I wrote a paper for school while taking a course in network forensics
to show how network fornesics could be enhanced by honeypots or
honeynets.
I ended up with a section on patterns to describe the different ways
that honeypots could be deployed in a network environment - use with
IDS, forensics, deter and slow attackers, incident response, research,
etc.
I have attached both a Word and PDF document to share for the purposes
of research, scholarship and instruction in case anyone might be
interested.
Take care,
Jeff
ÐÏࡱá>þÿ ¬®þÿÿÿª«ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿì¥Á @ ø¿Zbjbj5*5* (?W@W@K?eÿÿÿÿÿÿ?
(444H,,,8È,\$-\H°ht?-(´-Ê-¦p.p.D9®òN4&U /h1h1h1h1h1h1h$$jR
vlÖUh4z^æ8æ8^z^z^Uh44p.p.v
jhp`p`p`z^64p.4p./hp`z^/hp`p`:Sf?44gp.?- A9MÞ]È,°_^Ûf
/h?h0°håf.Lm`:LmgHH4444Lm4g BXH?Yêp`tZ¼0[JBXBXBXUhUhHHd!
¬'äH`(HH¬'Honey Patterns
The following patterns are intended as a foundation for formal design patterns for the deployment of honeynets or honeypots. These patterns are in the format prescribed from the original Gang of Four (GoF) design patterns. They are intended to help frame and illustrate the deployment possibilities, scenarios and related issues in honeynet or honeypot deployment. Please note that some of the ?Also Known As? names might be a bit silly, and also the ?Structure? diagrams are draft only and might be described as my lame attempt at using set theory to help illustrate traffic analysis concepts. Some of the patterns are obvious and well-known, while others may be a bit new and require further research. The hope is that others will provide input and continually improve this effort. Additions, enhancements or other constructive revisions are encouraged and welcomed. This document is released in the public domain to promote scholarship, research and instructional purposes.
Pattern Name and Classification
Alert Reduction by Correlation Pattern
Intent
The intent of this pattern is to reduce the number of actionable alerts or false positives from network security devices by correlating data with a comparable honeypot. This pattern directly enhances detection capabilities. The basis of this assertion is that no legitimate packets should be in the honeypot or honeynet, therefore any packets detected should be investigated.
Also Known As
Alert Reducer Pattern, Work Saver Pattern, Cry Wolf Detector Pattern
Motivation (Forces)
Network forensics is difficult due to the large volume of data, the complexity of data communications and the ethereal nature of network data in motion and at rest. Network security devices such as IDS produce large volumes of data, many of which are false positives.
Applicability
This pattern is applicable to a network forensics or security strategy that would like to reduce the volume of actionable security device alerts. False positives are frustrating to deal with and may reduce the effectiveness of IDS and other related security devices.
Structure
N = the set of all network traffic
S = the set of all security device traffic
B = the set of all ?bad? traffic
H = the set of all honeynet traffic
S(H = the set shown in grey above is the set of security device data we are interested
S(H? = a set that is not covered in this pattern, but the related patterns Discovery and Feedback, and Testing and Corroboration
Participants
The participants in this pattern are any security devices such as IDS, SIEM, and firewall in tandem with a honeypot or honeynet.
Collaboration
Security device alerts are correlated with honeypot data. Simple data such as timestamp, source IP, source port, destination IP, destination port, and protocol are easy to gather, normalize and correlate.
Consequences
Sole use of this pattern may result in a narrow field of view. This pattern is necessary, but not sufficient in the context of a ?defense in depth? strategy.
Implementation
A centralized log database should be created to collect, normalize, store and correlate data from various network security devices and honeypots. The honeypot or honeynets should be placed in areas conducive to detection enhancement and be comparable to production systems.
Example
Examples can be found in several books and papers on honeypots and honeynets.
Known Uses
This pattern refers to the correlation of honeypot or honeynet data with security device data to reduce the number of actionable events or false positives.
Related Patterns
Discovery and Feedback, Testing and Corroboration (Assurance)
Pattern Name and Classification
Discovery and Feedback Pattern
Intent
The intent of this pattern is to discover new network security threats such as malware, botnets, and new attacker methods. This pattern enables organizations to find security threats before they are well known and publicized. This pattern directly enhances prevention capabilities.
Also Known As
Early Warning Pattern, Research Pattern
Motivation (Forces)
Network forensics is difficult due to the large volume of data, the complexity of data communications and the ethereal nature of network data in motion and at rest. False accepts are a serious problem; that is to say when malicious packets are accepted as OK then this is a serious security hole. Zero day exploits are getting air time in the media, and represent a serious threat.
Applicability
This pattern is applicable to a network forensics strategy that has matured past a reactionary mode and is engaged in actively seeking new threats in order to better prepare and respond to them.
Structure
N = the set of all network traffic
S = the set of all security device traffic
B = the set of all ?bad? traffic
H = the set of all honeynet traffic
B ? (S(H) shown in grey above is the set of security device data we are interested in as this represents bad items that are going un detected. These represent false accepts ? perhaps one of the most dangerous statistical errors.
Participants
The participants in this pattern are any security devices such as IDS, SIEM, and firewall in tandem with a honeypot or honeynet and ancillary support services.
Collaboration
Network security devices such as IDS, firewall, and syslog in conjunction with a honeynet or honeypot correlation play a role in this pattern.
Consequences
The consequences of this pattern are that implementers will need to have an in depth knowledge of their networks as well as the time to plan, deploy, maintain, monitor and manage the extra work. The other consequence could be better security.
Implementation
Location plays a key role in the success of the honeypot or honeynet deployment. In this case, all locations are fair game, but for different reasons. A sensor in the DMZ would help to discover new worms and new external attacker methods while a sensor in the internal network would help discover the really good external attacker methods as well as any internal threats, such as consultants.
Example
An example of this would be the Honeynet project.
Known Uses
REN-ISAC, the Honeynet project and several other academic-oriented projects have focused on this research angle.
Related Patterns
Discovery and Feedback, Testing and Corroboration (Assurance)
Pattern Name and Classification
Testing and Corroboration (Assurance) Pattern
Intent
The intent of this pattern is to help provide assurance that network security and network forensics devices are functioning as expected. This pattern directly enhances prevention and detection efforts.
Also Known As
Assurance Pattern, Security Baseline Checker Pattern, Sleep Better at Night Pattern
Motivation (Forces)
Network forensics involves numerous complex devices such as IDS, firewall, etc. These devices are managed and run by humans and are thus prone to configuration errors. A miss-configuration could lead to false accepts or other activity that should be seen and understood going undetected. It is one thing to deploy something, but another to deploy, test, verify and validate the deployment.
Applicability
This pattern is applicable to a network forensics strategy that seeks to provide assurance that the existing security posture is configured and operating as expected. This could be for a mature program as well as a heavily-regulated industry that needs to provide audit and regulatory assurance.
Structure
N = the set of all network traffic
S = the set of all security device traffic
B = the set of all ?bad? traffic
H = the set of all honeynet traffic
B(H(S = the set shown in grey above to confirm that our security device configurations are working as expected. We don?t want one to get past the goalie.
Participants
The participants in this pattern are any security devices such as IDS, SIEM, and firewall in tandem with a honeypot or honeynet. We should not see packets that are supposed to be blocked or have packets go undetected that should be alerted.
Collaboration
The security device configuration is tested with support from the honeynet.
Consequences
This pattern requires a deep understanding of the network and related security settings. As with any deployment, there are on-going maintenance and support issues.
Implementation
This type of implementation should mirror and be placed behind the system that is to be tested.
Example
Suppose we would like to test our internal firewall. We could deploy a honeynet on the collision domain served by the internal firewall with alerting on the items the firewall is NOT supposed to allow. Any alert would therefore be evidence that the firewall rule set is suspect
Known Uses
None known at this time.
Related Patterns
Discovery and Feedback
Pattern Name and Classification
Timeline Creation Pattern
Intent
The intent of this pattern is to enhance timeline creation abilities during and after and event.
Also Known As
The What Happened Pattern, The Coroner Pattern, The Gus Grissom Pattern
Motivation (Forces)
Network forensics is difficult due to the large volume of data, the complexity of data communications and the ethereal nature of network data in motion and at rest. This pattern directly enhances response capabilities.
Applicability
This pattern is applicable to a network forensics strategy that seeks to enhance incident response practices.
Structure
N = the set of all network traffic
B = the set of all ?bad? traffic
H = the set of all honeynet traffic
The area in grey is the data we are trying to correlate and create a time-line
Participants
The participants in this pattern are any security devices such as IDS, SIEM, and firewall in tandem with a honeypot or honeynet with any ancillary sensors or collection devices.
Collaboration
This pattern will utilize data correlated from the honeypot or honeynet to any security device capture.
Consequences
This pattern requires up-front planning and a deep understanding of existing network topologies. Proper documentation and assignment of duties as well as adequate testing to verify and validate is essential.
Implementation
Deploy a honeynet or honeypot to mirror the systems you would like to enhance timeline creation abilities for.
Example
No examples known ? opportunity for further development.
Known Uses
None known uses at this time ? opportunity for further research.
Related Patterns
Incident Response Pattern.
Pattern Name and Classification
Deter and Slow Pattern
Intent
The intent of this pattern is to slow the advance of malware propagation and to slow and or deter an attacker. This additional time will allow for increased detection probability and allows for device fine tuning and calibration, and remediation activities. This pattern directly enhances detection capabilities.
Also Known As
Tar Pit Pattern, Minefield Pattern, Barbed Wire Pattern, Shock and Awe Pattern
Motivation (Forces)
Network forensics is difficult due to the large volume of data, the complexity of data communications and the ethereal nature of network data in motion and at rest. Every day newer and faster threats are on the Internet ? zero day exploits, new worms, polymorphic viruses are released faster than vendors can distribute patches and alerts.
Applicability
This pattern is applicable to a network forensics strategy that seeks to slow the propagation of malware, and to slow and deter attackers in order to better prepare to rapidly adapt and prevent attacks. Some would argue that the presence of well-deployed honeypots or honeynets is a sign of a well-monitored network. If an attacker observes that he is in a honeypot, he may feel that he is not sure if he is attacking a legitimate production system or a honeypot.
Structure
N = the set of all network traffic
S = the set of all security device traffic
B = the set of all ?bad? traffic
H = the set of all honeynet traffic
Participants
The participants in this pattern are any security devices such as IDS, SIEM, and firewall in tandem with a honeypot or honeynet.
Collaboration
Security devices collaborate with the honeynet.
Consequences
This pattern requires an in-depth knowledge of your network and the development of a deter and slow strategy that best fits your information security program
Implementation
One of the key factors is honeypot or honeynet placement. As discussed earlier in this paper, there are appropriate locations for prevention, detection, and response. In order to slow malware propagation, a special honeypot or honeynet should be deployed in the DMZ.
Example
This pattern is used by tar pit honeypot or honeynet deployments.
Known Uses
This pattern is used in several tar pit honeypots such as Labrea. Honeyd and others can be configured to function as a tar pit as well.
Related Patterns
Trend Analysis Pattern
Pattern Name and Classification
Trend Analysis Pattern
Intent
The intent of this pattern is to identify the top areas of concern for a network forensics program. Trend data such as source IPs, source port, destination IP, destination port, protocols, etc. are all useful to learn where threats are coming from. This pattern directly enhances prevention capabilities
Also Known As
Statistics Pattern, Research Pattern, Know Your Enemy Pattern
Motivation (Forces)
Network forensics is difficult due to the large volume of data, the complexity of data communications and the ethereal nature of network data in motion and at rest. This pattern would be used by a security program that seeks to better understand threat sources. In addition, security device companies such as IDS manufacturers might use this pattern to develop new signature or behavior files.
Applicability
This pattern is applicable to a network forensics strategy that seeks to go beyond a reactionary mode and tries to pro actively seek out, identify, analyze and prepare for new threat sources and manage related vulnerabilities
Structure
N = the set of all network traffic
S = the set of all security device traffic
B = the set of all ?bad? traffic
H = the set of all honeynet traffic
Participants
The participants in this pattern are any security devices such as IDS, SIEM, and firewall in tandem with a honeypot or honeynet.
Collaboration
Security devices collaborate with
Consequences
This pattern may have dangerous consequences. On one hand, the data about external threat sources is valuable. On the other hand, if you deploy this outside of your firewall, you may become a target for attackers and their friends.
Implementation
This pattern has been implemented by several projects illustrated in books and various papers on honeypots and honeynets.
Example
REN-ISAC, The Cymru Darknet Project, The Honeynet Project
Known Uses
REN-ISAC statistics pages
Related Patterns
Discovery and Feedback
Pattern Name and Classification
Incident Response Pattern
Intent
The intent of this pattern is to provide a template for using honeypots or honeynets to enhance the incident response process. This pattern directly enhances incident response capabilities.
Also Known As
The Fire Drill Pattern, Comfortable Response Pattern
Motivation (Forces)
Network forensics is difficult due to the large volume of data, the complexity of data communications and the ethereal nature of network data in motion and at rest. During an incident, most organizations prefer to restore service first, and then find out what happened later. During an incident, there is not desire and no time to take a production system off-line to perform an adequate job of ascertaining what the cause of the incident was. Since honeypots or honeynets have no production value, they have the luxury of being able to be taken off-line for full forensic analysis.
Applicability
This pattern is applicable to a network forensics strategy that seeks to avoid the business as usual response to restore service now, find out what happened later syndrome.
Structure
N = the set of all network traffic
S = the set of all security device traffic
B = the set of all ?bad? traffic
H = the set of all honeynet traffic
Participants
The participants in this pattern are any ?compromised? honeypots or honeynets.
Collaboration
All network security devices, syslogs etc involved in the incident will participate.
Consequences
The consequences of implementing this pattern are an improved understanding of what happened during an incident and allows for a more effective response. This pattern may also lead to more effective evidence preservation and be interesting to law enforcement.
Implementation
This pattern is designed to enhance the ability to respond to incidents. The honeypot or honeynet should be set up in such a fashion to mirror comparable production systems. For example, if you wanted to have incident response capabilities for a Web environment, the honeypots should be set up in the DMZ and be configured the same as the production systems.
Example
No known current examples ? opportunity for further development.
Known Uses
No known current uses ? opportunity for further research.
Related Patterns
Timeline Creation Pattern
References
[1] P.T. Chen , C.S. Laih , F. Pouget , M. Dacier, 2005, Comparative Survey of Local Honeynet Sensors to Assist Network Forensics, IEEE HYPERLINK "http://csdl2.computer.org/dl/proceedings/sadfe/2005/2478/00/24780120.pd
f" http://csdl2.computer.org/dl/proceedings/sadfe/2005/2478/00/24780120.p
df
[2] Frederic Raynal, Yann Berthier, Philippe Biondi, Danielle Kaminsky, "Honeynet Forensics Part I: Analyzing the Network," IEEE Security and Privacy, vol. 02, no. 4, pp. 72-78, July-August, 2004
[3] Anjali Sardana, Krishan Kumar, R. C. Joshi, "Detection and Honeynet Based Redirection to Counter DDoS Attacks in ISP Domain," ias, pp. 191-196, Third International Symposium on Information Assurance and Security, 2007
[4] Ren, W., & Jin, H. (2005). Honeynet based distribution adaptive network
forensics and active real time investigation. Paper presented at the 2005
ACM Symposium on Applied Computing (SAC ?05), Santa Fe, New Mexico.
[5] Sadasivam, K., Samudrala, K., & Yang, T. (2005). Design of network security projects using honeynets. Journal of Computing Sciences in Colleges,
20(4), 282-293.
[6] Team Cymru Darknet Project, HYPERLINK "http://www.cymru.com/Darknet/" http://www.cymru.com/Darknet/
[8] Provos, Niels, Holz, Thorsten, Virtual Honeynets, From Botnet Tracking to Intrusion Detection, Pearson Education, 2007
[9] Ed Skoudis, Steven Northcutt, SANS Security 504, Hacker Techniques, Exploits & Incident Handling (2007)
[10] Know Your Enemy, Learning about Security Threats, Pearson Education, 2004
[11] Niels Provos, A Virtual Honeypot Framework, Center for Information Technology Integration of the University of Michigan, Proceedings of the 13th conference on USENIX Security Symposium - Volume 13 (2004)
[12] Developments of the Honeyd Virtual Honeypot, http://www.honeyd.org/
[13] Yong Tang, HuaPing Hu, XiCheng Lu, Jie Wang, HonIDS: Enhancing Honeypot System with Intrusion Detection Models, IEEE, (2006)
[14] Professor James Burrell, Boston University Metropolitan College: MET 703 Network Forensics, Fall Semester 2007.
?Often referred to as the GoF, or Gang-Of-Four (because of the four authors who wrote it), Design Patterns: Elements of Reusable Object-Oriented Software ( HYPERLINK "http://en.wikipedia.org/w/index.php?title=Special:Booksources&isbn=0201
633612" ISBN 0-201-63361-2) is a HYPERLINK "http://en.wikipedia.org/wiki/Software_engineering" \o "Software engineering" software engineering book describing recurring solutions to common problems in software design. The book's authors are HYPERLINK "http://en.wikipedia.org/wiki/Erich_Gamma" \o "Erich Gamma" Erich Gamma, HYPERLINK "http://en.wikipedia.org/wiki/Richard_Helm" \o "Richard Helm" Richard Helm, HYPERLINK "http://en.wikipedia.org/wiki/Ralph_Johnson" \o "Ralph Johnson" Ralph Johnson, and HYPERLINK "http://en.wikipedia.org/wiki/John_Vlissides" \o "John Vlissides" John Vlissides. The book is divided into two parts, with the first two chapters exploring the capabilities and pitfalls of object-oriented programming, and the remaining chapters describing a series of classic HYPERLINK "http://en.wikipedia.org/wiki/Design_pattern_%28computer_science%29" \o "Design pattern (computer science)" software design patterns. The book includes examples in HYPERLINK "http://en.wikipedia.org/wiki/C%2B%2B" \o "C++" C++ and HYPERLINK "http://en.wikipedia.org/wiki/Smalltalk" \o "Smalltalk" Smalltalk.? http://en.wikipedia.org/wiki/Design_Patterns
This work is hereby released into the Public Domain. To view a copy of the public domain dedication, visit http://creativecommons.org/licenses/publicdomain/ or send a letter to Creative Commons, 171 Second Street, Suite 300, San Francisco, California, 94105, USA.
to show how network fornesics could be enhanced by honeypots or
honeynets.
I ended up with a section on patterns to describe the different ways
that honeypots could be deployed in a network environment - use with
IDS, forensics, deter and slow attackers, incident response, research,
etc.
I have attached both a Word and PDF document to share for the purposes
of research, scholarship and instruction in case anyone might be
interested.
Take care,
Jeff
ÐÏࡱá>þÿ ¬®þÿÿÿª«ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿì¥Á @ ø¿Zbjbj5*5* (?W@W@K?eÿÿÿÿÿÿ?
(444H,,,8È,\$-\H°ht?-(´-Ê-¦p.p.D9®òN4&U /h1h1h1h1h1h1h$$jR
vlÖUh4z^æ8æ8^z^z^Uh44p.p.v
jhp`p`p`z^64p.4p./hp`z^/hp`p`:Sf?44gp.?- A9MÞ]È,°_^Ûf
/h?h0°håf.Lm`:LmgHH4444Lm4g BXH?Yêp`tZ¼0[JBXBXBXUhUhHHd!
¬'äH`(HH¬'Honey Patterns
The following patterns are intended as a foundation for formal design patterns for the deployment of honeynets or honeypots. These patterns are in the format prescribed from the original Gang of Four (GoF) design patterns. They are intended to help frame and illustrate the deployment possibilities, scenarios and related issues in honeynet or honeypot deployment. Please note that some of the ?Also Known As? names might be a bit silly, and also the ?Structure? diagrams are draft only and might be described as my lame attempt at using set theory to help illustrate traffic analysis concepts. Some of the patterns are obvious and well-known, while others may be a bit new and require further research. The hope is that others will provide input and continually improve this effort. Additions, enhancements or other constructive revisions are encouraged and welcomed. This document is released in the public domain to promote scholarship, research and instructional purposes.
Pattern Name and Classification
Alert Reduction by Correlation Pattern
Intent
The intent of this pattern is to reduce the number of actionable alerts or false positives from network security devices by correlating data with a comparable honeypot. This pattern directly enhances detection capabilities. The basis of this assertion is that no legitimate packets should be in the honeypot or honeynet, therefore any packets detected should be investigated.
Also Known As
Alert Reducer Pattern, Work Saver Pattern, Cry Wolf Detector Pattern
Motivation (Forces)
Network forensics is difficult due to the large volume of data, the complexity of data communications and the ethereal nature of network data in motion and at rest. Network security devices such as IDS produce large volumes of data, many of which are false positives.
Applicability
This pattern is applicable to a network forensics or security strategy that would like to reduce the volume of actionable security device alerts. False positives are frustrating to deal with and may reduce the effectiveness of IDS and other related security devices.
Structure
N = the set of all network traffic
S = the set of all security device traffic
B = the set of all ?bad? traffic
H = the set of all honeynet traffic
S(H = the set shown in grey above is the set of security device data we are interested
S(H? = a set that is not covered in this pattern, but the related patterns Discovery and Feedback, and Testing and Corroboration
Participants
The participants in this pattern are any security devices such as IDS, SIEM, and firewall in tandem with a honeypot or honeynet.
Collaboration
Security device alerts are correlated with honeypot data. Simple data such as timestamp, source IP, source port, destination IP, destination port, and protocol are easy to gather, normalize and correlate.
Consequences
Sole use of this pattern may result in a narrow field of view. This pattern is necessary, but not sufficient in the context of a ?defense in depth? strategy.
Implementation
A centralized log database should be created to collect, normalize, store and correlate data from various network security devices and honeypots. The honeypot or honeynets should be placed in areas conducive to detection enhancement and be comparable to production systems.
Example
Examples can be found in several books and papers on honeypots and honeynets.
Known Uses
This pattern refers to the correlation of honeypot or honeynet data with security device data to reduce the number of actionable events or false positives.
Related Patterns
Discovery and Feedback, Testing and Corroboration (Assurance)
Pattern Name and Classification
Discovery and Feedback Pattern
Intent
The intent of this pattern is to discover new network security threats such as malware, botnets, and new attacker methods. This pattern enables organizations to find security threats before they are well known and publicized. This pattern directly enhances prevention capabilities.
Also Known As
Early Warning Pattern, Research Pattern
Motivation (Forces)
Network forensics is difficult due to the large volume of data, the complexity of data communications and the ethereal nature of network data in motion and at rest. False accepts are a serious problem; that is to say when malicious packets are accepted as OK then this is a serious security hole. Zero day exploits are getting air time in the media, and represent a serious threat.
Applicability
This pattern is applicable to a network forensics strategy that has matured past a reactionary mode and is engaged in actively seeking new threats in order to better prepare and respond to them.
Structure
N = the set of all network traffic
S = the set of all security device traffic
B = the set of all ?bad? traffic
H = the set of all honeynet traffic
B ? (S(H) shown in grey above is the set of security device data we are interested in as this represents bad items that are going un detected. These represent false accepts ? perhaps one of the most dangerous statistical errors.
Participants
The participants in this pattern are any security devices such as IDS, SIEM, and firewall in tandem with a honeypot or honeynet and ancillary support services.
Collaboration
Network security devices such as IDS, firewall, and syslog in conjunction with a honeynet or honeypot correlation play a role in this pattern.
Consequences
The consequences of this pattern are that implementers will need to have an in depth knowledge of their networks as well as the time to plan, deploy, maintain, monitor and manage the extra work. The other consequence could be better security.
Implementation
Location plays a key role in the success of the honeypot or honeynet deployment. In this case, all locations are fair game, but for different reasons. A sensor in the DMZ would help to discover new worms and new external attacker methods while a sensor in the internal network would help discover the really good external attacker methods as well as any internal threats, such as consultants.
Example
An example of this would be the Honeynet project.
Known Uses
REN-ISAC, the Honeynet project and several other academic-oriented projects have focused on this research angle.
Related Patterns
Discovery and Feedback, Testing and Corroboration (Assurance)
Pattern Name and Classification
Testing and Corroboration (Assurance) Pattern
Intent
The intent of this pattern is to help provide assurance that network security and network forensics devices are functioning as expected. This pattern directly enhances prevention and detection efforts.
Also Known As
Assurance Pattern, Security Baseline Checker Pattern, Sleep Better at Night Pattern
Motivation (Forces)
Network forensics involves numerous complex devices such as IDS, firewall, etc. These devices are managed and run by humans and are thus prone to configuration errors. A miss-configuration could lead to false accepts or other activity that should be seen and understood going undetected. It is one thing to deploy something, but another to deploy, test, verify and validate the deployment.
Applicability
This pattern is applicable to a network forensics strategy that seeks to provide assurance that the existing security posture is configured and operating as expected. This could be for a mature program as well as a heavily-regulated industry that needs to provide audit and regulatory assurance.
Structure
N = the set of all network traffic
S = the set of all security device traffic
B = the set of all ?bad? traffic
H = the set of all honeynet traffic
B(H(S = the set shown in grey above to confirm that our security device configurations are working as expected. We don?t want one to get past the goalie.
Participants
The participants in this pattern are any security devices such as IDS, SIEM, and firewall in tandem with a honeypot or honeynet. We should not see packets that are supposed to be blocked or have packets go undetected that should be alerted.
Collaboration
The security device configuration is tested with support from the honeynet.
Consequences
This pattern requires a deep understanding of the network and related security settings. As with any deployment, there are on-going maintenance and support issues.
Implementation
This type of implementation should mirror and be placed behind the system that is to be tested.
Example
Suppose we would like to test our internal firewall. We could deploy a honeynet on the collision domain served by the internal firewall with alerting on the items the firewall is NOT supposed to allow. Any alert would therefore be evidence that the firewall rule set is suspect
Known Uses
None known at this time.
Related Patterns
Discovery and Feedback
Pattern Name and Classification
Timeline Creation Pattern
Intent
The intent of this pattern is to enhance timeline creation abilities during and after and event.
Also Known As
The What Happened Pattern, The Coroner Pattern, The Gus Grissom Pattern
Motivation (Forces)
Network forensics is difficult due to the large volume of data, the complexity of data communications and the ethereal nature of network data in motion and at rest. This pattern directly enhances response capabilities.
Applicability
This pattern is applicable to a network forensics strategy that seeks to enhance incident response practices.
Structure
N = the set of all network traffic
B = the set of all ?bad? traffic
H = the set of all honeynet traffic
The area in grey is the data we are trying to correlate and create a time-line
Participants
The participants in this pattern are any security devices such as IDS, SIEM, and firewall in tandem with a honeypot or honeynet with any ancillary sensors or collection devices.
Collaboration
This pattern will utilize data correlated from the honeypot or honeynet to any security device capture.
Consequences
This pattern requires up-front planning and a deep understanding of existing network topologies. Proper documentation and assignment of duties as well as adequate testing to verify and validate is essential.
Implementation
Deploy a honeynet or honeypot to mirror the systems you would like to enhance timeline creation abilities for.
Example
No examples known ? opportunity for further development.
Known Uses
None known uses at this time ? opportunity for further research.
Related Patterns
Incident Response Pattern.
Pattern Name and Classification
Deter and Slow Pattern
Intent
The intent of this pattern is to slow the advance of malware propagation and to slow and or deter an attacker. This additional time will allow for increased detection probability and allows for device fine tuning and calibration, and remediation activities. This pattern directly enhances detection capabilities.
Also Known As
Tar Pit Pattern, Minefield Pattern, Barbed Wire Pattern, Shock and Awe Pattern
Motivation (Forces)
Network forensics is difficult due to the large volume of data, the complexity of data communications and the ethereal nature of network data in motion and at rest. Every day newer and faster threats are on the Internet ? zero day exploits, new worms, polymorphic viruses are released faster than vendors can distribute patches and alerts.
Applicability
This pattern is applicable to a network forensics strategy that seeks to slow the propagation of malware, and to slow and deter attackers in order to better prepare to rapidly adapt and prevent attacks. Some would argue that the presence of well-deployed honeypots or honeynets is a sign of a well-monitored network. If an attacker observes that he is in a honeypot, he may feel that he is not sure if he is attacking a legitimate production system or a honeypot.
Structure
N = the set of all network traffic
S = the set of all security device traffic
B = the set of all ?bad? traffic
H = the set of all honeynet traffic
Participants
The participants in this pattern are any security devices such as IDS, SIEM, and firewall in tandem with a honeypot or honeynet.
Collaboration
Security devices collaborate with the honeynet.
Consequences
This pattern requires an in-depth knowledge of your network and the development of a deter and slow strategy that best fits your information security program
Implementation
One of the key factors is honeypot or honeynet placement. As discussed earlier in this paper, there are appropriate locations for prevention, detection, and response. In order to slow malware propagation, a special honeypot or honeynet should be deployed in the DMZ.
Example
This pattern is used by tar pit honeypot or honeynet deployments.
Known Uses
This pattern is used in several tar pit honeypots such as Labrea. Honeyd and others can be configured to function as a tar pit as well.
Related Patterns
Trend Analysis Pattern
Pattern Name and Classification
Trend Analysis Pattern
Intent
The intent of this pattern is to identify the top areas of concern for a network forensics program. Trend data such as source IPs, source port, destination IP, destination port, protocols, etc. are all useful to learn where threats are coming from. This pattern directly enhances prevention capabilities
Also Known As
Statistics Pattern, Research Pattern, Know Your Enemy Pattern
Motivation (Forces)
Network forensics is difficult due to the large volume of data, the complexity of data communications and the ethereal nature of network data in motion and at rest. This pattern would be used by a security program that seeks to better understand threat sources. In addition, security device companies such as IDS manufacturers might use this pattern to develop new signature or behavior files.
Applicability
This pattern is applicable to a network forensics strategy that seeks to go beyond a reactionary mode and tries to pro actively seek out, identify, analyze and prepare for new threat sources and manage related vulnerabilities
Structure
N = the set of all network traffic
S = the set of all security device traffic
B = the set of all ?bad? traffic
H = the set of all honeynet traffic
Participants
The participants in this pattern are any security devices such as IDS, SIEM, and firewall in tandem with a honeypot or honeynet.
Collaboration
Security devices collaborate with
Consequences
This pattern may have dangerous consequences. On one hand, the data about external threat sources is valuable. On the other hand, if you deploy this outside of your firewall, you may become a target for attackers and their friends.
Implementation
This pattern has been implemented by several projects illustrated in books and various papers on honeypots and honeynets.
Example
REN-ISAC, The Cymru Darknet Project, The Honeynet Project
Known Uses
REN-ISAC statistics pages
Related Patterns
Discovery and Feedback
Pattern Name and Classification
Incident Response Pattern
Intent
The intent of this pattern is to provide a template for using honeypots or honeynets to enhance the incident response process. This pattern directly enhances incident response capabilities.
Also Known As
The Fire Drill Pattern, Comfortable Response Pattern
Motivation (Forces)
Network forensics is difficult due to the large volume of data, the complexity of data communications and the ethereal nature of network data in motion and at rest. During an incident, most organizations prefer to restore service first, and then find out what happened later. During an incident, there is not desire and no time to take a production system off-line to perform an adequate job of ascertaining what the cause of the incident was. Since honeypots or honeynets have no production value, they have the luxury of being able to be taken off-line for full forensic analysis.
Applicability
This pattern is applicable to a network forensics strategy that seeks to avoid the business as usual response to restore service now, find out what happened later syndrome.
Structure
N = the set of all network traffic
S = the set of all security device traffic
B = the set of all ?bad? traffic
H = the set of all honeynet traffic
Participants
The participants in this pattern are any ?compromised? honeypots or honeynets.
Collaboration
All network security devices, syslogs etc involved in the incident will participate.
Consequences
The consequences of implementing this pattern are an improved understanding of what happened during an incident and allows for a more effective response. This pattern may also lead to more effective evidence preservation and be interesting to law enforcement.
Implementation
This pattern is designed to enhance the ability to respond to incidents. The honeypot or honeynet should be set up in such a fashion to mirror comparable production systems. For example, if you wanted to have incident response capabilities for a Web environment, the honeypots should be set up in the DMZ and be configured the same as the production systems.
Example
No known current examples ? opportunity for further development.
Known Uses
No known current uses ? opportunity for further research.
Related Patterns
Timeline Creation Pattern
References
[1] P.T. Chen , C.S. Laih , F. Pouget , M. Dacier, 2005, Comparative Survey of Local Honeynet Sensors to Assist Network Forensics, IEEE HYPERLINK "http://csdl2.computer.org/dl/proceedings/sadfe/2005/2478/00/24780120.pd
f" http://csdl2.computer.org/dl/proceedings/sadfe/2005/2478/00/24780120.p
df
[2] Frederic Raynal, Yann Berthier, Philippe Biondi, Danielle Kaminsky, "Honeynet Forensics Part I: Analyzing the Network," IEEE Security and Privacy, vol. 02, no. 4, pp. 72-78, July-August, 2004
[3] Anjali Sardana, Krishan Kumar, R. C. Joshi, "Detection and Honeynet Based Redirection to Counter DDoS Attacks in ISP Domain," ias, pp. 191-196, Third International Symposium on Information Assurance and Security, 2007
[4] Ren, W., & Jin, H. (2005). Honeynet based distribution adaptive network
forensics and active real time investigation. Paper presented at the 2005
ACM Symposium on Applied Computing (SAC ?05), Santa Fe, New Mexico.
[5] Sadasivam, K., Samudrala, K., & Yang, T. (2005). Design of network security projects using honeynets. Journal of Computing Sciences in Colleges,
20(4), 282-293.
[6] Team Cymru Darknet Project, HYPERLINK "http://www.cymru.com/Darknet/" http://www.cymru.com/Darknet/
[7] Spitzner, Lance, Honeynets, Pearson Education, 2003.
[8] Provos, Niels, Holz, Thorsten, Virtual Honeynets, From Botnet Tracking to Intrusion Detection, Pearson Education, 2007
[9] Ed Skoudis, Steven Northcutt, SANS Security 504, Hacker Techniques, Exploits & Incident Handling (2007)
[10] Know Your Enemy, Learning about Security Threats, Pearson Education, 2004
[11] Niels Provos, A Virtual Honeypot Framework, Center for Information Technology Integration of the University of Michigan, Proceedings of the 13th conference on USENIX Security Symposium - Volume 13 (2004)
[12] Developments of the Honeyd Virtual Honeypot, http://www.honeyd.org/
[13] Yong Tang, HuaPing Hu, XiCheng Lu, Jie Wang, HonIDS: Enhancing Honeypot System with Intrusion Detection Models, IEEE, (2006)
[14] Professor James Burrell, Boston University Metropolitan College: MET 703 Network Forensics, Fall Semester 2007.
?Often referred to as the GoF, or Gang-Of-Four (because of the four authors who wrote it), Design Patterns: Elements of Reusable Object-Oriented Software ( HYPERLINK "http://en.wikipedia.org/w/index.php?title=Special:Booksources&isbn=0201
633612" ISBN 0-201-63361-2) is a HYPERLINK "http://en.wikipedia.org/wiki/Software_engineering" \o "Software engineering" software engineering book describing recurring solutions to common problems in software design. The book's authors are HYPERLINK "http://en.wikipedia.org/wiki/Erich_Gamma" \o "Erich Gamma" Erich Gamma, HYPERLINK "http://en.wikipedia.org/wiki/Richard_Helm" \o "Richard Helm" Richard Helm, HYPERLINK "http://en.wikipedia.org/wiki/Ralph_Johnson" \o "Ralph Johnson" Ralph Johnson, and HYPERLINK "http://en.wikipedia.org/wiki/John_Vlissides" \o "John Vlissides" John Vlissides. The book is divided into two parts, with the first two chapters exploring the capabilities and pitfalls of object-oriented programming, and the remaining chapters describing a series of classic HYPERLINK "http://en.wikipedia.org/wiki/Design_pattern_%28computer_science%29" \o "Design pattern (computer science)" software design patterns. The book includes examples in HYPERLINK "http://en.wikipedia.org/wiki/C%2B%2B" \o "C++" C++ and HYPERLINK "http://en.wikipedia.org/wiki/Smalltalk" \o "Smalltalk" Smalltalk.? http://en.wikipedia.org/wiki/Design_Patterns
Jeffrey Boltz
jaboltz (at) acm (dot) org [email concealed]
Honey Patterns
January 23, 2008 - PAGE 1 -
This work is hereby released into the Public Domain. To view a copy of the public domain dedication, visit http://creativecommons.org/licenses/publicdomain/ or send a letter to Creative Commons, 171 Second Street, Suite 300, San Francisco, California, 94105, USA.
68??§×Øñõ/ H ù d
g
Õ
$ G T b q z ? ® ç è /~?
n
¯
°
%3üøüôüøüêüæôâôÞÚÞÖÞÒÞÎÊÎÆξº³ü¦?üü?Ö?ü~üuüh|5CJaJh¯h|hþëh|h?eÇh¶
Ø#hXFáh|5CJ OJQJ^JaJ h¡Q h|OJQJ^Jh?h|hÅ$²h£iäh+m\h¯q1hä]ÓhF[PhÏhC4h ]hÅY4h1lh^~jh|0JUhçcùh?K?h|,è /6°
¾
&4@JLo?»ß6·ÄES!÷òêâÝòÝòÝÕÝòÝòòòòòòòÝÕÝò
& Fgd|gd|
& Fgd|
& Fgd|gd|
& FgdÐ#NS?XÿYþþþ349fr?@JKàá78¶·ÄD !ÌÍîï DEëì\]{|? ÕÖêiwx}·:;EFá÷óìèìóìóàóÙóÙ
óÒóÉóÂóÂóÂó¾·ó·ó©??ó·óóÉó÷óìóìóyój?h|Uhä(h|#h¡Q h|5CJ OJQJ^JaJ h|5CJ OJQJ^JaJ h¡Q h|5O
JQJ^Jh$]h|h?nah¯h|h|5CJaJhy h| jÇðh|jh|Uh?T2h¡Q h|h|h¡Q h|5/!.ÍÜï÷EPìý<=]|? ®Öêjx
;EGHk?úõúõúõúõúõõðèúõúõúàúõúõõõõ
& Fgd|
& Fgd|gd|gd|gd|?·ÛÁÎn | ¦ ® à ë ] n Í û !Í!Û!/"C"Î#Ü#úúúõíõúõúõúõúõúõúèàõúõúõíõ
& Fgd|gd|
& Fgd|gd|gd|áâÎm
¥ ¦ ß à \ ] ¬ Ì Í ú û ¶!Ä!Ì!Í!."/"C"ï"ó"ô"Í#Û#Ü#á#$%%%ùõìõåõÞõ×õÐõÉõÂõ´¥?õõ?õõìxoìõgõ`õ`
õh¡Q h|h¡Q h|5hF[P5CJaJhàµ5CJaJh
'Lh|hGIêh|h?>v#h¡Q h|5CJ OJQJ^JaJ h|5CJ OJQJ^JaJ h¡Q h
|5OJQJ^Jh?Gfh|h5nNh|hAh|h- Ïh|hû
:h|h` h|h|5CJaJh| jÇðh|%Ü#%%%4%_%?%¤%?&L&>'L'?'¦'K(Z(¼(Ä(Ü)ç)**(*H*b*i*Ì*úõúúúúúúõ
íõúõúõúõúõúõúèàõú
& Fgd|gd|
& Fgd|gd|gd|%%¥%¦%§%¨%L&='?'?'J(K(»(¼(Û)Ü)ÿ)*'*(*G*H*a*b*Ë*Ì
*!+"+6+, , ,%,_,,?,?,?,^-.?.?.b/÷óìóìóãóÜóÕóÎóÎóÎóÇó¹ª?ó?ó?óãó?ó{ó{ósóãólóhiÒh|j h|Uh¡Q h|h¡Q h|5hÆdEh|h^0h|#h¡Q h|5CJ OJQJ^JaJ h|5CJ OJQJ^JaJ h¡Q h|5OJ
QJ^Jh?Gfh|h<q¢h|h{ îh|h6Ih|h|5CJaJ jÇðh|h|jTh|U*Ì*Ú*"+6+, ,?,?,?,½,Þ,-Q-^-. .?.?.c/r/â/ê/#0.0o0?0?0úõúíúõúõõõõõúíúõúõúõúäúõúõ
Æ*gdÒ'f
& Fgd|gd|gd|b/c/á/â/ê/"0#0.0n0o0?0?0º0»0Ñ0Ò022p2q2?2Û3é3ê3ï3
)4»5¼5Æ5Ç5h6è6&7'7Ñ7Ò7í8î87989?9ùõîõêãõßãõØõÊ»©õ¢õ¢õ?õ?õ?õ?õ?õ?õ{õtõmõfõ
h|(¿h|h¿Gh|hDKïh|h nh|j) h|Uh¡Q h|h¡Q h|5h|5CJaJhMÈh|#h¡Q h|5CJ OJQJ^JaJ h|5CJ OJQJ^JaJ h¡Q h|5O
JQJ^Jh?Gfh|hfKjh~*Æh|hÒ'fhd0°h|h|h?@h|(?0»0Ò0Ù02"2q2?2Ü3ê3¼5Æ5È5ë5676[6h6é6÷6'747Ò7á7î8ö889úòíèíèí
àíèíèèèèèíàíèíèíèíè
& Fgd|gd|gd|
& Fgd|gd|89C9Ì9Ý9ô9:+:2:e;s;±;Å;Q=_=A>K>M>p>?>¼>à>í>n?|???«??@úõ
úõðèúõúõúàúõúõõõõõúàúõúõ
& Fgd|
& Fgd|gd|gd|gd|?9Ë9Ì9ó9ô9::*:+:d;e;°;±;Å;P=^=_=d=?=@>A>K
>L>í>m?????@?@¤@Æ@ï@ A A_A`A?A?A¬AAÌAÍAçAüõñêñÜÍ»ñ´ññ¤ñ?ñ?ñ?ññ¤ñ?ñ?ñ
?~zsñlñlñêñÜÍh"uh|h3Sh3Sh{o¤hYh3Sh7;?h|j'h|Uh¡Q h|h¡Q h|5h|5CJaJh?2h|hlAÅh|#h¡Q h|5CJ OJQJ^JaJ h|5CJ OJQJ^JaJ h¡Q h|5O
JQJ^Jh?Gfh|h|hMÈh|h
&*?@¤@ A&A`AkA?A?AAÍAèAïA®B¼BñBCOE]E
FFF9FdF?F©F¶FúõúðúðúðëãúðúðúÛúðúðððððú
& Fgd|
& Fgd|gd|gd|gd3Sgd|çAèA?B?B©B¬BB®BðBñBCNE\E]EbE?E F
FFF¶FGgGhGyHzHòIóIJ;J<J\J?JJ«J¬JJ¸J¼JñJ
KíéåéåéÞé×éÎéÆé¿é¿é·éÎé°é°é°é¬¥é¬¥é¿??|h&h°m3hÌ ?56CJOJQJ^JaJ h°m3hÌ ?CJOJQJ^JaJh°m3hÌ ?OJQJ^JhÌ ?hÛw`h|hJ0Dh|h¾Iyh¤jþh|jÏ.h|Uh¡Q h|h¡Q h|5h|5CJaJh-rh|h?@Ýh|h¶`?h|#h¡Q h|5CJ OJQJ^JaJ (¶FGGhGuGzH?HóIûI<JGJ
J?J¬JJ¸JãKäK¬LLM?MÚM$N÷òíòíòíòíòíòííÙÔÔÔÔÔÔËË 7$8$H$gdÌ ?gdÌ ?
& F
Æ°?°?Pþ^?°`?PþgdÌ ?gd|gd|
& Fgd|
KK:K@KAK?K?K?KáKâKçK-L5L`LyLìLôL/M2M?M?MMNÓNO
OO/OïÛʵʵ?µÊ??u??u?k^k^kPkhÌ ?CJOJQJ^JaJhÌ ?6OJQJ]^JhÌ ?OJQJ^Jh°m3hÌ ?6]hÌ ?h°m3hÌ ?$h°m3hÌ ?0JCJOJQJ^JaJ/j#7h°m3hÌ ?CJOJQJU^JaJ)jh°m3hÌ ?CJOJQJU^JaJ h°m3hÌ ?CJOJQJ^JaJ&h°m3hÌ ?56CJOJQJ^JaJ hÌ ?56CJOJQJ^JaJ$NhNiNþNOO|O}O¶O·O2P3P?P PïPðPÂQÃQR
RRRSS?X?XöööööññññññññññññññïêêïÝØgd|
-D`MÆ
ÿøüÿgd|gdtBgdÌ ? 7$8$H$gdÌ ?/O0O<OYO[O\O]OzO{O?O?O?OµO¶OÚOPUP?P¶PÕPoQ»QõQR?RÔRÖRSñçÚçÆñ·ñç¬?ç?ç?çuç?çkç^çTJThu
$OJQJ^JhtBOJQJ^JhÌ2AhÌ ?OJQJ^JhÌ ?0JCJaJh_$hÌ ?6OJQJ^JhÛyhÌ ?6OJQJ^Jh [ohÌ ?OJQJ^Jh [ohÌ ?6OJQJ^JhÌ ?6OJQJ^J hÀXThÌ ?0JOJQJ^J'j¼8hÀXThÌ ?OJQJU^Jh hÌ ?OJQJ^JhÌ ?OJQJ^JjhÌ ?OJQJU^JSSS S"S%S*S6ScS¡S£S¤SÿSTTTTTtTuT?T?TíTîT5U6UAUBUDUEU?UU?U?U?U?UêUëUøUùU
ÿUVMVNV\V]V!W"W?W?W²W³WÓWÔWXXXXXX]XüëàѼѼѼѩѩ?©Ñ©Ñ©?©Ñ©Ñ©?©Ñ©Ñ©
?©Ñ©Ñ©?©Ñ©Ñ©?©Ñ©Ñ©?©Ñ©Ñ©?©Ñ©Ñ hÎ*4h>¢0JCJaJmH sH %jhÎ*4h>¢CJUaJmH sH (hÎ*4h>¢56CJ\]aJmH sH hÎ*4h>¢CJaJmH sH hÎ*4h>¢CJaJ!jhÎ*4h>¢0JCJUaJhtB<]X^XgXhXjXkX?X?X?X?XX?
X¬X¼XàXáXçXèXéXêXîXðX÷YùYúYüYÿYZìÛìÌÁ¶²® ² ²®²?²??²®?² ²®?htBh§ ä
h>¢CJaJhù7ÛmHnHujh>¢Ujh>¢UmHnHuhù7Ûh>¢hÎ
*4h>¢mH sH hÎ*4h>¢CJaJ hÎ*4h>¢CJaJmH sH hÎ*4h>¢0JCJaJmH sH %jhÎ*4h>¢CJUaJmH sH ?X?X?XX¬X¼XËXíXîXïXðXøYùYûYüYýYþYÿYZýûýûûûûýùýùýûýùýýý&1h:p|
°Ð/ °à=!°"°#Ð$Ð%°?Dd¯èèðB²
ð
C ð AÁÿ?°ð?bðå¾?¸rä©Þ²ÉÌà,pÿÝDÞ
n ðÕå¾?¸rä©Þ²ÉÌà,pÿ?PNG
IHDRxa?ßòÖsRGB®Î é pHYsÄÄ?+iIDATx^í;R#1?mNbjajS¤Üg¤¦ö[lº?¹)?Ê>é¾?w?6Y£Gw«õ0 G??ZÝ_ÿê?4¢ïv»Qe?ñxÌó¨ÂXT ãâÎõ±²]4ÅË´§WÐ6V??cùýÉZ8)Ù@´ZQÊìFrÐ?8sTx±gs,h%ál?`àöÛdóS tµÆT?t²]bë1]b 1?ð&
8©? b?Xèà ñâ52
6?qÅ?:ãÅÓmx>?\?¥< Ø{Ô>U>èÆ ¤:"s)Û??àæ?ñi%??u?ÿ?.FPdÐøxDð!0¼ÊÓEùO+ ç¤b?eó?Tv?? ³Å ß7?~²¢¿e)èÂNJÑ5S?ñG×+ÚÉöéz|ý´?L7_ÔÏl¹ MGëè^Vó¿??xBî?]c µµ+Úgw¶\?~??ç?t¯Íl1?ÏCJ
P3äÑËÏûÛ碢>HTSÀ®FkØ>,߯ÒV3k;hÂözr÷«¨í:?]L?ýäîu÷z·ÿ"=o¾ìá÷èÐþtfÚ?
ú-U($»MÖ/ççÉËÆOÈã'4¦\?±·¢?ÏW$$©O !ð??ì¸ýgO 9???Mï?³Tèxv[àM?®èI
PµBÿZùÏML×?Ñh±6?gÝO,;ÜÈ=¦:_ÇãúIèçò¶¥ûõ?-?0÷?ê?IÙu?7·#{Éz+hÍe*
nÃIë?ºïA ¦ô?èYbuíbEgF z³,l«¨EËBvZ@·hHÇC¼Ì´Ë»ÊK?kk
ÛsP#kÍÝ ZõåeÃJÍ/¦¡VW<
kHE×¢
? "g¡b$k0h
?¡;??
?Cv3?d?Þl6àÕt:Uî1¦?2Fê·?Bh0¨øZs¯ +âÈùauÃ3ÿªÍFÜ??*þƦ ±A
?Ç/\± ?F?vY°vd+HgjxN¥¬L)Ü?1ö?ÒS` O¹_1Ù?#áêÝý?ñÜ ËX? @Lª?p
S ÖYA??Ū½ú¤>¨?RBïõ?XÞ[YGrz§^?|Ü>?û.À@<?B³??ùM.Í??nédæÞ*gzòòFE»?[ãñyàú?xWë<§?h߬¦*
ݽO]/þ¼lPÉÉÕ¨+k?»?î M.fïÿ¶¹ ¦ §VÐÛ·çÕå?@SõV?DcÃYh^® ó?ÉOlwz§ùÏßØÂ?¡ñ¬?¬ð?iºÔÇb ?T¦hv¹ uÊ\¨~ù@ ???l??s}Sg)¤¨Ç5I[¢¢
a,?¢axÁ¼ªÇzüÚCÐ+õü0pg
'J²Q±'??sà¨?8?«þd
>kÜ*mTQ«ö"n¨\èÖâ%_Î
>|`Â"ó@ËÆò?(\³yß?ÝYÁ¹,(m?(x]§(ú9{_CUÜT???¹.iK½ 4jEÿUF¥ õ?óý nnëURÇ
¼×3ßµò?ÃÚµ"¡?-Ò^DÝj?®omD *? AXÚ?u?8!³Ü6?$ 3F·éî]?¨? 3Èb?·®ÀÔrS ±?6ª}kûcý«¬`2ð
bÒÖ ÅUÐø??[z*p·3,¸ Gpü-
lÁ ?=ÿ?âô êt"0=°æ±®-¥c`Me ¤Ü´×è5?5?²4 ??v\xϾSK$e èuPxÊÐÁ?N¹?rôP@¤ÄÞ°¬ñ?¬`¯?? K©£¬ jÑo± ÷«ùg+¥Xó(?k´Ï??6e²¢?®añWJVùǯ?´Ò¡G?Þü¤bF?4¼ê
p¹x"eD?2³tºþ®e$¾\ ?)µ²>ÅLs?¾)Âá×hë2þØÕ1g ÑK:_1£³Û¤v[RÑýÚ]¿ÀÕQ°H õ¤9h5dj¥T+añä õ=N
Ï&á2 kxÙ¹?IÑfzµÿ8?Næ²w½Ø5*Õª?á?ÈË?·I]Ê(Úï"ï¥pêe «e?Q¹?áÕÓý?Ç?Ópº3IEND®B`?½Ddù èèðB²
ð
C ð AÁÿ?°ð?bð'4·?#Q×óõ+G
9Ð^\ÿÛÞ
n ðû4·?#Q×óõ+G
9Ð^\ÿ?PNG
IHDRw`¨?zþsRGB®Î é pHYsÃÄ?.>£IDATx^í?;R 1?Nåı??u9õ
s
åÔ© RgëºLâ?C8uÁMÖzVhõlu·z4?71°R?¾þÕ£Ñ??ív{4ëgÏ?9$AS²HrJä8<MÐô?¢
DÙͶ)Ö|íç
£9eHlF²)î?µ¢lUÓ!_?»N?ò?55B¾6???-I¹i ?@s?©6ýM?²AÜysÀ×I<4 áÖ
?KY¼ìxÅ)??Ê?Nù %ÜHÔʯ?o¸á#_xª)K-"?õ.î??ûqU(d7U^º l´ Ha¢ üÊch¦Æ`)ÿGirFQþØ)t?rñÓÃ? O?ùÅþÌY[Ë?[ º@¹¤â»?ïË3k?e-çÂ[o6Gßvr?5uçUrÎQ. yÌìýçO·¯UÎxÐqÊ?/ñ?ùäüËk?³Ýr7ÑÊÀ7¹åü[}ÉöâXåAû?±vs å|qq×KÚ³Ä?½G??
ø9§ÕçÍz?äâtï´?Ly!É63ð?ò,?óímhÎç GÊźàrW ?wW¢ÿ?M?ûTMq?Ô!øh̳iY×%?k?RF&,(?*? <??«CiÚS
¤6ebÁ54?)mÊså©ì×[|ÇK×¢??ª??RQỲP}QÞR. ÈzyÚ[m°P; ®?"ìª?Ø|õ´hìó8?ÝÞ_Ú¸/刺?ÿÀ,k!9.ý?µ@¨PÙè`
Ê?,hêEVæÁ÷ÙÑÄöqóç,þ ¸¸ ¤\þ¶`||H Çí???doÊë·'éÉù¯í¯óé?)xWø6?¯Ï WÝÈTí0¡Zµ¾`|õÛ?7V}îà(å?«áìÆ?
2Ýâzå??Z?" CÙ?JÇ?É8¢?¦,Ö1ÜƷײÁ®®aìÇ?ãü«¨|Í?GOÚµòÔѵ??ãÝ`?oq?éÒ§Ï
OóÂ4v\-?E4ßÒ¤-®k?²???ø?j6ýÂѯAÛþR¥Y°º¦MÏÌ ??)^?Õõ¸³ØmÑÖ?ǽÞ?±×FêlÉ?)¸æ?H¸?sB _W?>ÆSôE/³³?a>þ#ÁÉ?Ì
w?$_÷IÝ·'Y?Ë?1úÜmoO§?Yeø?v«??â?´¤MgÑ)WíFÇ? WzO/ ê}gV4r)Íçïï.Nwm7|÷¨ b?-Ò wñ°?É~ø %÷¹P?qyóó¡?Xóïwñl U_?j¬eÛÛõ?¿OÍ1öé@òíÝ»7'2ðÛ?Nvu);}ùݽÈn¸®Nä
û@p#uå ?âWE \eÁ£[¼Ï¶@ÎÍ$'B·Hµ\§¼? }È??íB°ætÊüí$Ù²]01Iµ ²?LÆdóç[H¡
d
??Ø?j|"U>?H«?9)·n{EbiY?Ô?Si/¦?E?òµÌ7ÊÇ$x|Î<$?zs6Q??EÓ#Hû hÚ)àK?qTd?¬$eØ?C(a¶HÐÖH??·Á°âí/ä ÉV
+?hæÿà?fßVË ÆüÝm ?PS.?6Ãéÿ-#ðâ²ÈÒ1oÁ±¶®AÙ®#Víêöv µÓ] íøÆ{ô7b|ë,j0 àÏS wu$Mp.??Sõ(çJ½ÿ`?#UH?°¹æÈ Ã7?¯åüP¤³Ì0þZá[àg?
²?Í¿÷£)¥]èK±?/ä»[ÐÝ
¹Xü £[Ð J»?ØÄ?<-j?c??~
QåÎä8PôÖ÷?D?Ó²~ÐËò?G\¦,.gq??¨Mù_? Á`?p¸×Æ?=±¿ýGDS k]Ô"?ÜûåÃ%8àÜ
ʺ©-¤rÇp?#,öbÙD?×1BC\eHFv'ϱ<#??2¶/?ñ? 5t×?Â):?S:eµ, q?H???
Æs)aB?k?`j\Ê-:õ\Xݽ´/©Hd( kAýº?¤¼hÖøNL×Å^õÒ¯¿H-C;W¶?D6Q(·ëq"pa?Ôî ?Ö?Ý6¢?U~g¦ ^/ù¾?×?¦?üTÅ;3eOÚMee{nS/?¦åhL"8<#=t'í¾?)¸wÁ¬?ÒÓöµ°rü?.?Új fJãIEND®B`?ËDd& èèðB²
ð
C ð AÁÿаð?bð5Ñ?Çéòë"(½ÀIb³ áÿ?Þ
n ð Ñ?Çéòë"(½ÀIb³ áÿ?PNG
IHDRz`]vñNsRGB®Î é pHYsÃÄ?.>£IDATx^í?½r1Çcj "
?Ò3iy?¸£
C %Z:SЧepÃ$¼-C
ÞÃèX?¢èô±ÚIçà&q,íÇoÿZéî?Ån·;jýZ,^ä¨MiPYãDãAQ¡¦¯,?z¸Ý´Uù¦snF
ÜaCıÔL·ÕQ? ÝÔ?Sw}Õd?&f@?°?qW??3F5IÜ&ÐÎû¾J¹ÈRU??ìH¤p+ A? Ù?lv,Üõ'sÑ?(?&·`z?d-?¤LÁ-»¾d¡h[cæþ¨4>¦¿Rw½7G¯é]0|e¸ 8k<ÖØÈÜÿYD
?À±¸ÿ³vK&? e}ûùåâåç[?ļ±¿ó?]ïhÄó¸sºÞ®?ÝôΦ?øò¸3¡®6?££À»I«J gpç¤=¤õâõ««?*ðRâQÜ4?õÀûøüíC¸=¨ ãaÜ7u9ü{?Ü£`?! Àµ?ø ðõzÛ#?j1a?û¸)¬ÿ%´|½YUËl¶?ü[Tdܳ% xà=ÜMX§[ ~ÿÆF5×5îl³¨Xç%bf_æ(?}?¦ïp÷©#Ìvß[Y1·T7²Às$ SÀ 72sA y? ñX
ÀmÔ]Äj<;âAi6ÀM`-¸ªÚ?j?»mÂÕ¼?ã?{.r;?~R[Ýs)È"?êc¸?¯?ÀúÂÜ®ts¶Wó`¡t:l¶"?
?xl«ªÙp?xw}a¸¸ÞÿmúfY Ñqñ¬B©?'WÂm?Êî?f ß? í!ÿÞü<
?Ë@ïþ½ 2·¶rR ?v ©v+(H5ìkõô?=>ÿ¶ûv¾³ ,¸ mÁ\½#³µÃl<?²?úrÇkýO¤áµË î?7?Óf¬i$?K'4«èiz?¾k9è ?9=íH±w»Íñ^ÇHF´¼?±g_?ùonÆ^á):aÃ?*¡KÔTºXï?2Ú^\ã
ÈûнÇîQjÁkÍ´é?j9?ÁMßL+q}²Þ??b÷âLD[¥?X??Á .\?å¥U´1²Úü~üã=ÆZzlËd;Ìé®_Ï?î?´?ïlî_&?àwÛÌyÄ|úù?/Ff$?¦ûµÑ_!åâΧm; ´¯Nö;!?)sÈ* ^Ä À],Üv{Ä¢¹8sz0 ?ÕX %ã¼chÉÔa¬qnTÛõɨ²é·¬ôXCldc< ³/çàW<w??w?
ÉÅǯ7¹Õ? ã1§Îú_ûÒW·Ãïéêç¯[u?=;¨?ûjûìɱ
üá?Ù?Ó½lõq;½ûÙõ½»"2àsVè?`ãNÎÜrÝY?2 æl?Þªö¢ §Fd§ë«;§¾õùãfjS,ÜümÄX ]ã ; ?³ZÓé,Ü"?^dâY?â°² ³ÜL?2§gC¤
hÎ:WÝ4Þ,8«`²I*hD7óö¬0©®B¾ ?à>¢àYÛ?w[7| ?@?9¬´Òcû$Ì%gÁ?~k¤`weD
âÈ.4+®iÚxièÁ'ñ?NkWñ?ÏÜE
èñ¸mÐA¥îD]³?°íÚ?0EÜÞâ?·??>U:´?©iHL#¥u%Ü®Ziܽ
?ICÑiëÛ?»t½ã?×LÒø¦§ Û?hÕïä¹ø4Ó«âN´o¼x! Âi³ ¸³b
0³s¾KûÒ¬jxÈbò±.shÚazÓ³¬M?á«Ên?cRjR9d`Ñ?øn?7¡?v?d U·ÝÁ ;R:2NñYÕ,IQT?[T :5snå«?uFÝr??ßRÖ(Üâ78?ò p?Aâ? RR--??ûèâ·?ÃTázÆi¬??êÒK[²'ÚE¦¬;??pB*~xFèÙC«?:F8¬)ê?¬dx,fn²I¹¸?
¸9â°×SRiÄY?vÝpódZ$n×
3$Yа?¥B0$²ÊÄ?OM·F7Å1"zOIj? t%Ð*¸g
]´"nºù]vqZDìR þ^!N±Þ PA5´Ô¬îÞÄî?ñiu"Ϫ?Û?X_S=¸VïÝi xå?úf /x±7Pwz¿âìZ Ü:» ?µÙ n/è)8LVJKã9¦SÜÈèg7ì/»¶Évw??úIEND®B`?
DdÍèèðB²
ð
C ð AÁÿ?°ð?bðtNÎ?ííB¶´Kr[ÿPcÞ
n ðHNÎ?ííB¶´Kr[ÿ?PNG
IHDRxcßSÝsRGB®Î é pHYsÄÄ?+ÜIDATx^íÍR1Ç^(9xð XÊ ? }¸X^±ô´ôjyYß?#\,à <b O2f¶wC6?I:ý?É{Z0étÿú?ÎÇeÓ¶íÆóG?@S!è¦ihW?
d|Ð}¬d^?¦h??ô´???âäXq
vV%??Ö)J?ÝP
? G?{1Ç´@[ ?·ß¦??ò «?0¦ªèÉBôD» Ð A´qQO´²@î¥? =Iñ;?Å?|>&) ?ÑÑA?ç\??¬ ©0) ¥Æ?%¢j r6hÁÙ¤?FÃ8'öÍ,?8#e
Tgc³"ß,f?~â??¹Ç?~¦ É¢F~¦ìÊ?Æ:
zòÝÏÃæðç ø`~°ß??lÝ ¬ SZ¾<ù~=0¸?VtÌÉ?ù|ãËJÔDSÐ?\QÇ@§äÜ?õúýÛ³§*ê,ÖaÐ1?rGzûøãSµÝ?`6×Ð?
ç9ëDý»à¬k(`?dí?Æ
Ù
¶õÉÉe]ñö&Éz
4?ò" ÙûùAáȦ6ÜÚ¥ôÔ¢Öò7ðô(?ã¥
¿Nh?Ë´[)èdj?
29?h>ä3ïÀRÂóG2ÆtÚI.å&aÈçÑLíYÓßFÆ,(?¬'Ç:èð?΢٠ë¾(K?&P?I#?*
zÄPKÝ???S?ØÔ«GQEO%©"Ú÷?Qôu| :y©è?jÏâ`!·;,§"ø²?¸Â*Ú¥s}}
ïµçÍþ7ø~zÕ 57ÁHf³?û{5wtB÷,¾¶± ºDéX<®YÞ^Ä?·n÷7®ÚÖü¦ý7ÿ³x»µ× (» i??z? 4ÖÐõÒk?!ÌñRÎô» Ç÷71!»½tøÑj?ì?¸Gî?á¾V:4F
ÆÐÝÅy>[TS6¾6n«â À=ô ^ª¸UJÌG[%ùk?º?жo~5ÍlvÞîu¥dëÉHAÐÒ £5Û¦X1É~m7
??º¡8??voÝ~ÞY<y?#¶Õch Ó?fÏ?¸º?¡ ?b¶ ®?
eSABÎ?-²±U7²}V³»?àJh~yÓ u{®htû??ù¿¡í]VHPI²º¸iûôàp®).è??»· ? ãGpëv¿û j?ù|Ú½ÇÐ1-½m5¦W×Æ}³øK?,Ðiá?.&¤ ólç¬u>vy¤%(jë 4h9cÙ9}ãnàÀ?äÊF#³?Ü×tgM
ãòdguë¿É¤G| ë??
ìo¢ >ká]GÌ[§t?~ûU¬tº´òÇ?ø ¿Z¥¬h'â?þÞ¥Tôxÿ½ è³ËW/¶e@â7 õlõ?A;5úÕÕÚm?ò?ò)?Ïb}¿ºGY)o©ÿ¾}|±º?4&D#TWý??ÇËIå~gÅvVV4ÖÇßî1?fÖ
ÙäÓAó·?ø5Í?Y{.R ½úNm¼?uRnL9 .?àê&³{?Áè?ûyb)?FÁë?x!ò?IY$¨Àö?o?ÿ
\®IEX3ØGq|,??å£,??1?|?nE?ÉZ¿?VBè?q?¸NBð9V?$hã¹=þôF²Nâö@[ ×?8²]Ñú«,÷À9ô^G|z©@óùZY3ôhZkv°Ð ?ñ}ÜÌaEÇ©3?? Ú
¾ç÷?8?kq wl?rY?²í÷n²<îý?->`?:²xn0ª
51ÈÈã á7??Üä& .S?òb¢Î
#² ÓL?÷?£óO?4½?;=9?I?àÕ²N3Vz0??ï:ªe=JÂ~Îë2x©¤Á?c£?òiÀ{»½ãp) sùñ?
oã_??$2bå4hqQ?¡VÀHZÑâhså£
?àöO+į?ʹɺö ?»SqÖÙ?6æö#ØFv8?d]J?×?¬?G¸µáE3B¦?h{á`¾dMÂ??cÜIfÈy¥?_ª?JüÞ1R
?äCI9 t7 ¤ÿ,q??P&?O×Ì9Åg¡dAvÃÃR´PÖ'%px³áÈ?ÖX$ñ\[j ^Â_sô|Ú7¥í¶¤¢ûµ»þòm7òâ?ór©ºþò-áÒ Ýò]?À?Ix Ð5¼°?Gí Ü 5:ï"E»
ÇCP¯Ñ?"Dú÷Sã?BÑ?ä?þô±*¬ícåþa&Ä$ÚäÝGO"¤:üÎâ}?µiQ
IEND®B`?åDd¾èèðB²
ð
C ð AÁÿ?°ð?bðO%]\ ÜCÎë¨Áekýºÿ+m Þ
n ð#%]\ ÜCÎë¨Áekýºÿ?PNG
IHDRxbK?xsRGB®Î é pHYsÄÃÚj?Ü·IDATx^í?ÁR 9??jsÈ!1Ô^&?=îÀ-WRÙWØ"×Ü&oÀ5.[°ïk
ò$7ê1 Ûmɲ¤vCúÃزôé·ìvw²ÚívG]«Õ?çQ?±ø@V³;?be»$h??éB¯@G8ØX),,Ç*ûc:X?,mP??ÝP
?£¢?ÝÌ1-Ð^Âf?Pà¦mÌü?Ý?)UEO? ?8L?^b ?zrà?v/Xèè©?Mª½£xP 5?ß?IÊ?
`t|Ðâ9?¢#kG*Lh©±e?¨Zk¹´àlRE£a¼%öã*?ZFª¨ÏÆn[Å>Y¬ýÂ)7æ?
ú7eÍ5 ôoÊ¡?y¬qÐ?? ¾¼]½ýò>¸þ÷ÆI¶?îÖhLË7?ï¦qE??Ül·GÿîEÝA4?.Ô?º?óÖ?ïÿ¾~©¢®bíS(¤OÎ?¾TQûMes
?ég?ëAÔÿÎÚ¾?V(ë4UÈa°?¨/.nú?ßØ?õhåÇ?Öï·ãÈ?6ÜÁ¡ôÒ¢Öò·ð ô,?Ë¥¾Nh?«´Û)h4µh?Jͧ|n»a±ðü??1?îS;èRÞa¦|?MÑÄÔ.?u6ýhbÌ?ò©qq¬³Ï è*
ÊÝűNEi
?AYp&ÍhÊô?¡ZNÁã¥HléÕÃTÑKIª?ö#e?¾?ïA£??Q¨þ^ ,Ôv?åT_??PXv?:þ? ãîn/½ë
?·ãßÒ ÐË[?l7ý?·ÀHRÜ©Æ =\PÖ?¸Ü£ó³£ïýöûYþ9: ¹{¼ ¬0>g"?F?õæ??/Ð?×'àéÉù·Ý·óñÃè<X{â¡Æ?¡úfÞ FÂjÇòí«_r¤?D)Ì?¾û°:ûäÚ
º²qµL{§Ã×k/m÷û??Eq2? JjS©Ña<¨Å ×WÐöÝסÿ(
©? 6@ïìl¦nEçËÂ! ´«Ø§O CÁ¢?Î6à)4;é?#m)¬h?य®p*v?])Sn íëÕ¶d4°Øu@5Ȩl}5ì5 §½k³ÙÞÿµú?CÔ* Û¬ÛìîaÇÐT+è???· ÇË
?}sÌí5 V¸ë?W?)á¹?°V_á??æ/e6Æ3ïTºß8_??k]5 ú~y¬ï:ôµw?´\±ì\¾Ku ?r¯F³â¬ù Itn.N÷%8}?I2ø?)Ö{V°¿)^í¬?w %o?Òqùé«?t1^ßïýÙÝ[¿Z¥¬è Ê×?ï? ª¨<«Æv ¯oÞüq"Ã?¾ñèg«§:¨ÑonN3dcVÜF°b¹N¬ñïÅRS°?Á Î|_åD¶qËb -Mù?/hÃÅ?ÀgÚE¹tÌJQβ¾óA·o3ÞÍ4
±n4?ªªéXQw>h(îø]8vSÀcBl?s#åÔ½áQV ¬Æî(/^?Ù)§yjR4BÔ
? ®)??Qt»]uã´`×ëÈÿÆ?A ¼ýn?ähTÄzÁÑ>d?÷(«?§´ù?È *¯ëTô!ʸ³OÁÙ·]{Kwt¿
´þUVXIx¹?Â
}?h?æâ? ?Õ æ¹ sâ|?cÔ?´?} S×tü^+Ãh¥í?f½ÅBA ¥U* ?^FQ%?+W\ºñÅ??'_?9®?´ Ð¥úuøx¿ 7??±?T?p4WJ?Gß??ºJ)häY?íUFßòô"ëñ¡ÍÜ?wË
f®Q Ë?utËz.?¼FØkòPI?u?M?jìÓ@÷ªtz×ÂÅ>fûé?oó ?Ú±?2Z\ÔâE¨Á-??a°V>Ú
àþP¹Åº??Í´ÉÒï§<¡??þ?L¶l?d?IÛ%¼t?þ1f}9<Æ©?/?6åA£?ÓÙé<y?«óì?Øud°
òÃq@???ðÉ@ËS D´W?@??l
?(D´efé??àÆ9??:Wá
ÙRw?æ?Ú#¸Y(Ë" +h_µ?®n
Äò [±èwÿ7Ûäð·wÄê©¢i3cÇÔA÷&p3 G©5ÝÃþÄXÂ3?? w>é ßÿEibí²VtÖèh?G$=?âÙ!?«mÖèx?±þ_?®°fÖÞÎý«N·íëΣ»
£Ç~éûÂéÀ?K?IEND®B`?ÁDd& èèðB²
ð
C ð AÁÿ?°ð?bð+÷ª2?°?Ô=Ë2???éÍÿR'Þ
n ðÿ÷ª2?°?Ô=Ë2???éÍÿ?PNG
IHDRz`]vñNsRGB®Î é pHYsÃÄ?.>£?IDATx^í=r9ÇÝ\»Ø`îà¡HìÚ
¹l???#@AJm2ÜÀéN¶?½ÁlÙ{?A=o,?n}<½/©±'2?ú}üÞ_ORw?ív{`ò?Áû1s:Ϭm?Aæ
¡£ZÙئ?Ûë¨CÐaa,ãTÁm¯?Z]GÇ?-?Û b²#ª)HâvvÞ7ð¥RÊEª"ð?dGj$%?[I²ìÈÖd³cáÖ¨???Þ??iq F ?IÖ²HÊܲóK?¶5f
îjãcú«u×Ûx·õ
oÔ?W?û?³®?; _û5àã ?ûu(U2qî$ë?O§Ãé§?ÄýÁÿÌ?v½[ /ã.éúêüã¦w6ÝÄWÆ]õd
½>xw+ðnÒ2 ? ðî?´Ç´?¿|qy_^K<?ÛÆ° y ?½¾¯÷äf<?@ã瑩Fÿm2?{t¬0Ä#¸±¢ ~~~Õ# ³?0
ħ¸)¬w ^®OÌ2[¬£é-*2îÅ<ðÜMXç[ ~ýÆF5×5îb?¨X¯ËÄÌ>æ(?ý?¾Ãݧ?0Ë}oeÉÄÜRÝÈ
/?xJ{ÜÈÌuTåqqÄS·Qwk¨ñâ?G¥Ù7µà¬jkªî¶ ?yNÇ÷Räöôku/¥´"?`®ño?ÀûÂÜ®sö§y°P{9,¶"«?LØ?âÝ%¿y5<û9\|Ù¾_ÅÓ?ðÝl6Ui»Á«Õi3ômp¬ÈLrïþ}
Ç?/_\>;???˱§F îí?èSܪ^½$!±H×r?ÿ8ø3BxO&
åHIq7?n?ÛË9jt?¸í%ÓF2 j3?6P#?]º"îxkxg×dÀ¾?îFfðy?µ[3½t-Ü?íMqÌؽwO<󼢸'è Äý ØÓ')Ëì»? ?»§éál2?ÇÚÉ?F*é¢æ çÚ}»L¤Ügñ?¬Þ_¯¿>sßíö 'ëëß?0Öòc ²°·Ô
$>9"àÎI{|gsÿq9Gßm;<ûÝÃ}Þüò?
?æñãooß~{||ì¼??c???áâ.Ï;§ØÛ7?.ö}C$t?ÀÉx' 7èºba¹ømܲýøÉoB8?a®ÄY¸Q,
®În[óü-+=Ö[¤íìâqª ×åR|â*;?\ØA3¹øðצ?¡ú÷»x Çíu?×¾ôÕ ðûõäë7ê<{v`?ûòêé?
CøÍ ~d42~?[*Qä?ÞýôKêö*ÊmPñ?7ë.¯Ø ?BdÝï®:LFs?J$Gä°(&nó¥²Tð{õ½iï¶'Ë?¶xÀ,Ü
´g?aÎíàgÃQ¶?¸ÄY¸Ýõ
?¥Ç, ?u4¼7óò"5Ú?欣[®ºi,&WAK¡u?hLÖ"I%ÕÍ·/ß L{?[]"Ä?F ð?{í0é»ßÍ©ÚD§¸e? íCÍhÏ4ùF àãÊT²Â¸]¶^ãs ?{#)p?^áåÜhbwfÛ?½%ù?IÖtJé??OÙ9T´O%7ÅC
âÕW[??ä?¦æÐ?M<j?ÎK{´
n ??[»MÖarßP]즿5??=óM?oGP0nß|j+]?á?|?¦¸skÈnC?Ñ>äCØtªR.¶?ýÎþ¡ªìÈ??6
ñS¤hJ|@1¶È©?¦ ñÐg°ÈÚe?ÄwK ?R?:!KÞ3é?x?y§HÖIu?u
â ?ø¬,KRUá? ??eÎ|U±.¨»UKñ[Ë?[\àâ?R n&N N?jhñTüëôp<?!
"?©Â§±vF*pK ÃÐ?qXRæ¨~VIèÅM«=2²Gfù«Õí+,ØX?Ï>zúo¦Dz7ZÍ»áül%¸Nå,
?) ÷Øû¥(n Z6G.n?F°±ðéZOM·F7DF3%zOI¶?*EICF»J51uOvÓKl/ª UÔ=?Þ?wÿØSv¢Gç??º£?<?dj
»??§(Ì(X?y?5ËÝÇc¡î~Än/çfêN #ýa²¶`Æû)¥ê?úR?Â??ü%´i>Ûá*Ý ?`Ê0?¹?V$
?e©1â?J¯7;Õ÷»{K`Yñ<à6×wؼc©`ÝIEND®B`?TDdbèèðB²
ð
C ð AÁÿ?°ð?bð¾´xÅf\?9µ[.R?ÿ?/Þ
n ð?´xÅf\?9µ[.R?ÿ?PNG
IHDR~h¸ÎÓYsRGB®Î é pHYsÃÃÇo¨d&IDATx^í?ÍR 7Ç?¼Pñ!¿Kåe?y¸¸|%?BRñ5?Ëú
8â?? x I?d¢¡weí?>Zý!i?ÝÓ~Hî_ÿÕÒhº¾ï÷v¯ºfÑw]GÒlD£pZA?M&(h??{d¯jèG
?È 1q? ã´)?ÞE Ê: +n?AÑ? ¯»Azõ ÓU½ÕW?ÐÝUñS }E5e©~¼ë(8 äÑÏúthÏTaô?»¶Ç QgõÕ?E?Ô?}?Õ dÐk $Kâ?¢ã¢WÕ?8D²A0éè5¼!£)ÓQ6d"z¥9X? s©Ø"ø!56aèº?- ùTÕõ?ý+ç.?û<ô;î?^DøèwÜ]Éóécѹ?}>íN??Wæ?}/855ŤB?Ò
ûíÅ?÷âiØ-ú?ÿ'ËåÞ_ká7 «?k á§Ñ§$?ôë?ß®^«ðÉôcè
t÷ýÁù ¯UøvÃ?»Ù¢èøàÅ ü¯
sz &U}?z¬Ø],?ð/.nçAJÉË,ú ôî/¡,>,O?bÚF³?ã32úmäC? p? ÙâQ¸O¼Dâ×Y¯ÈÖë£O:?l@f¤×ãsz_¯çß+·¼ ?«ò¼²¶
åÝó??ñ¹²ê?ÉÆDÒt¼?Ð#)àM'[f8;úI?«©>?;d1L2ÙM5¨??À½)j"ÎÔA/âzûFâÓt?~.2ܦ?
SAõsI³È¬?heu5[? +ë??YÀr»»D°"?Ø?Fïòº¿¿ïúëîø¼¿¼ëϺoT?ÅÂý?p¶ã?Nè?
d=jB_®àw¼ÖOßè?¸ï?? ïÝõ½ù¦ÿ¾üv|ú¸4
¸» iª?{0ihô½½V3WO6<Â|´ÐW?7èßïý{sþü»Ûˤ>Úy@ö Ü#wÇd"Vp?
½7ª)ú!òëÅK½1ÅæïÎI?Uºw??Á!¨??Bf±-H5ugC!éûw_ºn±¸î??Ò M?Ê ¥;:F¶M?$
Yp0³Ç«zÓþã??/wxãÐmÍ !6
??®?? 4õG]õî^Lf{ã*Ýp7u)ö,i#Û?lOnVn?ã]cÍ?ÝÙ°¯JÍ°?9Y~m.³??ú?ÕÅmL»nð2%?>
&ùáyØÕËxæÝ8>¿ùƼ>¾yÆð2-GÛ|L¯¡ûHnÕÇsЧÅe?ü2MàW?¿Ã*Zàe^ÚX?Â÷:ÀEzÏXÐ
.ß¹ÛGð)¹fÒØÁL"÷5 UésÑ£»½8\_:N?NÓã¾y?þÚ?öRÑ?¾ú'æ¿Sp.?})Vp?.ý1ç ?+
¢z?Á/'ßþ{J)íuü^ýÕíÛ?dÐâ79íl4ÝÈ? wjýÛ»S?$¤¬¯lÁ0ùj1î×??¿?ÄÆ88¿Y?Ó?f"?
K)ÔÑß?7ç«?ç¾g¥t.¢z?cÛßgûÑ3«?¸èùÅ
¿Z?(h_?úÈ:ÁE/²Té'%É?¼Ò n¯Ð3ÅËì?$HkP{<sª§qõb ¶L}`r *½¹Fê ?ñ(x3¦{?S?LÈÈÆ ô??¶??äÝAð2r7Ü?Zc¡oÆIê&ÁûãI?òèM,ö?I???ú?
ÉCÔÈ??Î,÷.Jè9?ø¤Í@Ï'n?"5c¹¿ ´i ¬¨Ó0 ä[°¼??Qp9ôn´ú¶Ù 9:Õ???üÐÌ[?9QÅ Èá!ð??ÛwºK±% ???,Bq·³~ÅH¾z¯(ÜL`Ê7Ä?¾ ?FÈVt¼äýè³úçz&b
)+?oü.xßüW³4Mñý?»<wið ¡YúYá?Ìe®c±3?fé?? +?{LõvAXÍâîr2J?É?Ó?æUúä?C?Ï\úÒ¸§U??økùIæ?E/.|q?µÐs
ÆM ¥¢O Ï??Q¨/Ó?¼sJñ£¤Ad3
¾JÜ?W³ñ?Ù OZK6(I Æq [pÜðµ"?ËòøÈ#?p'ªÞfÞ¼?:
Å#'´ÛQ¶îåÕúi?hÜÝ2§»Yù?t¥]¾lå}½I?ÅWoQõ¨? ? Áâ#KÊ?^hÜ?£W
¥Ø?íèA+8ÓÍâÜg?6t-ôû ²rs;?®?ÞM@û? Ê?J²ÖG$VRMYJ¯èX!ôM?*2 /?"?Ë,¡ÕÝ?V?y
èG?>*?À
\u?\ñ
úS
?âÊ濯¡96?QB?
©>îý"&ZZÂ0?ÅÛ4¤zñØ7H9¯o<¤¹¸·C_-S;ô;ôÕTx§ú újª
ü?ì]?^ð%¹IEND®B`??DÐÉêyùºÎ??ªK© Ihttp://csdl2.computer.org/dl/proce
edings/sadfe/2005/2478/00/24780120.pdfàÉêyùºÎ??ªK© ?http://csdl2.comput
er.org/dl/proceedings/sadfe/2005/2478/00/24780120.pdfíDÐÉêyùºÎ??ªK©
http://www.cymru.com/Darknet/àÉêyùºÎ??ªK© <http://www.cymru.com/Darknet
/?@@ñÿ@|NormalCJ_HaJmH sH tH b@b| Heading 1$
& F¤ð¤<@& 5CJ KH OJQJ\^JaJ d@d| Heading 2$
& F¤ð¤<@& 56CJ OJQJ\]^JaJ ^@^| Heading 3$
& F¤ð¤<@&5CJOJQJ\^JaJP@P| Heading 4$
& F¤ð¤<@& 5CJ aJ N@N| Heading 5
& F¤ð¤<@&56CJaJL@L| Heading 6
& F¤ð¤<@& 5CJaJ@@@| Heading 7
& F¤ð¤<@&D@D| Heading 8
& F¤ð¤<@&6P @P| Heading 9
& F¤ð¤<@&CJOJQJaJDA@òÿ¡DDefault Paragraph FontRióÿ³RTable Normal ö4Ö
l4Öaö (kôÿÁ(No List6U@¢ñ6| Hyperlink>*B*phÿ> @>|
Footnote TextCJaJ@&@¢@|Footnote ReferenceH*4 @"4|Header
ÆàÀ!B^@2B|Normal (Web)¤d¤d[$\$4 @B4 R?Footer
ÆàÀ!VþO¢QVÌ ?
mediumb-text1#5CJOJQJ\^JaJo(phFV`¢aFtBFollowedHyperlink>*B*ph??×R??R?ÿÿÿÿè/6°¾&4@JLo?»ß6 · Ä E
S
! . Í Ü ï÷E
P
ì
ý
<=]|? ®Öêjx;EGHk?·ÛÁÎn| ¦®àë]nÍûÍÛ/CÎÜ 4 _ ? ¤ ? L > L ? ¦ K Z ¼ Ä Ü!ç!""("H"b"i"Ì"Ú""#6#$ $?$?$?$½$Þ$%Q%^%& &?&?&c'r'â'ê'#(.(o(?(?(»(Ò(Ù(*"*q*?*Ü+ê+¼-Æ-È-ë-.7
.[.h.é.÷.'/4/Ò/á/î0ö081C1Ì1Ý1ô12+222e3s3±3Å3Q5_5A6K6M6p6?6¼6à6í6n7|7?7«
7?8¤8 9&9`9k9?9?99Í9è9ï9®:¼:ñ:;O=]=
>>>9>d>?>©>¶>??h?u?z@?@óAûA<BGBB?B¬BB¸BãCäC¬DDE?EÚE$FhFiFþFGG|
G}G¶G·G2H3H?H HïHðHÂIÃIJ
JJJKK?P?P?P?PP¬P¼PËPíPîPðPøQùQûQüQR0???0? 0???0?? 0è?0?/ 0è??0?° 0è?80? 0è??0?& 0è??0?@?0?@??0?@??0?@??0?@??0?@??0?@? 0è?80?· 0è??0?E
0è??0?! 0è??0?Í 0 è??0?ï 0
è??0?E
0 è??0?ì
?0?ì
? 0???0?? 0=]?0?| 0=]x?0? x 0=]x80?Ö ? 0=]?0?j? 0=] ??0?;X?0?;?0?;x?0?;X?0?;X?0?;x?0?;? 0=]80?Á` 0=]??0?nx 0=]?0? 0=]x?0?x 0 =]??0?¦? 0
=]??0?à 0 =]x?0?]? 0??0?? ? 0Íx?0?û ? 0Í??0?Í 0Í?80?/x 0Í?0?Îx 0Íx?0? x?0? x?0? x?0? ??0? ??0? x 0Íx80?? x 0Íx?0?> ? 0Í??0?? x 0Íx?0?K x 0 Í??0?¼ ? 0
Í?0?Ü! 0 Íx?0?"x 0??x0??x 0("H"??0?b"? 0("H"x?0?Ì"x 0("H"?80?"#x 0("H"x?0?$x 0("H"x?0??$x?0??$x?0??$x?0??$x?0??$x 0("H"x80?Q%? 0("H"?0?& 0("H" ??0??& 0("H"x?0?c'x 0 ("H"??0?â'x 0
("H"??0?#(x 0 ("H"??0?o(? 0??x0??x 0?(»(x?0?Ò(x 0?(»(??0?*x 0?(»(x80?q* ? 0?(»(x?0?Ü+ ? 0?(»((?0?¼-x?0?¼-x?0?¼-x?0?¼-??0?¼-? 0?(»(x80?[.x 0?(»(x?0?é.x 0?(»(??0?'/? 0?(»(??0?Ò/x 0 ?(»(??0?î0 0
?(»(??0?81 0 ?(»(??0?Ì10 0??x0??x 0ô12x?0?+2x 0ô12x?0?e3x 0ô12?80?±3x 0ô12x?0?Q5x 0ô12x?0?A6x?0?A6x?0?A6x?0?A6x?0?A6x 0ô12?80?à6x 0ô12x?0?n7? 0ô120?0??7x 0ô12x?0??8x 0 ô12x?0? 9? 0
ô12??0?`9? 0 ô12x?0??9x 0??x0??x 09Í9??0?è9 ? 09Í9?0?®: 09Í9x80?ñ:Ø 09Í9x?0?O= 09Í98?0?
>x?0?
>x?0?
>x?0?
>È?0?
>? 09Í9x80?©>? 09Í9 ??0??x 09Í9x?0?h?x 09Í9x?0?z@ ? 0 9Í9??0?óA ? 0
9Í9x?0?<BÈ 0 9Í9?0?B ??0?B?0???0?B@?0?B@?0?B@?0?B@?0?B@?0?B@?0?B??0?B@?0?B??0?B@
?0?B@?0?B@?0?B@?0?B@?0?B@?0?B@?0?B@?0?B??0?B ??0?B??0?B ??0?BH?0?BH?0?BH?0?B ??0?B??0?BH?0?BH?0?B?0?B ??0??x?@0???@0??0$O?@0???@0???@0??ø??@0??x?@0??x?@0???@0?
?}A00¼?]½?@0??ø??@0???@0???@0??0?\½¸BãCäC¬DDE?EÚE$FhFiFþF
GG|G}G¶G·G2H3H?H HïHðHÂIÃIJ
JJJKK?P?P?PPíPøQR
@ 0???@0?W2?@0?W2?@0?W2?@0?W2?@0?W2?@0?W2?@0?W2?@0?W2?@0?W2?@0
?W2?@0?W2?@0?W2?@0?W2?@0?W2?@0?W2?@0?W2?@0?W2?@0?W2?@0?W2
?@0?W2?@0?W2?@0?W2?@0?W2?@0?W2?@0?W2?@0?W2A00´½¼®ÿ
A0 ?}A0 ??@0?W2
0 AA00??@0??
0È(OA00¬½?=ÿÿÿÿ0ÀÿÿÿÿÿÿÀ?
0äY½TV_bdg3á%b/?9çA
K/OS]XZ.1468;=?ABC!?Ü#Ì*?089?@¶F$N?XZ/23579:<>@DÿY0@C?CáC/G\GzGRX
ÿ?Xÿ?FMOg!ÿ??ùn?ç/;>???äòùGV?¬Í
Wa?Xÿ?Xÿ?Xÿ?Xÿ?Xÿ?Xÿ?Xÿ?Xÿ?Xÿ?ð@ð @ ñÿÿÿ???÷ð? ðð0ð( ð
ððB
ðS ð ¿Ëÿ ?ðð? ððr ð( ð
ðð?
ð
à ð¾;ÀÀÃÅÀ ÿ@?ÀÀÀÀ??¿ÿ?Ã4?ÿ DRAFTTimes New RomanPowerPlusWaterMarkObject1BD6Su ³6u ?6é
á8Òá80"c- Î,£)¤#? é ]YÒ ¨u éu éF =Fêb
~ Ò ßu JÒ p?Ò Ô=_@J¼@º1BT
ÔA¨¥??<FÔ=îëB^?BÜëB/ÔAU¼@Ü2¥;á _D?!?BQ)1BQ)@·'9?(ê2>-ë>1E 2?BÊ;1B >ÔA >@¥;Ó9¥;)ù=&?HAK1F`L?B?O
1B(PÔAÞOH?ÔMv5ÔM»DNÒ
1RÒSGËSF¦S?
6Su C"ñ??ððð?
ð
à ð¾;ÀÀÃÅÀ ÿ@?ÀÀÀÀ??¿ÿ?Ã4?ÿ DRAFTTimes New RomanPowerPlusWaterMarkObject2BD6Su ³6u ?6é
á8Òá80"c- Î,£)¤#? é ]YÒ ¨u éu éF =Fêb
~ Ò ßu JÒ p?Ò Ô=_@J¼@º1BT
ÔA¨¥??<FÔ=îëB^?BÜëB/ÔAU¼@Ü2¥;á _D?!?BQ)1BQ)@·'9?(ê2>-ë>1E 2?BÊ;1B >ÔA >@¥;Ó9¥;)ù=&?HAK1F`L?B?O
1B(PÔAÞOH?ÔMv5ÔM»DNÒ
1RÒSGËSF¦S?
6Su C"ñ??ððð?
ð
à ð¾;ÀÀÃÅÀ ÿ@?ÀÀÀÀ??¿ÿ?Ã4?ÿ DRAFTTimes New RomanPowerPlusWaterMarkObject3BD6Su ³6u ?6é
á8Òá80"c- Î,£)¤#? é ]YÒ ¨u éu éF =Fêb
~ Ò ßu JÒ p?Ò Ô=_@J¼@º1BT
ÔA¨¥??<FÔ=îëB^?BÜëB/ÔAU¼@Ü2¥;á _D?!?BQ)1BQ)@·'9?(ê2>-ë>1E 2?BÊ;1B >ÔA >@¥;Ó9¥;)ù=&?HAK1F`L?B?O
1B(PÔAÞOH?ÔMv5ÔM»DNÒ
1RÒSGËSF¦S?
6Su C"ñ??ðð_gý!?
têÿÿ8ÍÿÿÐÚÿÿtý!?
tÿÿÆ
_Toc185174509
_Toc185157149
_Toc185174510
_Toc185157150
_Toc185174511
_Toc185157151
_Toc185174512
_Toc185157152
_Toc185174513
_Toc185157153
_Toc185174514
_Toc185157154
_Toc185174515
_Toc185157155
_Toc185174516
_Toc185157156
_Toc185174517
_Toc185157157
_Toc185174518
_Toc185157158
_Toc185174519
_Toc185157159
_Toc185174520
_Toc185157160
_Toc185174521
_Toc185157161
_Toc185174522
_Toc185157162
_Toc185174523
_Toc185157163
_Toc185174524
_Toc185157164
_Toc185174525
_Toc185157165
_Toc185174526
_Toc185157166
_Toc185174527
_Toc185157167
_Toc185174528
_Toc185157168
_Toc185174529
_Toc185157169
_Toc185174530
_Toc185157170
_Toc185174531
_Toc185157171
_Toc185174532
_Toc185157172
_Toc185174533
_Toc185157173
_Toc185174534
_Toc185157174
_Toc185174535
_Toc185157175
_Toc185174536
_Toc185157176
_Toc185174537
_Toc185157177
_Toc185174538
_Toc185157178
_Toc185174539
_Toc185157179
_Toc185174540
_Toc185157180
_Toc185174541
_Toc185157181
_Toc185174542
_Toc185157182
_Toc185174543
_Toc185157183
_Toc185174544
_Toc185157184
_Toc185174545
_Toc185157185
_Toc185174546
_Toc185157186
_Toc185174547
_Toc185157187
_Toc185174548
_Toc185157188
_Toc185174549
_Toc185157189
_Toc185174550
_Toc185157190
_Toc185174551
_Toc185157191
_Toc185174552
_Toc185157192
_Toc185174553
_Toc185157193
_Toc185174554
_Toc185157194
_Toc185174555
_Toc185157195
_Toc185174556
_Toc185157196
_Toc185174557
_Toc185157197
_Toc185174558
_Toc185157198
_Toc185174559
_Toc185157199
_Toc185174560
_Toc185157200
_Toc185174561
_Toc185157201
_Toc185174562
_Toc185157202
_Toc185174563
_Toc185157203
_Toc185174564
_Toc185157204
_Toc185174565
_Toc185157205
_Toc185174566
_Toc185157206
_Toc185174567
_Toc185157207
_Toc185174568
_Toc185157208
_Toc185174569
_Toc185157209
_Toc185174570
_Toc185157210
_Toc185174571
_Toc185157211
_Toc185174572
_Toc185157212
_Toc185174573
_Toc185157213
_Toc185174574
_Toc185157214
_Toc185174575
_Toc185157215
_Toc185174576
_Toc185157216
_Toc185174577
_Toc185157217
_Toc185174578
_Toc185157218
_Toc185174579
_Toc185157219
_Toc185174580
_Toc185157220
_Toc185174581
_Toc185157221
_Toc185174582
_Toc185157222
_Toc185174583
_Toc185157223
_Toc185174584
_Toc185157224
_Toc185174585
_Toc185157225
_Toc185174586
_Toc185157226
_Toc185174587
_Toc185157227
_Toc185174588
_Toc185157228
_Toc185174589
_Toc185157229
_Toc185174590
_Toc185157230
_Toc185174591
_Toc185157231
_Toc185174592
_Toc185157232
_Toc185174593
_Toc185157233
_Toc185174594
_Toc185157234
_Toc185174595
_Toc185157235
_Toc185174596
_Toc185157236
_Toc185174597
_Toc185157237
_Toc185174598
_Toc185157238
_Toc185174599
_Toc185157239
_Toc185174600
_Toc185157240
_Toc185174601
_Toc185157241
_Toc185174602
_Toc185157242
_Toc185174603
_Toc185157243
_Toc185174604
_Toc185157244
_Toc185174605
_Toc185157245
_Toc185174606
_Toc185157246
_Toc185174607
_Toc185174506èè//°°&&@@· · E
E
! ! Í Í ïïE
E
ì
ì
==]]|| ÖÖjj;;ÁÁnn ¦¦àà]]ÍÍûûÍÍ//ÎÎ ? ? > > ? ? K K ¼ ¼ Ü!Ü!""("("H"H"b"b"Ì"Ì""#"#$$?$?$Q%Q%&&?&?&c'c'â'â'#(#(o(o(?(?(»(»(Ò(
Ò(**q*q*Ü+Ü+¼-¼-[.[.é.é.'/'/Ò/Ò/î0î08181Ì1Ì1ô1ô122+2+2e3e3±3±3Q5Q5A6
A6à6à6n7n7?7?7?8?8 9 9`9`9?9?999Í9Í9è9è9®:®:ñ:ñ:O=O=
>
>©>©>??h?h?z@z@óAóA<B<BBBBR
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefgh
ijklmnopqrstuvwxyz{|}~??????????????????????????? ¡¢£¤¥¦§¨©ª«¬®¯°
±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅ..55½½33IIà à R
R
- - Û Û ööO
O
ü
ü
\\{{??ééwwDDÍÍ{{êêmmÌÌúúÚÚ
BBÛÛ K K K K ¥ ¥ Y Y Ã Ã æ!æ!""G"G"a"a"h"h"Ù"Ù"5#5# $ $?$?$]%]% & &?&?&q'q'é'é'-(-(((º(º(Ñ(Ñ(
Ø(Ø(!*!*?*?*é+é+Å-Å-g.g.ö.ö.3/3/à/à/õ0õ0B1B1Ü1Ü122*2*21212r3r3Ä3Ä3^5^5
J6J6ì6ì6{7{7ª7ª7£8£8%9%9j9j9?9?9Ì9Ì9æ9æ9î9î9»:»:;;\=\=>>µ>µ>??t?t?
?@?@úAúAFBFB?B?B·BRÿÿQÆÜ6?RÆLzSÆTªwTÆÌzUÆLz
VÆÌzWƬ|XÆ\?!YÆLzZÆ [Æ\7?\ÆìÚ?]Æ´
"^Æ?$?_Æ\"`Æ?"aÆ´? bÆô? cÆ|ÈwdƼÈweƤ@
fÆä@gÆ$ARFRF\F»G»G®J®JµJÀJÍJËP¡Q¡QªQ³Q³QÆQÆQÑQÑQàQìQóQR
ZFfFfFÁGÁG´J¿JÌJÔJÔJÛP©Q±Q±QÄQÄQËQÏQÞQêQñQöQöQR
8
*?urn:schemas-microsoft-com:office:smarttags?date?9*?urn:schemas-micro
soft-com:office:smarttags?place?=*?urn:schemas-microsoft-com:office:sm
arttags ?PlaceName?=*?urn:schemas-microsoft-com:office:smarttags ?PlaceType?; *?urn:schemas-microsoft-com:office:smarttags?address?:*?urn:schemas-mi
crosoft-com:office:smarttags?Street?8*?urn:schemas-microsoft-com:offic
e:smarttags?City?9*?urn:schemas-microsoft-com:office:smarttags?State?
>*?urn:schemas-microsoft-com:office:smarttags
?PostalCode?B*?urn:schemas-microsoft-com:office:smarttags?country-regi
on??1?2008?23?Day?Month?Year
KK K%K'K6K8K¡KLLLLuL?L?LíL6MAMM?MëMøMûMÿMNN\N_N!O?O²OµOÓOPPPP^PgPkP
?P?P?P«P»PàPêPîPðPüQþQR