Mobile Agent Based Network Defense System in Enterprise Network

Abstract

Security has become the Achilles’ heel of many organizations in today’s computer-dominated society. In this paper, a configurable intrusion detection and response framework named Mobile Agents based Distributed (MAD) security system was proposed for enterprise network consisting of a large number of mobile and handheld devices. The key idea of MAD is to use autonomous mobile agents as lightweight entities to provide unified interfaces for intrusion detection, intrusion response, information fusion, and dynamic reconfiguration. These lightweight agents can be easily installed and managed on mobile and handheld devices. The MAD framework includes a family of autonomous agents, servers and software modules. An Object-based intrusion modeling language (mLanguage) is proposed to allow easy data sharing and system control. A data fusion engine (mEngine) is used to provide fused results for traffic classification and intrusion identification. To ensure Quality-of-Service (QoS) requirements for end users, adaptive resource allocation scheme is also presented. It is hoped that this project will advance the understanding of complex, interactive, and collaborative distributed systems.