STI/ MAST: A Mobile Agent-based Security Tool for Administration and Training

互联网的发展和全球化给计算机和网络安全带来了巨大的挑战。1988年，互联网蠕虫造成了很大的破坏，并有效地关闭了互联网。然而，受影响的系统主要在大学和其他研究中心。今天的情况与1988年大不相同。许多企业依赖于连接到互联网的系统网络。网络攻击导致停机，由于生产力损失和/或数据丢失，使公司花费大量时间和金钱。此外，关键的基础设施系统正在连接到互联网，从而增加了通过基于网络的攻击造成破坏的可能性。不幸的是，同样的特点吸引了那些希望发表引人注目的言论的攻击者。这个项目将建立一个安全工具，有两个目的：(a)帮助系统管理员发现系统和网络的漏洞和可能的攻击；(b)向学生和新手管理员讲授安全问题。管理员将能够使用该工具检查其系统上的已知漏洞，检查是否安装了最新的安全更新和补丁，并监控其系统以防止不同形式的攻击或入侵。该工具可以在教室、实验室或现场使用，以帮助学生和新手管理员了解安全域、最新的已知漏洞以及如何修复它们。该安全工具将集成并建立在两项关键技术之上：移动软件代理和概念地图。NOMADS移动代理系统将提供代理框架和安全内核，而CMapTools软件将作为应用程序来构建和维护知识库。拟议的安全工具将把这些技术集成到一个管理员控制台中，该控制台将通过远程执行移动代码提供极大的灵活性，监视和控制系统。安全工具将由四个组件组成：管理员控制台、安全内核、知识模型和一组将随工具一起提供和分发的安全代理。基于概念图的知识模型和使用移动代理所带来的灵活性确保了所提出的工具在生产、教学和培训环境中同样有用和有效。在这项工作中提出的MAST安全工具将免费分发给学术和非营利组织使用。

The growth and globalization of the Internet have made computer and network security a paramount challenge. In 1988, the Internet Worm caused much havoc and effectively shutdown the Internet. However, the systems that were affected were mostly at universities and other research centers. Today, circumstances are very different from 1988. Many businesses rely on networks of systems connected to the Internet. Network attacks result in downtime that cost companies significant time and money due to lost productivity and/or loss of data. Moreover, critical infrastructural systems are being connected to the Internet thereby raising the potential for disruption through network-based attacks. Unfortunately, this same characteristic attracts attackers who wish to make highly-visible statements. This project, will build a security tool that serves two purposes: (a) Help system administrators find vulnerabilities and possible attacks on systems and networks and (b) Teach students and novice administrators about security concerns. Administrators will be able to use the tool to check for known vulnerabilities on their systems, to check whether the latest security updates and patches have been installed, and to monitor their systems for different forms of attacks or break-ins. The tool can be used in a classroom, laboratory, or in the field to help students and novice administrators learn about the security domain, the latest known vulnerabilities, and how to fix them. The security tool will integrate and build upon two key technologies: mobile software agents and concept maps. The NOMADS mobile agent system will provide the agent framework and security kernels while the CMapTools software will be used as the application to build and maintain the knowledge base. The proposed security tool will integrate these technologies in an administrator console that will provide extreme flexibility, monitoring and control of the system through remote execution of mobile code. The security tool will consist of four components, the An administrator's console, the security kernel, the knowledge model and a set of security agents that will be provided and distributed with the tool. The Concept Map based knowledge model and the flexibility imbued by the use of mobile agents ensures that the proposed tool will be equally useful and effective in production, teaching and training environments. The MAST security tool, proposed in this work will be freely distributed for academic and non-profit use.