Notes On The Design Of An Internet Adversary

The design of the defenses Internet systems can deploy against attack, especially adaptive and resilient defenses, must start from a real- istic model of the threat. This requires an assessment of the capabilities of the adversary. The design typically evolves through a process of sim- ulating both the system and the adversary. This requires the design and implementation of a simulated adversary based on the capability assess- ment. Consensus on the capabilities of a suitable adversary is not evident. Part of the recent redesign of the protocol used by peers in the LOCKSS digital preservation system included a conservative assessment of the ad- versary's capabilities. We present our assessment and the implications we drew from it as a step towards a reusable adversary specication.