[ PROOFECONOMY ]™GlossaryOriginSpecsProof Swarm
A Proof Swarm is the full, ordered set of good and bad canaries released against a security control in one Dead Canary Protocol run: bad canaries execute real adversary techniques, good canaries perform legitimate work, and the two are mixed blind so neither the control nor the witness can tell them apart.
What it means
A canary is one test item.
- A bad canary executes a real adversary technique, such as a MITRE ATT&CK or ATLAS technique, and produces a defined malicious effect if nothing stops it. Inert test strings and signatures are not bad canaries.
- A good canary performs a legitimate action and produces a defined benign effect if nothing stops it.
The Proof Swarm is every canary in one run, in its committed order.
The rules
- Every canary carries exactly one Color and a committed Path, both sealed before release.
- A Proof Swarm must contain White (ordinary good) and Red (known or mutated bad) canaries. It should contain Gray and Black canaries and may contain Gold.
- Good canaries should make up at least 30% of the swarm.
- The good-to-bad ratio and the release order are randomized per run from a Time Anchor pulse published after commitment, and they are not disclosed to the Provider, the control or the witness until the run ends.
- Good and bad canaries must be indistinguishable to the control and the witness by anything except their behavior.
- The Issuer builds the swarm and holds the labels. The Provider of the control never does.
In jail mode
In a Jailed Canary Protocol run, a bad canary is bait, not a weapon. It invites the agent to commit an offense and is inert.
Former name
The Proof Swarm was called the Flock in PP-SPEC-077 versions 0.2.0 to 0.7.1.