Attack Resistant Mobile Agents for Intrusion Detection Systems

The rapid increase in attacks on computer systems has made intrusion detection systems (IDSs) increasingly popular. An emerging research area involves using mobile agents in implementing such systems. The lack of security for mobile agents is a primary factor that has inhibited their widespread use in real-world applications, including intrusion detection systems. Thus, providing security for mobile agents is key to building useful applications based on the mobile agent paradigm. The core problem of such an agent-based system is this: an agent's owner cannot trust its agent, and mobile agents and their hosts do not trust each other. Worse still, if a host is penetrated and the attacker gains access to a traveling agent, he will potentially be given a wealth of new information that will help him attack and further penetrate the system. If an attacker can obtain detailed knowledge of the detection systems installed at a particular site, he will be better able to avoid its triggers. Hence, security for these agents is critical. The overall intent of this research is to develop a methodology for protecting mobile agents in intrusion detection systems and to demonstrate the ability of such agents to address the shortcomings in current host-based systems. This methodology will support the defense of computer systems through a secure, mobile agent-based architecture. In support of this research, a secure mobile agent ID S prototype was created. The capabilities of this prototype as well as experimental results are described.Air Force Inst of Tech Wright-Patterson AFB OH is the author of 'Attack Resistant Mobile Agents for Intrusion Detection Systems', published 2001 under ISBN 9781423528357 and ISBN 1423528352.