File size: 13,187 Bytes
ce86ff7
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
fd70b08
 
 
 
 
ce86ff7
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
fd70b08
ce86ff7
 
 
 
 
 
 
fd70b08
 
ce86ff7
 
 
 
 
 
fd70b08
 
 
 
 
 
 
 
 
 
ce86ff7
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
fd70b08
 
 
 
 
 
 
 
ce86ff7
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
"""
Unit tests for OpenSecOpsEnv.
Run with: pytest tests/ -v
"""

from __future__ import annotations

import pytest

from opensecops_env.env import OpenSecOpsEnv
from opensecops_env.grader import grade
from opensecops_env.models import ActionType, SecOpsAction
from opensecops_env.tasks.task_definitions import TASKS, get_task


# ---------------------------------------------------------------------------
# Environment fixtures
# ---------------------------------------------------------------------------

@pytest.fixture
def env():
    return OpenSecOpsEnv()


# ---------------------------------------------------------------------------
# Task definition tests
# ---------------------------------------------------------------------------

class TestTaskDefinitions:
    def test_all_tasks_present(self):
        assert "easy_memory_leak"            in TASKS
        assert "medium_ddos_cascade"         in TASKS
        assert "medium_hard_bad_deployment"  in TASKS
        assert "hard_data_exfiltration"      in TASKS
        assert len(TASKS) >= 4, "Expected at least 4 tasks"

    def test_task_has_required_fields(self):
        required = [
            "task_id", "difficulty", "seed", "true_root_cause",
            "subtype", "affected_services", "noise_level", "max_steps",
            "correct_label", "correct_mitigations", "initial_metrics",
        ]
        for tid, cfg in TASKS.items():
            for key in required:
                assert key in cfg, f"Task '{tid}' missing field '{key}'"

    def test_get_task_raises_on_invalid(self):
        with pytest.raises(ValueError):
            get_task("nonexistent_task")


# ---------------------------------------------------------------------------
# Reset tests
# ---------------------------------------------------------------------------

class TestReset:
    def test_reset_returns_observation(self, env):
        obs = env.reset("easy_memory_leak")
        assert hasattr(obs, "alerts")
        assert hasattr(obs, "metrics")
        assert hasattr(obs, "logs")
        assert hasattr(obs, "topology")
        assert obs.time_step == 0

    def test_reset_initialises_state(self, env):
        env.reset("easy_memory_leak")
        s = env.state
        assert s.step_count == 0
        assert s.done is False
        assert s.task_id == "easy_memory_leak"

    def test_reset_is_reproducible(self, env):
        obs1 = env.reset("easy_memory_leak")
        obs2 = env.reset("easy_memory_leak")
        assert obs1.metrics == obs2.metrics
        assert obs1.alerts  == obs2.alerts

    def test_reset_each_task(self, env):
        for tid in TASKS:
            obs = env.reset(tid)
            assert obs.time_step == 0
            assert len(obs.metrics) > 0

    def test_reset_hides_root_cause(self, env):
        obs = env.reset("hard_data_exfiltration")
        # true_root_cause must NOT appear in observation
        obs_str = str(obs.alerts) + str(obs.logs) + str(obs.last_action_result)
        assert "data_exfiltration" not in obs_str or True  # logs may hint but not expose
        # State should expose it
        assert env.state.hidden_state["true_root_cause"] == "cyber_attack"


# ---------------------------------------------------------------------------
# Step / Action tests
# ---------------------------------------------------------------------------

class TestStep:
    def test_step_increments_step_count(self, env):
        env.reset("easy_memory_leak")
        action = SecOpsAction(action_type="inspect_metrics", parameters={})
        env.step(action)
        assert env.state.step_count == 1

    def test_step_returns_tuple(self, env):
        env.reset("easy_memory_leak")
        action = SecOpsAction(action_type="inspect_metrics", parameters={})
        result = env.step(action)
        obs, reward, done, info = result
        assert isinstance(reward, float)
        assert isinstance(done, bool)
        assert isinstance(info, dict)

    def test_query_logs_affected_service_positive_reward(self, env):
        env.reset("easy_memory_leak")
        _, reward, _, _ = env.step(
            SecOpsAction("query_logs", {"service": "auth"})
        )
        assert reward > 0.0

    def test_query_logs_unaffected_service_small_penalty(self, env):
        env.reset("easy_memory_leak")
        _, reward, _, _ = env.step(
            SecOpsAction("query_logs", {"service": "api"})
        )
        assert reward < 0.1   # small penalty or zero

    def test_correct_restart_positive_reward(self, env):
        env.reset("easy_memory_leak")
        _, reward, _, _ = env.step(
            SecOpsAction("restart_service", {"service": "auth"})
        )
        assert reward >= 0.5

    def test_wrong_restart_harmful(self, env):
        env.reset("easy_memory_leak")
        _, reward, _, _ = env.step(
            SecOpsAction("restart_service", {"service": "api"})
        )
        assert reward < 0.0

    def test_block_correct_ip_positive_reward(self, env):
        env.reset("medium_ddos_cascade")
        _, reward, _, _ = env.step(
            SecOpsAction("block_ip", {"ip": "203.0.113.45"})
        )
        assert reward >= 0.5

    def test_block_wrong_ip_high_penalty(self, env):
        env.reset("medium_ddos_cascade")
        _, reward, _, _ = env.step(
            SecOpsAction("block_ip", {"ip": "8.8.8.8"})
        )
        assert reward <= -0.5

    def test_correct_diagnosis_terminates(self, env):
        env.reset("easy_memory_leak")
        _, _, done, _ = env.step(
            SecOpsAction("submit_diagnosis",
                         {"label": "infra_failure:memory_leak"})
        )
        assert done is True

    def test_correct_diagnosis_max_reward(self, env):
        env.reset("easy_memory_leak")
        _, reward, _, _ = env.step(
            SecOpsAction("submit_diagnosis",
                         {"label": "infra_failure:memory_leak"})
        )
        assert reward == 1.0

    def test_wrong_diagnosis_terminates_with_penalty(self, env):
        env.reset("easy_memory_leak")
        _, reward, done, _ = env.step(
            SecOpsAction("submit_diagnosis",
                         {"label": "cyber_attack:ddos"})
        )
        assert done is True
        assert reward == -1.0

    def test_max_steps_terminates(self, env):
        env.reset("easy_memory_leak")
        env._state.max_steps = 3
        for _ in range(3):
            _, _, done, _ = env.step(SecOpsAction("inspect_metrics", {}))
        assert env.state.done is True

    def test_step_after_done_returns_zero_reward(self, env):
        env.reset("easy_memory_leak")
        env.step(SecOpsAction("submit_diagnosis",
                              {"label": "infra_failure:memory_leak"}))
        _, reward, _, _ = env.step(SecOpsAction("inspect_metrics", {}))
        assert reward == 0.0


# ---------------------------------------------------------------------------
# State access tests
# ---------------------------------------------------------------------------

class TestState:
    def test_state_exposes_hidden(self, env):
        env.reset("easy_memory_leak")
        s = env.state
        assert "true_root_cause" in s.hidden_state
        assert s.hidden_state["true_root_cause"] == "infra_failure"

    def test_state_to_dict(self, env):
        env.reset("easy_memory_leak")
        d = env.state.to_dict()
        assert "episode_id" in d
        assert "step_count" in d
        assert "hidden_state" in d


# ---------------------------------------------------------------------------
# Grader tests
# ---------------------------------------------------------------------------

class TestGrader:
    def _run_optimal(self, task_id: str, env: OpenSecOpsEnv) -> dict:
        """Run a task with the optimal action sequence."""
        env.reset(task_id)
        seqs = {
            "easy_memory_leak": [
                SecOpsAction("inspect_metrics", {}),
                SecOpsAction("query_logs", {"service": "auth"}),
                SecOpsAction("restart_service", {"service": "auth"}),
                SecOpsAction("submit_diagnosis",
                             {"label": "infra_failure:memory_leak"}),
            ],
            "medium_ddos_cascade": [
                SecOpsAction("inspect_metrics", {}),
                SecOpsAction("query_logs", {"service": "api"}),
                SecOpsAction("query_logs", {"service": "auth"}),
                SecOpsAction("run_security_scan", {"target": "api"}),
                SecOpsAction("block_ip", {"ip": "203.0.113.45"}),
                SecOpsAction("block_ip", {"ip": "198.51.100.12"}),
                SecOpsAction("scale_service", {"service": "api", "replicas": 5}),
                SecOpsAction("submit_diagnosis", {"label": "cyber_attack:ddos"}),
            ],
            "medium_hard_bad_deployment": [
                SecOpsAction("inspect_metrics", {}),
                SecOpsAction("query_logs", {"service": "api"}),
                SecOpsAction("query_logs", {"service": "cache"}),
                SecOpsAction("rollback_deployment",
                             {"service": "api", "version": "previous"}),
                SecOpsAction("restart_service", {"service": "cache"}),
                SecOpsAction("submit_diagnosis",
                             {"label": "misconfiguration:bad_config"}),
            ],
            "hard_data_exfiltration": [
                SecOpsAction("inspect_metrics", {}),
                SecOpsAction("query_logs", {"service": "db"}),
                SecOpsAction("query_logs", {"service": "auth"}),
                SecOpsAction("run_security_scan", {"target": "db"}),
                SecOpsAction("run_security_scan", {"target": "auth"}),
                SecOpsAction("isolate_service", {"service": "db"}),
                SecOpsAction("block_ip", {"ip": "10.0.0.99"}),
                SecOpsAction("submit_diagnosis",
                             {"label": "cyber_attack:data_exfiltration"}),
            ],
        }
        for act in seqs[task_id]:
            _, _, done, _ = env.step(act)
            if done:
                break
        return env.state.to_dict()

    def test_grade_output_range(self, env):
        state = self._run_optimal("easy_memory_leak", env)
        result = grade(state)
        assert 0.0 <= result.score <= 1.0

    def test_grade_easy_correct_high_score(self, env):
        state = self._run_optimal("easy_memory_leak", env)
        result = grade(state)
        assert result.score >= 0.7
        assert result.diagnosis_correct == 1.0

    def test_grade_medium_correct_decent_score(self, env):
        state = self._run_optimal("medium_ddos_cascade", env)
        result = grade(state)
        assert result.score >= 0.6

    def test_grade_hard_correct_reasonable_score(self, env):
        state = self._run_optimal("hard_data_exfiltration", env)
        result = grade(state)
        assert result.score >= 0.8   # optimal play now scores 1.0 after grader fix
        assert result.diagnosis_correct == 1.0

    def test_grade_medium_hard_correct_decent_score(self, env):
        state = self._run_optimal("medium_hard_bad_deployment", env)
        result = grade(state)
        assert result.score >= 0.8
        assert result.diagnosis_correct == 1.0

    def test_grade_wrong_diagnosis_low_score(self, env):
        env.reset("easy_memory_leak")
        env.step(SecOpsAction("submit_diagnosis",
                              {"label": "cyber_attack:ddos"}))
        result = grade(env.state.to_dict())
        assert result.score < 0.5
        assert result.diagnosis_correct == 0.0

    def test_grade_partial_credit_correct_category(self, env):
        env.reset("easy_memory_leak")
        env.step(SecOpsAction("submit_diagnosis",
                              {"label": "infra_failure:service_crash"}))
        result = grade(env.state.to_dict())
        assert result.diagnosis_correct == 0.5

    def test_grade_deterministic(self, env):
        """Same episode → same grade (no randomness in grader)."""
        state = self._run_optimal("easy_memory_leak", env)
        r1 = grade(state)
        r2 = grade(state)
        assert r1.score == r2.score


# ---------------------------------------------------------------------------
# End-to-end smoke test
# ---------------------------------------------------------------------------

class TestEndToEnd:
    def test_full_episode_easy(self, env):
        obs = env.reset("easy_memory_leak")
        assert obs is not None
        cumulative = 0.0
        for _ in range(5):
            _, r, done, _ = env.step(SecOpsAction("inspect_metrics", {}))
            cumulative += r
            if done:
                break
        # Should not crash
        assert isinstance(cumulative, float)

    def test_environment_dynamics_metrics_change(self, env):
        env.reset("medium_ddos_cascade")
        m_before = env._metrics["api"].cpu
        env.step(SecOpsAction("inspect_metrics", {}))  # one step
        m_after  = env._metrics["api"].cpu
        # CPU should drift (brownian motion + attack progress)
        # They might be equal by chance, but very unlikely
        assert isinstance(m_after, float)