Modelo de IDS Remoto baseado na tecnologia de Agentes, Web Services e MDA

Abstract

In the current state of the Internet, information security presents a permanent concern. In many cases, information security is vital a maintenance and continuity of the businesses. The organizations have used the Internet as one of the main points for rendering of services for other organizations as well as for their final users. We can cite some organizations such as Banks, Institutions of Education, Administrators of Credit cards and the Federal Government. The use of Security policies associated with a set of tools such as Firewall, Antivirus and IDS (Intrusion Detection System) have helped organizations to achieve some security and thus allowing the continuity of the businesses. On the other extremity of the rendering of services for organizations we have the final users. The necessity for effectiveness in computational security to the final users has increased in function of the considerable growth on the occurrence of attacks to this type of user. This problem creates a niche for the research in security directed to the final user. This work is motivated by the above problem. Our work consists of a proposal of a model and an implementation of a Remote IDS (Intrusion Detection System) using the technology of Multi-agent Systems, Web Services and MDA (Model-Driven Architecture). This model adapts and extends the NIDIA (Network Intrusion Detection System based on Intelligent Agents) to provide a remote IDS on the Internet. The purpose is that users that do not have a local IDS can use the services provided by a remote IDS (e.g. NIDIA). NIDIA is an IDS whose architecture consists of a set of cooperative agents. The Remote IDS functionalities are provided as a set of accessible services on the Internet through Web Services. The architecture of our IDS uses MDA to support metadata management such as profiles of configurations, profiles of users and profiles of services. The prototype of the proposed model and the tests demonstrate the viability of our solution. An illustrative example of the execution of the Remote IDS is presented.