Application of autonomic agents for global information grid management and security

ABSTRACT

In the near future, the U.S. DoD will activate a newly created Global Information Grid (GIG) providing an agile, robust, interoperable and collaborative communication network. This GIG is viewed as the single most important contributor to combat power and protection [1]. The GIG can be characterized as a globally interconnected, end-to-end set of disparate information and processing capabilities available on-demand to warfighters, policymakers and support personnel.

Management of the GIG resources and operation will be, of necessity, intrinsic to the architecture and transparent to the user. The development an architecture that is secure against malicious exploitation, data or service denial and data corruption is a principal focus. Introduction of mobile, adhoc network elements having intermittent network connectivity and limited life exacerbates this problem. In this paper we explore the GIG and present an innovative application of Autonomic Agent technology currently in development that has the potential to automate many of the obligatory network management tasks. Additionally, we introduce a GIG Simulation Testbed that, utilizing Discrete Event System Specification (DEVS), is proving useful in simulating GIG operation at the node level for the analysis of agent-based detection and neutralization of network cyber attacks by malicious parties and programs.

REFERENCES

• 1: GlobalSecurity.org, "Global Information Grid (GIG"), http://www.globalsecurity.org/intell/systems/gig.htm.
• 2: Fact Sheet, "A Brief History of NSF and the Internet", National Science Foundation, 4201 Wilson Boulevard, Arlington, Virginia 22230, USA, Tel: [phone], http://www.nsf.gov/.
• 3: National Defense Authorization Act for Fiscal Year 1996.
• 4: DoD Chief Information Officer (CIO) Guidance and Policy Memorandum (G&PM) no. 11--8450, Department of Defense (DoD) Global Information Grid (GIG) Computing.
• 5: G. Alvarez and S. Petrovic. A New Taxonomy of Web Attacks Suitable for Efficient Encoding. Computer and Security, 22(5):435--449, July 2003.
• 6: M. Bishop. A Taxonomy of Unix and Network Security Vulnerabilities. Technical report, Department of Computer Science, University of California at Davis, May 1995.
• 7: John Douglas Howard, An analysis of security incidents on the Internet 1989-1995, Carnegie Mellon University, Pittsburgh, PA, 1998
• 8: J. D. Howard and T. A. Longstaff. A Common Language for Computer Security Incidents. Technical report SAND98--8667, Sandia National Laboratories, Albuquerque, New Mexico and Livermore, California, October 1998.
• 9: Ivan Victor Krsul , Eugene H. Spafford, Software vulnerability analysis, Purdue University, West Lafayette, IN, 1998
• 10: R. P. Lippmann, D. J. Fried, I. Graf, J. W. Haines, K. R. Kendall, D. J. McClung, D. J. Webber, S. E. Webster, D. Wyschogrod, R. K. Cunningham, and M. A. Zissman. Evaluating Intrusion Detection Systems: The 1998 DARPA off-line intrusion detection evaluation. In First International Workshop on Recent Advances in Intrusion Detection, 14--16 September 1998, Louvain-la-Neuve, Belgium, 2000.
• 11: Daniel Lowry Lough , Nathaniel J. Davis, IV, A taxonomy of computer attacks with applications to wireless networks, Virginia Polytechnic Institute and State University, 2001
• 12: D. J. Weber. A taxonomy of Computer Intrusions. Master's thesis, Department of Electrical and Computer Science, Massachusetts Institute of Technology, June 1998.
• 13: Jake D. Brutlag, Aberrant Behavior Detection in Time Series for Network Monitoring, Proceedings of the 14th USENIX conference on System administration, December 03-08, 2000, New Orleans, Louisiana
• 14: Matthew Roughan , Albert Greenberg , Charles Kalmanek , Michael Rumsewicz , Jennifer Yates , Yin Zhang, Experience in measuring backbone traffic variability: models, metrics, measurements and meaning, Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, November 06-08, 2002, Marseille, France [doi>10.1145/637201.637213]
• 15: PORRAS, P. AND NEUMANN, P. 1997. Emerald: Event monitoring enabling responses to anomalous live disturbances. In Proceedings of the 20th National Information Systems Security Conference. 353--365.
• 16: Barford, P., Kline, J., Plonka, D., and Ron, A. A Signal Analysis of Network Traffic Anomalies. In Proc. Of ACM/USENIX IMW (2002).
• 17: Anukool Lakhina , Mark Crovella , Christophe Diot, Diagnosing network-wide traffic anomalies, Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications, August 30-September 03, 2004, Portland, Oregon, USA
• 18: Yin Zhang , Zihui Ge , Albert Greenberg , Matthew Roughan, Network anomography, Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement, p.30-30, October 19-21, 2005, Berkeley, CA
• 19: Ratul Mahajan , Steven M. Bellovin , Sally Floyd , John Ioannidis , Vern Paxson , Scott Shenker, Controlling high bandwidth aggregates in the network, ACM SIGCOMM Computer Communication Review, v.32 n.3, p.62-73, July 2002 [doi>10.1145/571697.571724]
• 20: Papadopoulos, C., Lindell, R., Mehringer, J., Hussain, A. & Govindan, R. (2003), Cossack: Coordinated suppression of simultaneous attacks, in 'DARPA Information Survivability Conference and Exposition', Vol. 1, Washington, DC, pp. 2--13
• 21: Jelena Mirkovic , Gregory Prier , Peter L. Reiher, Attacking DDoS at the Source, Proceedings of the 10th IEEE International Conference on Network Protocols, p.312-321, November 12-15, 2002
• 22: Angelos D. Keromytis , Vishal Misra , Dan Rubenstein, SOS: secure overlay services, Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications, August 19-23, 2002, Pittsburgh, Pennsylvania, USA
• 23: Robert Stone, Centertrack: an IP overlay network for tracking DoS floods, Proceedings of the 9th conference on USENIX Security Symposium, p.15-15, August 14-17, 2000, Denver, Colorado
• 24: Xiaowei Yang , David Wetherall , Thomas Anderson, A DoS-limiting network architecture, Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications, August 22-26, 2005, Philadelphia, Pennsylvania, USA
• 25: Karthik Lakshminarayanan , Daniel Adkins , Adrian Perrig , Ion Stoica, Taming IP packet flooding attacks, ACM SIGCOMM Computer Communication Review, v.34 n.1, January 2004 [doi>10.1145/972374.972383]
• 26: Ajay Gupta, Management of Conflicting Obligations in Self-Protecting Policy-Based Systems, Proceedings of the Second International Conference on Automatic Computing, p.274-285, June 13-16, 2005 [doi>10.1109/ICAC.2005.38]
• 27: J. Kephrat and W. Walsh, An Artificial Intelligence Perspective on Autonomic Computing Policies, The 5^th IEEE POLICY, 2004
• 28: Gerald Tesauro , Jeffrey O. Kephart, Utility Functions in Autonomic Systems, Proceedings of the First International Conference on Autonomic Computing, p.70-77, May 17-18, 2004
• 29: Gerald Tesauro , William E. Walsh , Jeffrey O. Kephart, Utility-Function-Driven Resource Allocation in Autonomic Systems, Proceedings of the Second International Conference on Automatic Computing, p.342-343, June 13-16, 2005 [doi>10.1109/ICAC.2005.65]
• 30: Brian F. Cooper , Karsten Schwan, Distributed Stream Management using Utility-Driven Self-Adaptive Middleware, Proceedings of the Second International Conference on Automatic Computing, p.3-14, June 13-16, 2005 [doi>10.1109/ICAC.2005.24]
• 31: Mohamed N. Bennani , Daniel A. Menasce, Resource Allocation for Autonomic Data Centers using Analytic Performance Models, Proceedings of the Second International Conference on Automatic Computing, p.229-240, June 13-16, 2005 [doi>10.1109/ICAC.2005.50]
• 32: Alice X. Zheng , Jim Lloyd , Eric Brewer, Failure Diagnosis Using Decision Trees, Proceedings of the First International Conference on Autonomic Computing, p.36-43, May 17-18, 2004
• 33: Anand Ranganathan, Autonomic Pervasive Computing Based on Planning, Proceedings of the First International Conference on Autonomic Computing, p.80-87, May 17-18, 2004
• 34: Brian D. Ziebart , Dan Roth , Roy H. Campbell , Anind K. Dey, Learning Automation Policies for Pervasive Computing Environments, Proceedings of the Second International Conference on Automatic Computing, p.193-203, June 13-16, 2005 [doi>10.1109/ICAC.2005.37]
• 35: Biplav Srivastava , Joseph P. Bigus , Donald A. Schlosnagle, Bringing Planning to Autonomic Applications with ABLE, Proceedings of the First International Conference on Autonomic Computing, p.154-161, May 17-18, 2004
• 36: H. Chen, S. Hariri, and F. Rasal, An Innovative Self-Configuration Approach for Networked Systems and Applications The 4^th International Conference on Computer Systems and Applications (AICCSA-06)
• 37: Huoping Chen , Salim Hariri , Byoung Kim , Yeliang Zhang , Mazin Yousif, Self-Deployment and Self-Configuration of Pervasive Network Services, Proceedings of the The IEEE/ACS International Conference on Pervasive Services, p.242-242, July 19-23, 2004 [doi>10.1109/ICPS.2004.29]
• 38: Salim Hariri , Bithika Khargharia , Houping Chen , Jingmei Yang , Yeliang Zhang , Manish Parashar , Hua Liu, The Autonomic Computing Paradigm, Cluster Computing, v.9 n.1, p.5-17, January 2006 [doi>10.1007/s10586-006-4893-0]
• 39: S. Hariri, L. Xue, H Chen, M. Zhang, S. Pavuluri and S. Rao., AUTONOMIA: an autonomic computing environment. Proceedings of IEEE IPCCC 2003
• 40: Jingmei Yang , Huoping Chen , Salim Hariri , Manish Parashar, Autonomic runtime manager for adaptive distributed applications, Proceedings of the High Performance Distributed Computing, 2005. HPDC-14. Proceedings. 14th IEEE International Symposium, p.69-78, July 24-27, 2005 [doi>10.1109/HPDC.2005.1520937]
• 41: http://kdd.ics.uci.edu/databases/kddcup99/task.html, 2005
• 42: Guangzhi Qu , Salim Hariri , Mazin Yousif, A New Dependency and Correlation Analysis for Features, IEEE Transactions on Knowledge and Data Engineering, v.17 n.9, p.1199-1207, September 2005 [doi>10.1109/TKDE.2005.136]

INDEX TERMS

Keywords:
autonomia, autonomic agents, global information grid, net-centric warfare, network security