A secure mobile agents approach for anomalies detection on firewalls

ABSTRACT

Firewalls are core elements in network security. However detecting anomalies, particularly in distributed firewalls has become a complex task. Mobile agents promise an interesting approach for communications between different distributed systems. The main challenge when deploying mobile agent environments pertains to security issues concerning mobile agents and their executive platform. In this work, we propose a firewall anomalies' detection system using a secure mobile agents approach where protection is based on the cooperation of a trust agent running inside a trust host.

REFERENCES

• 1: Bellovin, M. and Chewsick, R., 1994. "Network firewalls". IEEE Communications Magazine, pages 50--57.
• 2: Benelbahri, A. and Bouhoula, A. 2007. "Tuple Based Approach for Anomalies Detection within Firewall iltering Rules". IEEE Symposium on Computers and communications. ISCC 2007. 12th Volume Page(s):63--70.
• 3: Cobb, S., 1997. "ICSA Firewall Policy Guide v2.0". NCSA Security White Paper Series.
• 4: F. Ben Ftima, K. Karoui and H. Ben Ghezala "Anomalies detection on firewalls using the Mobile Agents approach". Proceedings of the International Conference Intelligent Systems and Agents (ISA08) Amsterdam, July 22--24, 2008
• 5: F. Ben Ftima, K. Karoui and H. Ben Ghezala "Firewalls anomalies' detection system based on Web Services/Mobile Agents interactions", Proceedings of the Third international conference on risks and security of internet and systems(CRiSIS'2008), Tozeur, Tunisia, 28--30, oct 2008.
• 6: Elizabeth D. Zwicky , Simon Cooper , D. Brent Chapman, Building Internet firewalls (2nd ed.), O'Reilly & Associates, Inc., Sebastopol, CA, 2000
• 7: William R. Cheswick , Steven M. Bellovin, Firewalls and Internet security: repelling the wily hacker, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 1994
• 8: Wack, J. et al,.2002. "Guidelines on Firewalls and Firewall Policy". NIST Recommendations, SP 800-41.
• 9: Bellovin, M., 1999. Distributed Firewalls. Special Issue on Security, ISSN 1044--6397.
• 10: Eronen, P. and Zitting, J., 2001. "An Expert System for Analyzing Firewall Rules". Proceedings of 6th Nordic Workshop on Secure IT-Systems (NordSec 2001).
• 11: Al-Shaer, E. Hamed, H., 2004. "Discovery of policy anomalies in distributed firewalls". Sch. of Comput. Sci., Telecommun. & Inf. Syst. 2004 DePaul Univ, USA.
• 12: Sotiris Ioannidis , Angelos D. Keromytis , Steve M. Bellovin , Jonathan M. Smith, Implementing a distributed firewall, Proceedings of the 7th ACM conference on Computer and communications security, p.190-199, November 01-04, 2000, Athens, Greece [doi>10.1145/352600.353052]
• 13: Hari, B. et al. 2000."Detecting and Resolving Packet Filter Conflicts". Proceedings of IEEE INFOCOM'00.
• 14: Danny B. Lange , Mitsuru Oshima, Seven good reasons for mobile agents, Communications of the ACM, v.42 n.3, p.88-89, March 1999 [doi>10.1145/295685.298136]
• 15: Robert H. Guttman , Alexandros G. Moukas , Pattie Maes, Agent-mediated electronic commerce: a survey, The Knowledge Engineering Review, v.13 n.2, p.147-159, July 1998 [doi>10.1017/S0269888998002082]
• 16: Karoui, K., 2005. "MA Overview", published in ncyclopedia of Multimed ia Technology and Networking, Idea Group.
• 17: Walsh, T., N. Paciorek and D. Wong, 1999. "Mobility: Processes Computers and Agents", Addison(Ed.), p:525--534.
• 18: Algesheimer, J., C. Cachin, J. Cameniscsh and G. Karjoth, 2000. "Cryptographic Security for Mobile Code". IBM Research Report, Zurich, Switzerland.
• 19: Jansen, W et al., 1999. "Applying mobile agents to intrusion detection and response". Technical report, NIST Interim Report - 6416.
• 20: Karoui, K. and B. Ftima, F., 2007. "Interaction Mobile Agents--Web Services". Encycloped ia of multimedia Technology and Networking, IGI global.
• 21: Karoui, K. and B. Ftima, F., 2007. "Effectiveness of Web Services-Mobile Agents Approach in E-commerce System". Encyclopedia of Information Science and Technology, IGI.
• 22: El Rhazi, A., S. Pierre and H. Boucheneb, 2003. "Secure protocol in mobile agent environment". Proc. Canadian Conf. Electrical and Computer Engineering (CCECE2003), Canada.
• 23: R. Rivest, The MD5 Message-Digest Algorithm, RFC Editor, 1992
• 24: Toshiba Corporation,.2001.Beegent Framework.
• 25: Russell, R., 1999. Linux iptables HOWTO, v0.0.2.

INDEX TERMS

Keywords:
anomalies detection, firewalls, mobile agent, trust agent