Using mobile agents as roaming security guards to test and improve security of hosts and networks

ABSTRACT

This paper discusses the design and implementation details of MAST (Mobile Agent-based Security Tool), a new mobile agent-based network security approach. MAST has been designed to support flexible and customizable network security tasks and training. This paper focuses on the implementation details and security aspects of MAST's components, services, and mobile-agent architecture

REFERENCES

• 1: Cañs, A. J., K. M. Ford, J. D. Novak, P. Hayes, T. Reichherzer, N. Suri., Using Using Concept Maps with Technology to Enhance Collaborative Learning in Latin America, accepted for publication, Science Teacher.
• 2: Cañas, A. J., K. M. Ford, J. Brennan, T. Reichherzer, and P. Hayes. (1995). Knowledge Construction and Sharing in Quorum. In Proc. of AI in Education, Washington D.C., pp. 218--225.
• 3: Carvalho, M.M, Cowin, T.B., Suri, N. - MAST - A Mobile Agent-based Security Tool. -- Proceedings of the 7th World Multiconference on Systemics, Cybernetics and Informatics. Orlando, FL, October 2003.
• 4: The CERT Coordination Center. Online at: <u>http://www.cert.org/</u>
• 5: CERT® Advisory CA-2003-20 W32/Blaster worm. Originally release on August 11th, 2003. and revised on August 14th, 2003. Available online at: http://www.cert.org/advisories/CA-2003-20.html
• 6: CERT® Advisory CA-2003-04 MS-SQL Server Worm. Originally release on January 25, 2003 and revised on January 27th, 2002. Available online at: <u>http://www.cert.org/advisories/CA-2003-04.html</u>
• 7: CERT® Advisory CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow in IIS Indexing Service DLL. Originally release on July 19, 2001. and revised on January 17th, 2002. Available online at: <u>http://www.cert.org/advisories/CA-2001-19.html</u>
• 8: CERT® Advisory CA-2003-16 Buffer Overflow in Microsoft RPC. Originally release on July 17, 2003. and revised on August 8th, 2003. Available online at: <u>http://www.cert.org/advisories/CA-2003-16.html</u>
• 9: Coffey, J. W. and A. J. Cañas (2000). A Learning Environment Organizer for Asynchronous Distance Learning Systems. Twelfth IASTED Intern. Conf. Parallel and Distributed Computing and Systems (PDCS 2000), Las Vegas, Nevada.
• 10: General Magic, Inc. Telescript technology: The foundation for the electronic marketplace, 1994. White paper
• 11: Internet X.509 Public Key Infrastructure: Certificate and CRL Profile. Online at http://www.ietf.org/rfc/rfc2459.txt.
• 12: Intrusion Detection with Mobile Agents, Computer Communications Journal, Special Issue on Intrusion Detection, In Press. Wayne Jansen.
• 13: Lemos, Robert. - Study: Bad security flaws don't die - CNET News.com -- July 30th. Available online at: <u>http:news.com.com/2100-1009-5058058.html?tag=nl</u>
• 14: Lemos, Robert. - Worm's spread shows holes in patch system - CNET News.com -- August 12th, 2003. Available online at: http://news.com.com/100-1002_3-5062832.html
• 15: Network Security Testing Using Mobile Agents, The Third International Conference and Exhibition on The Practical Application of Intelligent Agents and Multi-Agent Technology, London, UK, March 1998. Tom Karygiannis.
• 16: Novak, D.B. Gowin, Learning How to Learn. Cambridge University Press (1984)
• 17: Novak, J.D., The Theory Underlying Concept Maps and How to Construct Them. Cornell University
• 18: Schuba, Christoph. August 1993 Master's Thesis. "Addressing Weaknesses in the Domain Name System Protocol." Online at http://ftp.cerias.purdue.edu/pub/papers/christoph-schuba/schuba-DNS-msthesis. pdf
• 19: Service Locaction Protocol, Version 2. Online at <u>http://www.ietf.org/rfc/rfc2608.txt</u>
• 20: Suri, N., Bradshaw, J.M., Breedy, M.R., Groth, P.T., Hill, G.A., Jeffers, R., and Mitrovich, T.S. An Overview of the NOMADS Mobile Agent System. Sixth ECOOP Workshop on Mobile Object Systems. <u>(http://cui.unige.ch/~ecoopws/ws00)</u>
• 21: Suri, N. Bradshaw, J.M., Breedy, M.R., Ford, K.M., Groth, T., Hill, G.A., and Saavedra, R.: "State Capture and Resource Control for Java: The Design and Implementation of the Aroma Virtual Machine." White Paper. <u>http://nomads.coginst.uwf.edu</u>
• 22: Niranjan Suri , Jeffrey Bradshaw , Maggie R. Breedy , Paul T. Groth , Gregory A. Hill , Renia Jeffers, Strong Mobility and Fine-Grained Resource Control in NOMADS, Proceedings of the Second International Symposium on Agent Systems and Applications and Fourth International Symposium on Mobile Agents, p.2-15, September 13-15, 2000
• 23: The TLS Protocol Version 1.0 Online at <u>http://www.ietf.org/rfc/rfc22446.txt</u>
• 24: Vulnerability Note VU#568148 - Microsoft Windows RPC vulnerable to buffer overflow. Originally release on July 17, 2003. and revised on August 14th, 2003. Available online at: <u>http://www.kb.cert.org/vuls/id/568148</u>

INDEX TERMS

Primary Classification:
  I. Computing Methodologies
  I.2 ARTIFICIAL INTELLIGENCE
        I.2.11 Distributed Artificial Intelligence

Additional Classification:
  I. Computing Methodologies
  I.2 ARTIFICIAL INTELLIGENCE
      I.2.4 Knowledge Representation Formalisms and Methods
          Subjects: Representation languages; Semantic networks

General Terms:
Design, Human Factors, Management, Reliability, Security

Keywords:
IHMC, MAST, concept maps, knowledge models, mobile agents, network security