Before doing so, we will check the impact of the initial rank by calculating it
\caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}_0(v) = 0.75\)}\label{fig:dist_sr_75} \caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}_0(v) = 0.75\)}\label{fig:dist_sr_75}
\end{figure} \end{figure}
The distribution graphs in \Fref{fig:dist_sr_25}, \Fref{fig:dist_sr_50} and \Fref{fig:dist_sr_75} show that the initial rank has no effect on the distribution, only on the actual numeric rank values and how far apart they are spread. The distribution graphs in \Fref{fig:dist_sr_25}, \Fref{fig:dist_sr_50}, and \Fref{fig:dist_sr_75} show that the initial rank has no effect on the distribution, only on the actual numeric rank values and how far apart they are spread.
For all combinations of initial value and PageRank iterations, the rank for a well-known crawler is in the \nth{95} percentile, so for our use case---detecting sensors due their high ranks---those parameters do not matter. For all combinations of initial value and PageRank iterations, the rank for a well-known crawler is in the \nth{95} percentile, so for our use case---detecting sensors due to their high ranks---those parameters do not matter.
% On average, peers in the analyzed dataset have \num{223} successors over the whole week. % On average, peers in the analyzed dataset have \num{223} successors over the whole week.
Looking at the data in smaller buckets of one hour each, the average number of successors per peer is \num{90}. Looking at the data in smaller buckets of one hour each, the average number of successors per peer is \num{90}.
%{{{ fig:avg_out_edges %%{{{ fig:avg_out_edges
\begin{figure}[H] %\begin{figure}[H]
\centering %\centering
\includegraphics[width=1\linewidth]{./avg_out_edges.png} %\includegraphics[width=1\linewidth]{./avg_out_edges.png}
\caption{Average outgoing edges per peer per hour}\label{fig:avg_out_edges} %\caption{Average outgoing edges per peer per hour}\label{fig:avg_out_edges}
\end{figure} %\end{figure}
%}}}fig:avg_out_edges %%}}}fig:avg_out_edges
Experiments were performed, in which the incoming edges for the known sensor are reduced by increasing factors, to see, when the sensor's rank reaches the overall average. Experiments were performed, in which the incoming edges for the known sensor are reduced by increasing factors, to see, when the sensor's rank reaches the overall average.
% \begin{figure}[H] \begin{landscape}
% \centering
% \includegraphics[width=1\textwidth]{reduced_ranks/0/in_out.png}
% % \caption{PageRank after adding \(0.75 \times \abs{\text{pred}(v)}\) edges}\label{fig:pr75}
% \end{figure}%
\begin{figure}[H] \begin{figure}[H]
\centering \centering
\begin{subfigure}[b]{1\textwidth} \begin{subfigure}[b]{.6\textwidth}
\centering \centering
\includegraphics[width=.8\linewidth]{reduced_ranks/0/pr.png} \includegraphics[width=1\linewidth]{reduced_ranks/0/in_out.png}
\caption{PageRank after removing \SI{0}{\percent} of edges}\label{fig:pr0} \end{subfigure}%
\begin{subfigure}[b]{.6\textwidth}
\centering
\includegraphics[width=1\linewidth]{reduced_ranks/1/in_out.png}
\end{subfigure}% \end{subfigure}%
\hfill \hfill
\begin{subfigure}[b]{1\textwidth} \begin{subfigure}[b]{.6\textwidth}
\centering \centering
\includegraphics[width=.8\linewidth]{reduced_ranks/0/sr.png} \includegraphics[width=1\linewidth]{reduced_ranks/2/in_out.png}
\caption{SensorRank after removing \SI{0}{\percent} of edges}\label{fig:sr0}
\end{subfigure}% \end{subfigure}%
% \caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}(v) = 0.75\)}\label{fig:dist_sr_75} \begin{subfigure}[b]{.6\textwidth}
\centering
\includegraphics[width=1\linewidth]{reduced_ranks/3/in_out.png}
\end{subfigure}%
\caption{In-degrees after removing edges}\label{fig:prFiltered}
\end{figure} \end{figure}
\end{landscape}
\begin{landscape}
\begin{figure}[H]
\centering
\begin{subfigure}[b]{.6\textwidth}
\centering
\includegraphics[width=1\linewidth]{reduced_ranks/0/pr.png}
\end{subfigure}%
\begin{subfigure}[b]{.6\textwidth}
\centering
\includegraphics[width=1\linewidth]{reduced_ranks/1/pr.png}
\end{subfigure}%
\hfill
\begin{subfigure}[b]{.6\textwidth}
\centering
\includegraphics[width=1\linewidth]{reduced_ranks/2/pr.png}
\end{subfigure}%
\begin{subfigure}[b]{.6\textwidth}
\centering
\includegraphics[width=1\linewidth]{reduced_ranks/3/pr.png}
\end{subfigure}%
\caption{PageRank after removing edges}\label{fig:prFiltered}
\end{figure}
\end{landscape}
\begin{landscape}
\begin{figure}[H]
\centering
\begin{subfigure}[b]{.6\textwidth}
\centering
\includegraphics[width=1\linewidth]{reduced_ranks/0/sr.png}
\end{subfigure}%
\begin{subfigure}[b]{.6\textwidth}
\centering
\includegraphics[width=1\linewidth]{reduced_ranks/1/sr.png}
\end{subfigure}%
\hfill
\begin{subfigure}[b]{.6\textwidth}
\centering
\includegraphics[width=1\linewidth]{reduced_ranks/2/sr.png}
\end{subfigure}%
\begin{subfigure}[b]{.6\textwidth}
\centering
\includegraphics[width=1\linewidth]{reduced_ranks/3/sr.png}
\end{subfigure}%
\caption{SensorRank after removing edges}\label{fig:srFiltered}
\end{figure}
\end{landscape}
\Fref{fig:pr0} and \Fref{fig:sr0} show the situation on the base truth without modifications. \Fref{fig:pr0} and \Fref{fig:sr0} show the situation on the base truth without modifications.
\begin{figure}[H]
\centering
\includegraphics[width=.8\textwidth]{reduced_ranks/1/in_out.png}
\caption{Incoming edges after removing \SI{10}{\percent} of edges}\label{fig:in1}
% \caption{PageRank after adding \(0.75 \times \abs{\text{pred}(v)}\) edges}\label{fig:pr75}
\end{figure}%
\begin{figure}[H] We can see in \Fref{fig:prFiltered} and \Fref{fig:srFiltered}, that we have to reduce the incoming edges by \SI{20}{\percent} and \SI{30}{\percent} respectively to get average values for SensorRank and PageRank.
\centering This also means that the number of incoming edges for a sensor must be about the same as the average about of incoming edges as can be seen in \Fref{fig:in3}.
\begin{subfigure}[b]{1\textwidth} Depending on the protocol details of the botnet (\eg{} how many incoming edges are allowed per peer), this means that a large amount of sensors is needed if we want to monitor the whole network.
\centering
\includegraphics[width=.8\linewidth]{reduced_ranks/1/pr.png}
\caption{PageRank after removing \SI{10}{\percent} of edges}\label{fig:pr1}
\end{subfigure}%
\hfill
\begin{subfigure}[b]{1\textwidth}
\centering
\includegraphics[width=.8\linewidth]{reduced_ranks/1/sr.png}
\caption{SensorRank after removing \SI{10}{\percent} of edges}\label{fig:sr1}
\end{subfigure}%
% \caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}(v) = 0.75\)}\label{fig:dist_sr_75}
\end{figure}
\begin{figure}[H]
\centering
\includegraphics[width=.8\textwidth]{reduced_ranks/2/in_out.png}
\caption{Incoming edges after removing \SI{20}{\percent} of edges}\label{fig:in2}
% \caption{PageRank after adding \(0.75 \times \abs{\text{pred}(v)}\) edges}\label{fig:pr75}
\end{figure}%
\begin{figure}[H]
\centering
\begin{subfigure}[b]{1\textwidth}
\centering
\includegraphics[width=.8\linewidth]{reduced_ranks/2/pr.png}
\caption{PageRank after removing \SI{20}{\percent} of edges}\label{fig:pr2}
\end{subfigure}%
\hfill
\begin{subfigure}[b]{1\textwidth}
\centering
\includegraphics[width=.8\linewidth]{reduced_ranks/2/sr.png}
\caption{SensorRank after removing \SI{20}{\percent} of edges}\label{fig:sr2}
\end{subfigure}%
% \caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}(v) = 0.75\)}\label{fig:dist_sr_75}
\end{figure}
\begin{figure}[H]
\centering
\includegraphics[width=.8\textwidth]{reduced_ranks/3/in_out.png}
\caption{Incoming edges after removing \SI{30}{\percent} of edges}\label{fig:in3}
% \caption{PageRank after adding \(0.75 \times \abs{\text{pred}(v)}\) edges}\label{fig:pr75}
\end{figure}%
\begin{figure}[H]
\centering
\begin{subfigure}[b]{1\textwidth}
\centering
\includegraphics[width=.8\linewidth]{reduced_ranks/3/pr.png}
\caption{PageRank after removing \SI{30}{\percent} of edges}\label{fig:pr3}
\end{subfigure}%
\hfill
\begin{subfigure}[b]{1\textwidth}
\centering
\includegraphics[width=.8\linewidth]{reduced_ranks/3/sr.png}
\caption{SensorRank after removing \SI{30}{\percent} of edges}\label{fig:sr3}
\end{subfigure}%
% \caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}(v) = 0.75\)}\label{fig:dist_sr_75}
\end{figure}
We can see in \Fref{fig:sr2} and \Fref{fig:pr3}, that we have to reduce the incoming edges by \SI{20}{\percent} and \SI{30}{\percent} respectively to get average values for SensorRank and PageRank.
This also means, that the amount of incoming edges for a sensor must be about the same as the average about of incoming edges as can be seen in \Fref{fig:in3}.
Depending on the protocol details of the botnet (\eg{} how many incoming edges are allowed per peer), this means that a large amount of sensors is needed, if we want to monitor the whole network.
% Experiments were performed, in which a percentage of random outgoing edges were added to the known sensor, based on the amount of incoming edges:
% We evaluate the impact of outgoing edges by picking a percentage of random nodes in each bucket and creating edges from the sensor to each of the sampled peers, thereby evening the ratio between \(\deg^{+}\) and \(\deg^{-}\).
% \begin{figure}[H]
% \centering
% \begin{subfigure}[b]{.75\textwidth}
% \centering
% \includegraphics[width=1\linewidth]{ranks/pr_75.png}
% \caption{PageRank after adding \(0.75 \times \abs{\text{pred}(v)}\) edges}\label{fig:pr75}
% \end{subfigure}%
% \hfill
% \begin{subfigure}[b]{.75\textwidth}
% \centering
% \includegraphics[width=1\linewidth]{ranks/sr_75.png}
% \caption{SensorRank after adding \(0.75 \times \abs{\text{pred}(v)}\) edges}\label{fig:sr75}
% \end{subfigure}%
% % \caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}(v) = 0.75\)}\label{fig:dist_sr_75}
% \end{figure}
% \begin{figure}[H]
% \centering
% \begin{subfigure}[b]{.75\textwidth}
% \centering
% \includegraphics[width=1\linewidth]{ranks/pr_100.png}
% \caption{PageRank after adding \(1.0 \times \abs{\text{pred}(v)}\) edges}\label{fig:pr100}
% \end{subfigure}%
% \hfill
% \begin{subfigure}[b]{.75\textwidth}
% \centering
% \includegraphics[width=1\linewidth]{ranks/sr_100.png}
% \caption{SensorRank after adding \(1.0 \times \abs{\text{pred}(v)}\) edges}\label{fig:sr100}
% \end{subfigure}%
% % \caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}(v) = 0.75\)}\label{fig:dist_sr_75}
% \end{figure}
% \begin{figure}[H]
% \centering
% \begin{subfigure}[b]{.75\textwidth}
% \centering
% \includegraphics[width=1\linewidth]{ranks/pr_150.png}
% \caption{PageRank after adding \(1.5 \times \abs{\text{pred}(v)}\) edges}\label{fig:pr150}
% \end{subfigure}%
% \hfill
% \begin{subfigure}[b]{.75\textwidth}
% \centering
% \includegraphics[width=1\linewidth]{ranks/sr_150.png}
% \caption{SensorRank after adding \(1.5 \times \abs{\text{pred}(v)}\) edges}\label{fig:sr150}
% \end{subfigure}%
% % \caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}(v) = 0.75\)}\label{fig:dist_sr_75}
% \end{figure}
% These results show, that simply adding new edges is not enough and we need to limit the incoming edges to improve the Page- and SensorRank metrics.
%}}} eval creating edges %}}} eval creating edges
@ -1317,7 +1346,7 @@ We were able to show, that a collaborative monitoring approach for \ac{p2p} botn
On the other hand, graph ranking algorithms have been proven to be hard to bypass without requiring large amounts of sensor nodes. On the other hand, graph ranking algorithms have been proven to be hard to bypass without requiring large amounts of sensor nodes.
Luckily most of the anti-monitoring and monitoring detection techniques discussed in this work are of academic nature and have not yet been deployed in real-world botnets. Luckily most of the anti-monitoring and monitoring detection techniques discussed in this work are of academic nature and have not yet been deployed in real-world botnets.
Further investigation and improvements in \ac{p2p} botnet monitoring are required to prevent a situation were a botmaster implements the currently theoretical concepts and renders monitoring as it is currently done, ineffective. Further investigation and improvements in \ac{p2p} botnet monitoring are required to prevent a situation where a botmaster implements the currently theoretical concepts and renders monitoring as it is currently done, ineffective.
%}}} conclusion %}}} conclusion

Binary file not shown.

View File

@ -33,6 +33,8 @@ headsepline,
\usepackage{mathtools} \usepackage{mathtools}
% \usepackage{tikz} % \usepackage{tikz}
% figures in landscape mode
\usepackage{lscape}
% positioning % positioning
\usepackage{float} \usepackage{float}