1. Architecture Update

2. Guest Host HOST COMPONENTS VERNIER Community Level: Connected Clusters User Node KB Super Node COMMUNITY MONITOR SERVLET WEB SERVER Situation Awareness Node EPIDEMIC BOT TRAFFIC Central Detection Node Guest TRAINING/ANALYSIS Analysis Node Multiple Node Roles

3. Guest Host HOST COMPONENTS User Node KB Super Node COMMUNITY MONITOR SERVLET WEB SERVER Situation Awareness Node EPIDEMIC BOT TRAFFIC Central Detection Node Guest TRAINING/ANALYSIS Analysis Node KB Super Node Situation Awareness Guest User Node Example Functional Overlay COMMUNITY MONITOR SERVLET WEB SERVER Situation Awareness Node

4. Guest Host HOST COMPONENTS User Node KB Super Node COMMUNITY MONITOR SERVLET WEB SERVER Situation Awareness Node EPIDEMIC BOT TRAFFIC Central Detection Node Guest TRAINING/ANALYSIS Analysis Node KB Super Node EPIDEMIC Central Detection Node Epidemic Detection Sample Functional Overlay 1.Anomaly reports from local Syzygy to central detector 2.Central Syzygy epidemic report published to Knowledge Base 3.User nodes receive report EPIDEMIC S S S

5. Guest Host HOST COMPONENTS User Node KB Super Node COMMUNITY MONITOR SERVLET WEB SERVER Situation Awareness Node EPIDEMIC BOT TRAFFIC Central Detection Node Guest TRAINING/ANALYSIS Analysis Node Configuration Diagnosis Sample Functional Overlay KB Super Node HOST COMPONENTS User Node C C C C C C C C 1.Sick node queries the continuously updated KB 2.Sick node posts demand query 3.User nodes reply 4.Sick node queries result

6. 6 VERNIER User Node Level Guest HOST COMPONENTS Host Host Kernel AGENT GUARDIAN VM monitor Guest Kernel KERNEL AGENT USER LIB AGENT USER AGENT (Config) Apps Botswat Quasi-Static

7. 7 Guest HOST COMPONENTS Host Host Kernel AGENT GUARDIAN VM monitor Guest Kernel KERNEL AGENT USER LIB AGENT USER AGENT (Config) Apps VERNIER User Node Level Local Coordinator PolicyState Configuration Execution Network Botswat Quasi-Static Detect Response Knowledge Sharing Diagnose

8. 8 Guest HOST COMPONENTS Host Host Kernel AGENT GUARDIAN VM monitor Guest Kernel KERNEL AGENT USER LIB AGENT USER AGENT (Config) Apps VERNIER User Node Level Local Coordinator PolicyState Config Configuration Logger Diag & Resp Detect Updater Execution Syzygy Network Dynamic FW Rootkit Detect Component-specific Detect Response Knowledge Sharing Diagnose Model Botswat Quasi-Static Inter-component Q-S BotSwat