Mobile Agents for Intrusion Detection Jaromy Ward

Mobile Agents? What is a mobile agent? –Autonomous –Move on own to another machine –Platform / Agent –Duplicative –Adaptable

Traditional IDS Hierarchical –Intrusion detection at end nodes –Aggregate nodes take data from end nodes –Command and control at top of hierarchy –IDS reports possible intrusions to human The user must than make a decision –is this a real threat –What action should be taken

Problems with Traditional IDS Lack of Efficiency High number of False Positives Burdensome Maintenance Limited Flexibility Vulnerable to Direct Attack Vulnerable to Deception Limited Response Capability No Generic Building Methodology

Problems with Traditional IDS Lack of Efficiency –Amount of data –Host-base IDS Slow down performance of system –Network-base IDS Cannot process all network traffic High Number of False +’s –IDS’s still have too many false alarms that an intrusion has taken place. –Also some attacks still go unnoticed.

Problems with Traditional IDS Burdensome Maintenance –The maintenance of IDS requires knowledge of rule sets, which are different from system to system. Limited Flexibility –IDS’s are written for a specific environments –Not easily ported to different systems –Upgrade Requires shutting down IDS

Problems with Traditional IDS Vulnerable to Attack –Levels of compromise Root level – worst case Aggregation level – next worse case End node level – not too bad –Lack of redundancy –Lack of mobility –Lack of dynamic recovery

Problems with Traditional IDS Vulnerable to Deception –Network based use generic network protocol stack for analysis –Attacker could use this to decieve the IDS that the packet is good when in fact it is not Limited Response Capability –Delay of Response Human response time Distance from end node and controller

Advantages of Mobile Agents Reduce Network Load Overcoming Network Latency Autonomous Execution Platform Independence Dynamic Adaptation Static Adaptation Scalability Fault Tolerance Redundancy

Advantages Reduce Network Load –Computation moved closer to affected nodes –Reduction in data to be moved Overcoming Network Latency –More immediate response times –Closer to end nodes Autonomous Execution –Communication with other MA’s –Cloning of MA’s –No need for central authority to take action

Advantages Platform Independence –Run on any operating system –Only need to write code to run on platform not OS Dynamic Adaptation –Reactions based on previous intrusions –Learn to avoid or move towards areas –Cloning for added protection

Advantages Static Adaptation –Upgrades only require introducing new agent –Old Mobile agents removed later Scalability –Introduction of more mobile agents Fault Tolerance –Moves encrypted in the network with data it may need

Advantages Redundancy –Central point of failure removed –Harder to locate MA as they are always moving –Keep in contact with other MA’s Determine state of network Help other MA, produce clone

Disadvantages of MA’s Security –Need for PKI –Platforms need to ensure MA is not harmful Signed by trusted authority Encrypted with public key Code Size –IDS is complicated –Minimize agent size Function Platform provide OS dependent operations

Disadvantages Performance –Language used InterpretiveScript –New Java VM developed to help save state information of MA.

Intrusion Responses Dynamically modify or shutdown Target Automated Tracing of Attackers Automated Evidence Gathering Operations on an Attacker’s Host Isolating the Attacker/Target Operations on Attacker and Target Subnet

Intrusion Responses Dynamically modify or shutdown Target –Shutdown compromised target –Gather more information from target Automated Tracing of Attackers –Follow trail of intruder Automated Evidence Gathering –Mobil agents move to area of attack –Determine what collection is necessary

Intrusion Responses Operations on an Attacker’s Host –Limit operations of Attacker Isolating the Attacker/Target –Prevent network traffic from attacker/target Operations on Attacker and Target Subnet –Deploy multiple agents to flood systems

Implementations Mobile agents deployed in Hierarchy Composed of three types of Agents –Data Collectors Collect specific data Minor processing of data –Detection Agents Detect intrusions Trace intrusions –Manager Agents Oversee Data collectors and Detection agents

Conclusion Still under development Show great promise Wireless networks could use Mobile agent protection. For more information visit

References Wayne Jansen, “Intrusion Detection with Mobile Agents”, National Institute of Standards and Technology, October 2001 T. Karygiannis, “Network Security Testing Using Mobile Agents”, National Institute of Standard and Technology, June 2002 Peter Mell, Mark McLarnon, “Mobile Agent Attack Resistant Distributed Hierarchical Intrusion Detection Systems”, National Institute of Standards and Technology, November 1999 Gene Bradshaw, Mark Greaves, Heather Holmback, T. Karygiannis, Wayne Jansen, Barry Silverman, Niranjan Suri, Alex Wong, “Agents for the Masses?”, IEEE Journal pp , March/April 1999 Asaka, S.Okazawa, A.Taguchi, and S.Goto, ”A Method of Tracing Intruders by Use of Mobile Agents”, Proceedings of the Ninth Annual Internet Society Conference INET'99, San Jose, California, June 1999 W. Jansen, P. Mell, T. Karygiannis, D. Marks, “Mobile Agents in Intrusion Detection and Response”, National Institute of Standards, February 2000 W. Jansen, P. Mell, T. Karygiannis, D. Marks, “Mobile Agents in Intrusion Detection and Response”, National Institute of Standards, February 2000 Jai Balasubramaniyan, Jose Omar Garcia-Fernandez, David Isacoff, E. H. Spafford, and Diego Zamboni, “An Architecture for Intrusion Detection using Autonomous Agents”, Department of Computer Sciences, Purdue University, Coast TR 98-05, 1998 David Kotz, Robert Gray, “Mobile Agents and the Future of the Internet”, Department of Computer Science, Dartmouth College, New Hampshire, December 2002 Christopher Krugel, Thomas Toth, “Applying Mobile Agent Technology to Intrusion Detection”, Technical University Vienna, Vienna, Austria April 2001 Christopher Krugel, Thomas Toth, “Applying Mobile Agent Technology to Intrusion Detection”, Technical University Vienna, Vienna, Austria April 2001 W. Jansen, P. Mell, T. Karygiannis, D. Marks, “Applying Mobile Agents in Intrusion Detection and Response”, NIST Interim Report – 6416, National Institute of Standards, October 1999