3 June, 2016 Toorcon Security Expo Hydra Intelligent Agent: Instrument for Security One Size Fits All Distributed Scanning Distributed IDS Distributed Assessments

17 July, 2001Toorcon Security Expo Introduction Hydra integrates IDS, scanning and vulnerability assessment tools with an agent framework Uses intelligent agent and AI techniques to collect, evaluate and act on events All tools are open source and freely available New tools can be integrated into the agent framework

17 July, 2001Toorcon Security Expo Hydra Integrates a Set of Publicly Available Tools ZEUS: Infrastructure to build intelligent agent systems CLIPS: (C Language Integrated Production System) A productive development and delivery expert system shell Portsentry, clog, nmap, logcheck, snort, et al Hydra incorporates these and other tools, using the FIPA communication protocol to bind the agents together  FIPA is a common group of standards describing the communication and other protocols for intelligent agents

17 July, 2001Toorcon Security Expo ZEUS Award Winning Agent Building Toolkit Provides an integrated environment for rapid development of multi-agent applications Entirely implemented in Java 2 Open Source (released to the community by British Telecom in 2000)

17 July, 2001Toorcon Security Expo ZEUS Agent Creation Provides a framework for agent communication Contains rudimentary intelligence Supports quick understanding of agent based systems

17 July, 2001Toorcon Security Expo Agent Creation with ZEUS Agent ontology (common vocabulary) is created Societal responsibilities are determined for each agent Agent tasks and rule bases are defined based on the agent society Skeleton Java code is generated for the agents Custom code is added for specific functionality and user interface Agent communication, fact management and rule activation is provided by the ZEUS framework

17 July, 2001Toorcon Security Expo ZEUS Encapsulates CLIPS C Language Integrated Production System Productive development delivery expert system tool Environment for construction of Rule/Object-based expert systems CLIPS contains knowledge representation, portability, integration, and extensibility ZEUS contains a Java implementation of CLIPS  Full RETE algorithm implementation  Flexibility in rules and inferencing

17 July, 2001Toorcon Security Expo Common Intrusion Detection Packages used in Hydra Portsentry: a host-based intrusion detection system which monitors TCP and UDP ports Snort: a lightweight network intrusion detection system, capable of performing real- time traffic analysis and packet logging on IP networks Clog: simple TCP connection logger Other agents (such as arpwatch) will be included as time and resources permit

17 July, 2001Toorcon Security Expo Common Port and Vulnerability Scanners Used in Hydra Nmap: a utility for port scanning large networks; it also works fine for single hosts.  Nessus: a free, open-sourced and easy-to-use security scanner. It compares favorably with the more expensive commercial scanners  Home grown scanners, based on other open source scanners Hydra has the capability to use commercial scanners such as NFR and ISS

17 July, 2001Toorcon Security Expo ZEUS Uses 1997 FIPA Specifications Foundation for Intelligent Physical Agents Non-profit organization aimed at producing standards for interoperation of heterogeneous software agents ZEUS will be updated to new, post-1997 standards when they are defined The FIPA structure provides a convenient and useful mechanism for ZEUS and similar agents to communicate

17 July, 2001Toorcon Security Expo Enhancements to ZEUS Reviewing and cleaning up code Adding security features  Secure communication (SSL)  Authentication (signed applets/applications) Expanded and improved scheduling and decision making capabilities Improvements will be offered for inclusion in ZEUS distribution

17 July, 2001Toorcon Security Expo Enhanced Security Integrating Java SSL (Sun JSSE) package into the ZEUS architecture  Agent communication protected with strong encryption  Agent authentication provided by digital certificates

17 July, 2001Toorcon Security Expo Hydra Architecture Agents act as wrappers for IDS tools Agents collect, format and forward data to the host agent IDS data is evaluated for significant events using AI methods Agents respond intelligently by starting additional IDS, defensive or offensive agents ZEUS provides the infrastructure

17 July, 2001Toorcon Security Expo Intelligent Agents: Independent and Creative Hydra contains an expert system shell (from Zeus) Each agent makes decisions about its environment and tasks Hydra adds new capabilities  New search techniques  Independent decision capability  Creates agents that respond to new events as needed

17 July, 2001Toorcon Security Expo Fusion of Data from Independent Agents Each agent contributes its piece of knowledge. The knowledge is rated, after considering the following:  The age of the data  The type of agent  The dependability of the data  Criticality (or importance) of the data  The number of other agents reporting similar data  The number of other agents reporting conflicting data The last two items can be thought of as negative and positive corroboration

17 July, 2001Toorcon Security Expo Distributed Intrusion Detection Different computer architectures notice different attacks Distributed IDS/NIDS using existing tools (e.g. snort, portsentry, ISS) Agents intelligently coordinate intrusion reports Improved performance during coordinated attacks) Evaluates data using attack signatures from multiple systems

17 July, 2001Toorcon Security Expo IDS Scenario Scan or Attack Control and Coordination Offensive Actions Host with Agent Host Host with Agent Host Firewall Router Bad Guy Data Collection and Decision Agent Host with Agent Defensive Actions Data

17 July, 2001Toorcon Security Expo Distributed Scanning Distributed Denial of Service (DDoS) meets nmap Distributed scanning using existing tools (e.g. nmap, strobe, or firewalk) Agents intelligently coordinate scanning Improved performance in adverse conditions (IP based blocking) Enhances spoofing and decoy scanning Correlates and evaluates data from multiple simultaneous scans

17 July, 2001Toorcon Security Expo Scanning Scenarios: Spoofed Redirect Scans from spoofing scanners return to the data collection agent Decoy scanners used to obscure data collection IP Coordination agent controls scanning agents Target can see the data collection agent but not the scanner IP Decoy Scanner Spoofing Scanner Decoy Scanner Spoofing Scanner Target Control and Coordination Data

17 July, 2001Toorcon Security Expo Scanning Scenarios: Scanning Zombies Scanner agents scan target under control of coordination agent Decoy scanners used to obscure scanner agent IP Scanner agents return data to data collection agent for analysis Target never sees data collection or coordination agent IP Coordination agent stops, starts, or creates new scanning agents Data Collection and Coordination Decoy Scanner Scanner Decoy Scanner Scanner Target Control and Coordination Data

17 July, 2001Toorcon Security Expo Merits of Hydra Uses all open source tools IDS, scanning, and evaluation tools used in real life  Not a prototype or superficial construct  Not trying to reinvent the wheel Java cross platform capability integrates tools running on their native platform True intelligent agents

17 July, 2001Toorcon Security Expo Further Information Etaoin Shrdlu: Gurney Halleck: