A multi-agent architecture for information leakage detection in distributed systems.

摘要

Covert channel attacks utilize shared resources to indirectly transmit sensitive information to unauthorized parties. Many current operating systems, such as SELinux, rely on generating labels based on a file's security classification and system-wide security policies and then binding these labels to all such files in the filesystem. Enforcement of security policies in such systems occurs at the time of access to a file or resource. Such mechanisms are flawed, however, in that they do not adequately protect against information laundering by means of covert channels. One recent development, Colored Linux, serves as an extension to SELinux and utilizes watermarking algorithms to "color" the contents of files with their respective security classification in order to enhance resistance to information laundering attacks. In this thesis, a mobile agent-based approach to implementing Colored Linux is proposed to automate the process of detecting and coloring receptive hosts' filesystems and to provide monitoring of the colored filesystem for instances of potential information leakage. Implementation details and execution results are included to illustrate the merits of the proposed approach. An evaluation of the performance of this agent-based system is conducted over a single host as well as a local network of machines and detailed here as well. Finally, third-party analysis of the agent system using formal methods is discussed.