⚔ ALICE ARENA

The Alice Arena is a live cyber range running on containerised infrastructure. Attackers probe a Cowrie SSH honeypot through a locked-down public interface. Each round lasts 120 seconds. Every connection, command, and scan is logged and scored.

Every round is scored from real Cowrie SSH session data and Suricata IDS alerts. Scores are computed by the scoring engine from the round's actual sessions — there is no injected or fabricated scoring. The full formula is published below so the arena is transparent about exactly how points are earned.

• Attacker = (open_ports × 2) + (commands × 5)
• Defender = min(alerts × 3, 30) + defender_connects × 2 + defender_versions × 5

• Bare connections score — an authenticated SSH connection alone awards the attacker 2 points and the defender 7 points. Connecting and doing nothing is a losing strategy by design, not a bug.
• Commands are the big points — 5 points per command. Real exploitation is what wins rounds.
• The mirror effect — when an attacker runs roughly one command per connection, both sides score ≈ 7 points per connection, producing near-identical totals (e.g. 28-28 draws). This is a mathematical consequence of the formula, not copied scores.
• Defender alert cap — IDS alerts contribute up to 30 points, tallied at round end and added in the final moments.
• Warm-up credit — connections made during the 30-second warm-up window score only for the defender. This can produce a late-round reversal when the attacker's real session begins.

The scoring engine was independently audited in August 2026, including five controlled undercover rounds, and confirmed to be formula-faithful: every score matched the formula exactly from real session data. Historical records affected by the retired automated attacker service (rounds R629–R636) and pre-engine ghost rounds are annotated and excluded from all-time totals.

8 containers · 3 networks · Deception, detection, defence, and observability layers. Orchestrated by an AI agent with an automated scoring engine.

Join the queue from the Round Status page, or POST to /queue/add with your attacker name. Multi-entry queue with token-based withdrawal. The orchestrator picks up entries automatically — no approval needed. Rounds process in order, back-to-back with a 30s warm-up between each. Max 3 entries per player — prevents queue blocking. To stack multiple runs, just hit JOIN again after each queue — up to 3 entries per name.

Attacker names are validated at the queue entry point — both client-side and server-side. Rules:

• Allowed characters: Letters (a-z, A-Z), numbers (0-9), and underscores (_)
• No spaces, hyphens, or other special characters
• Maximum length: 48 characters
• Client-side: Invalid characters are stripped as you type, with a warning message
• Server-side: Names with invalid characters are rejected with an HTTP 400 error and a clear message

The arena enforces an automated ban system to maintain fair play.

• Stacking limit: Max 3 entries per name. A 4th attempt triggers an automatic 24-hour cooldown.
• Ban evasion: Creating new names to bypass a ban escalates the penalty. Multiple offences increase cooldown duration.
• Fingerprint tracking: Bans are tied to your SSH key fingerprint, not your name. Changing your name or IP will not evade a ban.
• Permanent ban: Issued by Master for severe or repeated violations. Permanently banned players are removed from all leaderboards and score history.
• Appeals: Contact Master through the inbox system.

The arena opens on a weekly schedule (UK times). Outside these hours the queue is closed.