1. Agent Caching in APHIDS CPSC 527 Computer Communication Protocols Project Presentation Presented By: Jake Wires and Abhishek Gupta

2. Agent Technology The Rationale – Move Computation to data rather than data to computation.  Traditional Client–Server model. Client submits a query. Server responds with data. Client iterates through the data to compute information of interest.  Agent based models. Agent, acting as client, migrates to the server. Migrated Agent data mines at the server to compute information of interest.

3. Agent Paradigmns Static Agents  Stationary.  Interacts with objects of interest using message protocols and/or RPCs. Mobile Agent  Mobile.  Interacts with objects of interest by actually migrating to its location.

4. Seven Advantages of Mobile Agents They reduce Network Load - Avoid flurry of messages/raw data through the network. They overcome network latency – Possibility of support for real time control systems. They encapsulate protocols – Can establish channels based on proprietary protocols. They execute asynchronously and autonomously – Support poor network fidelity in wireless environments. ………………………

5. Advantages (contd). They Adapt Dynamically – Can sense their execution environment and respond autonomously to changes. Also, can arrange themselves in an optimal configuration to solve a particular problem. They are naturally heterogeneous – Independent of protocols. They are robust and fault-tolerant – Can migrate to a different host in case of current host failure.

6. Mobile Agent Applications E-Commerce. Personal Assistants. Secure Brokering. Distributed Information Retrieval. Telecommunication Network Services. Monitoring and Notification. Information Dissemination. Parallel Processing.

7. Grasshopper – A Middleware for Mobile Agent Systems. Overview and Concepts. Region Agency AAgency B Place A Place D Place C Place B

8. APHIDS – A Programmable Hybrid Intrusion Detection System. Why Programmable? Provides a high-level application specfic meta-language to specify the interaction between monitoring agents and analysis agents, and to enable multiple agents to perform distributed searches in a cooperative manner. Why Hybrid? Is targeted to act as a middleware for combining and correlating results from different IDSs running on a common network.

9. APHIDS – System Overview IDS- Snort Target Host APHIDS Console LAN External Machine

10. APHIDS: System Setup IDS- Snort Target Host APHIDS Console LAN External Machine Correlation Agent Trigger Agent

11. APHIDS: System Operation IDS- Snort Target Host APHIDS Console LAN Correlation Agent Trigger Agent Attacker Task Agent Action Agent

12. Caching of Mobile Agents Why Caching?  To reduce consumption of bandwidth.  To improve upon response time.  To prevent Denial-of-Service attack.  Load Balancing. Points to Ponder  Isn’t caching against mobility??  How can agents be cached??

13. Our Approach: A Two Level Caching Scheme. An Agent to be cached does not terminate after its task is done. The cached agent maintains a task queue which is replenished by requests from other agents. If the task queue is empty then the agent waits for a request arrival until a period of time called Spin Life time. If no more requests turn up during the Spin Life time period, then the agent is paused and flushed to disk. A flushed agent is kept on disk for a period of time called Flushed Life time. ………………….

14. Our Approach: A Two Level Caching Scheme. (contd.) If a new request turns up during the Spin Life time it is added to the task queue and is served sequentially. If a new request turns up during the Flushed Life time period then the agent is woken up to serve the request. After serving the request the agent waits upon the task queue until the expiry of its Spin Life time. If a new request does not turn up during the Flushed Life time period the agent is terminated from the host.

15. Grasshopper Support Support for proxies.  Agent Proxy  Agency Proxy Support for flushing agents to disk.  Through Agent Proxy  Through Agency Proxy Support for terminating agents.  Through Agent Proxy  Through Agency Proxy

16. Caching Agents in APHIDS Correlation Agent and Trigger Agent are more or less persistent. Task Agent and Action Agents are potential candidates for caching. We chose Task Agents to demonstrate the utility of caching.

17. Caching Agents in APHIDS(Contd.) Implementation  Correlation Agent maintains a Map (cache) of Time Stamped proxy objects.  Each Map entry comprises of a key and a list of associated Time Stamped proxy objects of Task Agents.  A key is formed by combining the target host and task type for the Task Agent.  Each Time Stamped Proxy object contains: An agent proxy. The time stamp denoting its last use. Number of pending requests for completion.

18. Caching Agents in APHIDS(Contd.) Implementation (contd.)  Whenever a new trigger arrives from the Trigger Agent the proxy map is consulted to determine if a Task Agent exists on the Target Host.  If no Task Agent proxy exists on the Target Host then a new Task Agent is launched to gather data, otherwise a request is sent to an existing Task Agent after incrementing its pending task value in the proxy map.  If multiple qualified task agent proxies exist in the proxy map then we follow an LRU approach to serve the request.

19. Caching Agents in APHIDS(Contd.) Implementation (contd.)  Further, if the number of pending tasks for a qualified task agent proxy is more than a certain threshold then we spawn a new Task Agent and send it to the target host.  Meanwhile, at regular intervals the Correlation Agent checks for agent proxies which have exceeded either their Spin Life time or Flushed Life time.  If a Task Agent has exceeded its Spin Life time, the Correlation Agent requests its Agency to put it to sleep.  If a Task Agent has exceed its Flushed Life time, the Correlation Agent calls the shutdown() method on its proxy.

20. Evaluation Bandwidth Conservation.

21. Evaluation Latency Conservation – Improved Response time.

22. Conclusion oBandwidth consumption is reduced to 1/5 th. oResponse time improves by 3 times. oAgent Caching must for agent based systems!!