State identifiers for sink states: |Sink or state IDs?

[azqanadeem]

Determine how to represent vertices in AGs that come from sink states. If we do assign |Sink, then all sinks of that type will be merged in one node (cool for simplicity, bad for readability). However, state IDs taken from sinks (salvaged) might be misleading for analysts (think different context). In either case, vertices related to sink states MUST ALWAYS have a dotted border.

[jzelenjak]

I would like to add something regarding this issue.

1. Current implementation is as follows: for low-severity sinks, there is no ID at all. For med- and high-severity sinks, there is the actual ID. For low-severity non-sinks, there is no ID at all.
2. in_main_model (in ag-generation.py, see the fragments below) seems useless, since it is created from the state IDs from the episodes and then the same states are queried in in_main_model (so all states will be in in_main_model, including the ones with ID -1). So, all the if-checks for |Sink's are never true and are currently not used. What could be checked instead is if episode[3] != -1, since nodes with ID -1 are low-severity sinks (their ID is removed in traverse method). This will lead to some states having |Sink ID (which I saw on the image in some of the papers, but which is not the case for the current implementation), and as a result a bit more states (these states will now have an ID "Sink" and hence will not be merged with a non-sink nodes without ID (e.g. some VulnD)).
   
   
3. This is how an AG would look like if we check if episode[3] != -1:
   
   And this is the original (i.e. current implementation):
   
4. I think it went wrong somewhere in this commit
   
5. With the current implementation, there is technically no point in removing IDs from low-severity sinks as they will not be shown as sinks anyway and will be treated in the same way as low-severity non-sinks (when creating attack graphs; since they don't have IDs, graphviz will treat them the same). As intended, there are no oval dotted sinks in the AGs (I have verified this with the cursed pipelines below).
   

[azqanadeem]

Note: Changes here might break some tests.