1. The project
An architecture for Safeguarding large complex critical infrastructures
Start slide show

2. To run this slide show
Three buttons will appear at the bottom right hand corner of the screen
Go to next slide
Click on these to control the slide show
Go back one slide
On some slides, these do not appear until the animation is finished
Go to first slide
Now – click on the right hand button to continue

3. An overview of the project
Safeguard aims to enhance the dependability and survivability of Large Complex Critical Infrastructures (LCCIs).
It will use electricity networks and telecommunications networks as practical examples of LCCIs.
The aim is to produce a generic solution that can be adapted for other forms of LCCI.
Started December 2001, ends May 2004

4. Society and infrastructure
We rely heavily on many different types of infrastructure

5. Society and infrastructure
There is a massive degree of interdependence between them

6. Society and infrastructure
In particular, control systems are often strongly interlinked
INFORMATION & CONTROL

7. Society and infrastructure
INFORMATION & CONTROL
Failure of a single node in a single infrastructure can trigger an uncontrollable cascading failure of many other infrastructures

8. How can we counter those threats?
Safeguard believes that:
Large complex critical infrastructures are too complex to be protected solely by existing systems
LCCIs need to be self-healing
Agent technology is a very effective way to increase the survivability of LCCIs faced with:
Failure
Accidents
Attacks

9. Layered networks
Each layer has a degree of dependency on the other layers
There are three layers in most networks:
Organisational Infrastructure
including people
Intra-dependency
Cyber-Infrastructure
LCCIs can generally be described by three layers, made up of
Physical infrastructures (made by hardware components).
Cyber-infrastructures (made by software components).
Organisational infrastructures (made by human operators)
Each layer has a degree of dependency on the other layers, although there is also a degree of independence. For instance, the telecommunications network could continue in operation for a while without any organisational layer.
In a similar way, we can see that interconnected LCCIs will have a degree of interdependency between similar layers in other LCCIs. Particularly at the cyber layer, this dependency is increasing as the need to exchange information between different LCCIs grows
e.g. management and control systems
Physical Infrastructure
e.g. hardware such as cables and switches

10. Layered networks
Interconnected LCCIs will have a degree of interdependency between similar layers in other LCCIs
There are three layers in most networks:
Organisational Infrastructure
Inter-dependency
Intra-dependency
Cyber-Infrastructure
LCCIs can generally be described by three layers, made up of
Physical infrastructures (made by hardware components).
Cyber-infrastructures (made by software components).
Organisational infrastructures (made by human operators)
Each layer has a degree of dependency on the other layers, although there is also a degree of independence. For instance, the telecommunications network could continue in operation for a while without any organisational layer.
In a similar way, we can see that interconnected LCCIs will have a degree of interdependency between similar layers in other LCCIs. Particularly at the cyber layer, this dependency is increasing as the need to exchange information between different LCCIs grows
Physical Infrastructure

11. The Safeguard approach
agents
This slide represents a set of interconnected nodes in an LCCI or, indeed a set of interconnected LCCIs. Note that there is a complex mesh between the different layers in different nodes.
The 3 layers we have looked at have to be protected if we are going to keep our LCCIs alive. We have taken the decision that protecting the physical layer is outside the scope of this project. It is important, but there are more appropriate ways of dealing with it than agent technology.
However, the higher layers are an increasing area of attacks, and we believe that infrastructure safeguards could be provided by a fourth layer containing a population of Safeguard agents interacting with layer 2 and 3.
The circles represent the Safeguard agents, that manage the survivability of the whole infrastructure.
One of the aims of the project is to investigate autonomous agent architectures that can manage the survivability of the infrastructure through localised communication, without appealing to a global co-ordinator, or to excessive inter node communication.
Protecting the physical layer is outside the scope of this project. It is important, but there are more appropriate ways of dealing with it than agent technology.
However, the higher layers are an increasing area of attacks, and we believe that infrastructure safeguards could be provided by a fourth layer containing a population of Safeguard agents interacting with layer 2 and 3.

12. The role of Safeguard agents
Maintain critical services under all conditions
The Safeguard agents have a hierarchy of roles:
Level 1 – identify component failure or an attack in progress
Level 2 – self-healing to replace functions of the failed component
Level 3 – if self-healing fails, isolate problem components and suggest a reconfiguration strategy
Safeguard needs to be able to recognise dynamically changing
Normal behaviour
Abnormal but acceptable behaviour
Abnormal and unacceptable behaviour

13. The Safeguard architecture
Home LCCI
IDS wrapper
Diagnosis wrapper
Hybrid detector agent
Actuator
Topology agent
Correlation agent
Action agent
Negotiation agent
MMI
Other LCCIs

14. The Safeguard architecture
Wrapper agents Interface with other applications on LCCI, e.g. IDS, diagnostic software
Home LCCI
IDS wrapper
Diagnosis wrapper
Can be classified into categories such as:
WA for Alert Databases, which either get information on request from other agents or provide a constant (filtered) flow of information.
WA for Information Gathering, which gather information about the current status of the system.
Wrapper agents
The wrapper agents will interface with other applications running on the LCCI such as intrusion detection system (IDS), firewall, virus checker and diagnostic software. Their task will be to pass information from these applications to the correlation agents and receive feedback from the action agents, in the form of data and policy updates. They may include limited intelligence to avoid sending too much data to correlation agents.

15. The Safeguard architecture
Hybrid detector agents Detect previous signatures and new anomalies
Home LCCI
IDS wrapper
Diagnosis wrapper
Hybrid detector agent
Each hybrid detector agent can have a signature-based component used for alert classification based on earlier knowledge and an anomaly-detecting component that specialises in detecting deviations from normality.
Hybrid Detector Agents
There are two main components in a Safeguard hybrid agent. Each hybrid agent has an anomaly detecting component that specializes in defining normality and in detecting deviations from normality and a second signature based component used for alert classification based on earlier knowledge. The latter is diagnostic in nature as it often attempts to pinpoint a cause. The former is for completeness, enabling us to detect new patterns of anomaly, while the latter is to improve speed and accuracy. Information from the hybrid detector agents is passed on to correlation agents for analysis and action.
Click for more about Hybrid detectors

16. Hybrid detectors N-Gram and invariant hybrid detector
processes data readings using the n-gram technique
uses a Bayesian network to combine this with invariant rules automatically detected in the data
Event course hybrid detector
deployed in the electricity network to monitor deviations from normal event sequences within the control system
case base reasoning techniques used to model normal event sequences
Neural network hybrid detector
inside the Remote Terminal Units in electricity networks to detect when their data patterns deviate from normal behaviour
could be used to identify anomalous patterns in the IP traffic in a telecom management network
Clustering detector
filters and analyses data captured by TCPdump in IP networks

17. The Safeguard architecture
Home LCCI
IDS wrapper
Diagnosis wrapper
Hybrid detector agent
Correlation agent
Correlation agents Hierarchical. Analyse inputs from lower level agents to detect problems
Correlation Agent
These agents will operate across wide areas of the system, eventually in a hierarchised framework. Their main tasks will be to
Process information coming from the lower level agents, such as wrappers or Hybrid Detector, but also other correlation agents.
Request more information to evaluate the state of the system
Detect possible problems
Pass this evaluation on to action agents who will carry out an appropriate response.
This evaluation can be carried out using case based reasoning, neural networks or a similar technique and the system will learn from past experience and the operators. In addition to their coordination functions, the correlation agents will look for connections in the information that they receive and use this to update applications on the system. For example, by correlating information about an anomalous process with a positive result from the virus checker the correlation agent could explicitly identify the anomalous process as a virus and then instruct the hybrid detector agents to learn its anomaly pattern, so that they can recognize it (and its variants) more quickly in the future. This will be especially useful for new attacks or problems.
This evaluation will result in an alarm message being sent either to another Correlation Agent or directly to an Action Agent and the MMI.

18. The Safeguard architecture
Compiles information about the controlled network - including network components, the connections between them, the importance of each component and the services running on each machine. Its information is provided to other agents, such as the correlation agent and the negotiation agent.
Home LCCI
IDS wrapper
Diagnosis wrapper
Hybrid detector agent
Topology agent Knows where to find topology and configuration data about the LCCI
Topology agent
The topology agent will have knowledge of the system and will be able to quickly answer any questions asked by the correlation, action or MMI agent. Information about the network will be provided by low-level agents, such as a wrapper agent interfacing with diagnosis software. The topology agent may also have to gather information from humans, such as the people responsible for certain systems. This knowledge should include the components, covering their (inter)connections, importance, the services they are running and the people responsible for them or who can answer questions about them.
Correlation agent
Correlation agent
Topology agent

19. The Safeguard architecture
Action agent Receives problem diagnosis from Correlation Agent and decides on action to be taken by Actuator Agent
Home LCCI
IDS wrapper
Diagnosis wrapper
Hybrid detector agent
Topology agent
Correlation agent
Action agent
Action agent
The action agents will receive a diagnosis from the correlation agents and decide upon an appropriate course of action. To respond effectively to anomalies these agents will have to access detailed knowledge about the most critical areas of the system, through the topology agent, and then will decide upon the best way to restore it to its normal state. Some of their responses could be learnt by example from the human operators.
Effective actions on the system will be taken through actuators which will interface between the Safeguard agents and the real system. Typical actions could include killing a process that started up without instrumentation or reconfiguring a firewall to block incoming connections from a given network range.
The electricity Action Agent is based on defence trees.
The telecom Action Agent uses a combination of perimeter defence, internal router and switch reconfiguration and host-based countermeasures.

20. The Safeguard architecture
Actuator agents Interface with other components of the LCCI to actuate changes
Home LCCI
IDS wrapper
Diagnosis wrapper
Hybrid detector agent
Actuator
Topology agent
Correlation agent
Action agent
Execute commands from the Action Agents and feedback confirmation of the action. This may include a certain level of abstraction, for example, an actuator attached to a firewall could receive generic commands such as ‘block incoming connections from network A’ and apply appropriate commands on the firewall, no matter what software it is running.
Actuator agents
Actuator agents will, like wrapper agents, interface with the components of the cyber part of the LCCI. Instead of passing information from the system to the Safeguard agents, they will have to actuate changes on the system. These changes will be commanded by the action agents for the purpose of the safety of the LCCI. A typical action would be to close a given port on a firewall.

21. The Safeguard architecture
Establishes the relationship between the home LCCI and other LCCIs.
When other LCCIs fail, interacts with the Correlation Agent to make sure that any analysis of problems in the home LCCI takes this into account.
Ensures that failure (and restoration) of the home LCCI is communicated to other LCCIs.
Home LCCI
IDS wrapper
Diagnosis wrapper
Hybrid detector agent
Actuator
Topology agent
Correlation agent
Action agent
Negotiation agent
Other LCCIs
Negotiation agent Interfaces with other LCCIs. Agrees service levels, discusses problems.
Negotiation Agent
These will come into play when the Safeguard system needs to interact with agents in other autonomous systems or even other large complex critical infrastructures. Their tasks will include rerouting and requesting services and sharing information about failures and attacks. If the telecommunications network experiences a major failure, the negotiation agent could arrange for calls to be switched through to the most suitable network at an appropriate price.

22. The Safeguard architecture
Ensures that all information is transferred and correctly filtered to avoid information overload. In the case of alarms, it proposes possible solutions if the Action Agents are incapable of resolving the situation.
Also supports the administrator when complicated configuration or attack counter actions have to be undertaken.
Home LCCI
IDS wrapper
Diagnosis wrapper
Hybrid detector agent
Actuator
Topology agent
Correlation agent
Action agent
Negotiation agent
MMI
Other LCCIs
MMI Agent
The MMI Agent is a high level agent communicating with the human administrator. Its major role is to assure that all information is transferred and correctly filtered in order to avoid information overload, thus supplying humans with a global picture in arbitrary granularity. In the case of true alarms the human will be able to take over if action agents are incapable of resolving the situation. The MMI agent also supports the administrator when complicated configuration or attack counter actions have to be undertaken.
The MMI Agent also has the duty to feed back human knowledge into the Safeguard system by notifying various agents of decision made by human operators.
MMI agent Filters information and communicates with the human administrator

23. A reminder of the Safeguard architecture
Home LCCI
IDS wrapper
Diagnosis wrapper
Hybrid detector agent
Actuator
Correlation agent
Action agent
Correlation agent
Action agent
Negotiation agent
Topology agent
Other LCCIs
MMI

24. Safeguard and the European Union’s IST programme
The Information Society Technologies programme
Aims to ‘realise the benefits of the information society for Europe both by accelerating its emergence and by ensuring that the needs of individuals and enterprises are met’
The phase of the workplan that Safeguard is in runs from 1998 – 2004 and has a budget of €3600M

25. The partners in the project
Queen Mary, University of London
Is managing the project.
Is one of the four large Colleges of the University of London.
Has expertise in
complex telecoms systems
agent technology

26. The partners in the project
Aplicaciones en Informática Avanzada
Are one of the few Spanish companies dedicated to consulting on and engineering of software and Information Systems
Are experts in electricity network management systems

27. The partners in the project
Ente per le Nuove tecnologie, l’Energia e l’Ambiente
The Italian National Agency for New Technology, Energy and the Environment.
Are involved in work on agent organisation for LCCIs and emergency management domains for many years.

28. The partners in the project
Linköping University
The Laboratory of Real-time Systems is a leading department for computer science research and education in Sweden
Are experts in modelling and simulation

29. The partners in the project
Swisscom
Switzerland's leading telecommunications provider
Are experts on security of telecom systems

30. The partners in the project
plus a panel of senior government and industry advisors from Europe and the USA

31. Contact Project manager Visit the safeguard web site
Visit the safeguard web site