Mobile Agent-Based Active Monitoring of Computer Networks

移动代理技术为构建监控和管理大型网络的下一代系统提供了许多新的能力。这项研究的目标是研究和构建一个使用移动代理的系统基础设施，用于对大型分布式系统的主动监控。移动代理将被用来执行远程信息过滤和控制功能，并且这种分布式和移动代理可以被安全地修改以改变其监控策略和功能。如果需要，可以在节点上安装新的代理，以执行与现有代理不同的功能。该系统还将支持使用代理组进行协作分布式监控和监控信息的协作过滤。拟议的基础设施将为事件监控、订阅以及信息关联和过滤提供一套基本的代理类型。这一基础设施将用不同的方案支持实验，以监测、传播和处理事件数据。我们将为不同的操作系统平台开发监控功能，如Sun OS、Linux和Windows NT。我们建议使用该基础设施来试验入侵检测技术。我们计划使用逻辑编程技术对事件数据执行搜索和关联操作。事件通知数据将使用PROLOG存储在逻辑数据库中。移动代理将用于对存储在不同节点的此类数据库中的数据执行过滤和关联功能，操作的安全性和健壮性将是该基础设施的重要设计要求。该系统基础设施将包括监控其自身组件并在检测到任何故障时执行恢复操作的机制。我们还将开发一个安全体系结构，让移动代理在不同的保护域和不同的安全级别上执行，以最大限度地减少任何被破坏或受损的代理的影响。该系统将部署在明尼苏达大学的研究和教学计算实验室，以评估其机制的有效性。这一系统将使用阿金塔代理编程系统来实施。为此目的，阿金塔系统的能力将得到加强，以支持安全代理组和大规模代理程序的调试设施。这一监测基础设施将提供给社区用于研究和教育活动。

The mobile agent technology offers many novel capabilities for building future generation systems for monitoring and management of large networks. The goal of this research is to investigate and build a system infrastructure using mobile agents for active monitoring of large distributed systems. Mobile agents would be used to perform remote information filtering and control functions, and such distributed and mobile agents could be securely modified to change their monitoring policies and functions. If needed, new agents could be installed at a node to perform functions different from the existing ones. The system would also support use of agent groups for cooperative distributed monitoring and collaborative filtering of monitored information.The proposed infrastructure would provide a set of basic agent types for event monitoring, subscription, and information correlation and filtering. This infrastructure would support experimentation's with different schemes for monitoring, dissemination, and processing of event data. We would develop monitoring functions for different operating system platforms, such as Sun OS, Linux, and Windows NT. We propose to experiment with intrusion detection techniques using this infrastructure. We plan to use logic programming techniques for performing search and correlation operations on event data. The event notification data would be stored in logic databases using Prolog. Mobile agents would be used for performing filtering and correlation functions on data stored in such databases at different nodes.Security and robustness of operations would be an important design requirement for this infrastructure. This system infrastructure would include mechanisms to monitor its own components and perform recovery actions on detecting any failures. We would also develop a security architecture for mobile agents to execute in separate protection domains and at different security levels to minimize the impact of any corrupted or compromised agents.The proposed system would be deployed in the research and instructional computing labs at the University of Minnesota to evaluate the effectiveness of its mechanisms. This system would be implemented using the Ajanta agent programming system. For this purpose, the capabilities of the Ajanta system would be enhanced to support secure agent groups and debugging facilities for large-scale agent based programs. This monitoring infrastructure would be made available to the community for research and education activities.