Tolerância a Falhas para o NIDIA: um Sistema de detecção de Intrusão Baseado em Agentes Inteligentes

Abstract

An Intrusion Detection System (IDS) is one tool among several existing ones to provide safety to a computational system. The IDS has the objective of identifying individuals that try to use a system in non-authorized way or those that have authorization but are abusing of their privileges. However, to accomplish the functions correctly an IDS needs to guarantee reliability and availability of its own application. The IDS should provide continuity to its services in case of faults, mainly faults caused by malicious actions. This thesis proposes a fault tolerance mechanism for the Network Intrusion Detection System based on Intelligent Agents Project (NIDIA), an intrusion detection system based on the agents technology. The mechanism uses two approaches: monitoring the system and replication of agents. The mechanism has a society of agents that monitors the system to collect information related to its agents and hosts and to provide an appropriate recovery for each type of detected fault. Using the information that is collected, it is possible: to discover agents that are not active; determine which agents must be replicated and which replication strategy must be used. The replication type depends on the type of each agent and its importance for the system in different moments of processing. Moreover, this monitoring allows to accomplish other important tasks such as load balancing, migration, and detection of malicious agents, to guarantee safety of the proper IDS (self protection). The implementation of the proposed architecture and the illustrated tests demonstrate the viability of the solution.