Applying Mobile Agents to Intrusion Detection and Response

摘要

This report is an initial foray into the relatively unexplored terrain of using211u001eMobile Agents (MAs) for Intrusion Detection Systems (IDSs). It is a research 211u001eguide that helps identify the most promising areas of mobile agent IDS research. 211u001eAfter providing some background information, the authors enumerate th problems 211u001efound in current IDSs and propose potential solutions offered by MAs. The report 211u001esuggests innovative ways to apply agent mobility to address shortcomings of 211u001ecurrent IDS designs and implementations. The authors then discuss performance 211u001eadvantages and disadvantages that occur when using MAs for IDSs. The practical 211u001ediscussion of performance leads into proposals for several new intrusion 211u001edetection paradigms enabled by MAs. While the report focuses mostly on the 211u001ebenefits derived from mobility, the authors also take into consideration the 211u001efeatures gained from agent technology, such as autonomous components, which offer 211u001esignificant benefits. The authors explore these benefits in some detail and 211u001epropose specific research topics in both the intrusion detection and intrusion 211u001eresponse areas.