Sie sind auf Seite 1von 6

Conviction Model for Incident Reaction Architecture

Monitoring based on Automatic Sensors Alert Detection


Christophe Feltus and Djamel Khadraoui
Public Research Centre Henri Tudor,
29, avenue John F. Kennedy
L-1855 Luxembourg-Kirchberg, Luxembourg
christophe.feltus@tudor.lu

ABSTRACT detect [15] and characterize attacks, react accurately and


Dynamic distributed wireless networks constitute a critical pillar automatically, and manage network equipment policy to protect
for the information system. Nonetheless, the openness of these the infrastructure, no mechanism has been defined to include the
networks makes them very sensitive to external attack such as the requirement for autonomous reaction and dynamic self-
DoS. Being able to monitor the conviction level of network reconfiguration of the architecture. Each entity has a
components and to react in a short time once an incident is responsibility e.g. detect an intrusion, forward the alert if
detected is a crucial challenge for their survival. In order to face necessary, aggregate and correlate the information from possible
those problems, research tends to evolve towards more dynamic multiple sources, decide to apply a new security policy and
solutions that are able to detect and validate network anomalies disseminate the new policy. But what is the behavior to adopt if
and to adapt themselves in order to retrieve a secure an entity becomes malicious after an attack? Which other entity
configuration. In this position paper, we complete our previous will take its responsibility? And how can we assure that this
works and make the assignment of functions to agents more alternative entity is the more appropriate to take the
contextual. Our approach considers the concept of agent responsibility?
responsibility that we assigned dynamically to agent and that we Our objective is to extend the solution proposed in [2] with (i) a
exploit in order to analyze the level of conviction in the set of policies that specifies and represents the responsibilities
component. In this current paper, we provide an insight of the assigned to agents, and (ii) with an conviction model able to give
architecture without depicting the assignment mechanism neither an assurance value based on the verification of responsibility
the conviction calculation. fulfillment by the assigned agent.
Categories and Subject Descriptors The paper is structured as following: Section II details the ReD
architecture and explains how agents interact in order to detect
H.2.7: Security, Integrity, and Protection. incidents and react accordingly. Section III presents the
responsibility model and its instantiation for our use-case
General Terms specification. Section IV links the responsibility model to a
Management, Measurement, Performance, Design, Reliability, conviction model, evaluates the responsibility of the network
Experimentation, Security, Standardization, Verification. components at a period of time (p) and provides a conviction
value for all of them. Section V proves the conceptual validity
Keywords from a Lab Case deployment and last section concludes the paper
Keywords are your own designated keywords. and introduces future works.
1. INTRODUCTION 2. ReD ARCHITECTURE
Wide-area wireless data services are provided by heterogeneous The reaction architecture presented in this section is based on the
entities which have to communicate in order to forward ReD project [1]. The ReD (Reaction after Detection) project
information from A to B. In our case, we consider the security of defines and designs a solution to enhance the detection/reaction
this kind of wireless overlay networks. To ensure the security of process and improves the overall resilience of IP networks. ReD
the information system, entities have to collaborate in order to architectures are built around a set of four types of responsibilities
detect, forward, make decision and react in case of attack. assigned to agents:
The architecture proposed in ReD project [1] defines an advanced PEP (Policy Enforcement Point) enforces, outside the ReD
single management console for security incident detection and node, the security policies provided by the PDP.
reaction management, as part of a comprehensive Secure
Information Management (SIM) system. Despite its capacity to PIE (Policy Instantiation Engine) is the agent that receives
information about attacks from the ACE and instantiates new
security policies to react to the attack.
Permission to make digital or hard copies of all or part of this work for PDP (Policy Decision Point) receives the new security policies
personal or classroom use is granted without fee provided that copies are defined by the PIE and deploys them at the enforcement points
not made or distributed for profit or commercial advantage and that (PEP);
copies bear this notice and the full citation on the first page. To copy
otherwise, to republish, to post on servers or to redistribute to lists, ACE (Agent Correlation Engine) is the agent in charge of
requires prior specific permission and/or a fee. receiving alerts coming from network nodes, to correlates the
SIN'13, November 26-28, 2013, Aksaray, Turkey information and to forward confirmed alert to the PIE;
Copyright 2012 ACM 978-1-4503-1668-2/12/10... $15.00.
Figure 1. ReD node Architecture mapped with BARWAN case study [14]
1
Fig. 1 illustrates the ReD architecture applied on the BARWAN and the previous log values and to report this analysis to the ACE
use-case [2]. The flow is supposed to begin with an alert detected in case of suspected alert. In order to perform the monitoring
by the automatic sensors (termed IDS). This alert is sent to the activity, the PEP is assigned to obligations of achieving some
ACE of BuildingA (BuildingA_ACE) agent that does or does not tasks and he gains in parallel the access rights needed to perform
confirm the alert to the PIE. Afterwards, the PIE decides to apply these tasks. When a crisis occurs, for instance a DoS attack, one
new policies or to forward the alert to an ACE from a higher layer or more PEP agents can be isolated from the rest of the network,
(upper ACE). Its PIE agent sends the policies to the PDP agent, the normal monitoring rules and procedures do no longer work as
which decides which PEP is able to implement it in terms of rules usual and it is required to change the responsibility of the agents.
or script on devices (laptop, InfoPad server, fileserver, etc.). Then For instance, in the above case, other agents have to fulfill the
the PDP agent returns the new policy to the PEP agent that knows responsibilities of the isolated PEP.
how to transform a policy into an understandable rule or script for
the component. The Fig. 2 presents a more detailed view of the
architecture of the use case.
As previously explained, ReD specifications are embedded in
reaction policies managed at the multi-agents system (MAS)
management layer. These policies specify the responsibility of
each agent on the network and their evolution according to
reaction. The formalization of the agent responsibilities has been
achieved according to the responsibility model presented in the
next section.

3. AGENT RESPONSIBILITY
3.1 Responsibility Model
In a non-crisis context, agents are assigned to responsibilities like
PEP, PIE, ACE, etc. By analyzing for instance the activity of
monitoring the fileserver (see Fig. 2), we observe e.g. that the PEP
concerned by that activity has the responsibility to collect the log
file on the firewall, to make a basic correlation between the values

1
Bay Area Research Wireless Access Network project, conducted at the
University of California at Berkeley. Figure 2. Synoptical ReD Architecture
In general, the definition of the agent responsibility is mostly We consider the trust in an agent as the reliance that this agent
incomplete. Most of the architectures only consider the agent act as it is requested. For didactic reason, we consider in this
against the outcome that it has to produce. Sometimes, advanced paper that a trust level of 10 is high and a trust level of 0 is low.
solutions integrate the inputs that those agents request for
performing the outcome. We define the responsibilities as a state 3.2 Agent Responsibility Specifications
assigned to an agent to signify him its obligations concerning the Based on the responsibility model defined above, we may
task, its accountabilities regarding its obligations, and the rights instantiate the responsibility model for each responsibility of the
and capabilities necessary to perform it. In [3] and [12] we have agents within the network. Because of the size of the paper, only
proposed an initial responsibility model that can be used to depict the four most important meta-concepts are instantiated: the
the agent responsibility. That responsibility model has been obligations concerning the task (in red), the capabilities (in blue),
upgraded in order to integrate the following concepts: the rights (in green), and commitment represented as a trust value
(in black). Table 1 provides these concepts instantiated for each
responsibilities of the network. The two last columns propose a
mapping of the rights and capabilities which are necessary by
obligation.
For the PEP, we observe that the responsibility includes
obligations such as the obligation to retrieve the logs from the
component he monitors (O1), to provide an immediate reaction
if necessary (O2), etc. In order to perform that obligation, he
must have the capabilities to be on the same network as the
component he controls (C1), to be able to communicate with the
PDP (C2), to be able to communicate with the facilitator agent
(C3) and so on. He also must have the right to read the log file on
the concerned network component (R1), to write the log in a
central logs database (R2), and so on.
Fig.3. Responsibility model for Conviction sharing
4. MONITORING NEEDS BASED
The assignment is the action of linking an agent to a
responsibility. Delegation process is the transfer of an agents CONVICTION MODEL
responsibility assignment to another agent. Commonly an agent is considered as an encapsulated computer
system [13] that is situated in some environment and that is
The accountability is a duty to justify the performance of a task capable of flexible, autonomous action in that environment in
to someone else under threat of sanction [5]. Accountability is a order to meet its design objectives [9]. As agents have control
type of obligation to report the achievement, maintenance or over their own behaviour, they must cooperate and negotiate with
avoidance of some given state to an authority and, as each other to achieve their goals [10]. The convergence of these
consequence, is associated to an obligation. Accountability agents properties and distributed systems behaviour makes the
contribute to generate trust or to remove trust depending of the multi-agent architecture an appropriate mechanism to evaluate the
accountability outcomes [20]. security (Conviction) of critical infrastructures run by distributed
systems [11]. Nonetheless for such multi-agents systems one
The obligation is the most frequent concept to appear as well in
would expect each involved agent to be able to meet its assigned
literature [4] as in industrial and professional frameworks.
responsibilities in order to provide efficient monitoring of the
Obligation is a duty which links a responsibility with a task that
security [14] of a network. Indeed, this is an intrinsic
must be performed. We define a task as an action to use or
characteristic of the monitoring system which should be
transform an object.
guaranteed if one is to gain a reliable insight of a network security
The capability describes the requisite qualities, skills or resources posture. The common approach which is to put more emphasis on
necessary to perform a task. Capability may be declined through the well functioning of the network itself need being augmented
knowledge or know-how, possessed by the agent such as ability to with a critical evaluation of the monitoring system to ensure the
make decision, its processing time, its faculty to analyze a reliability of its operations. This is relevant since links between
problem, and its position on the network. entities part of the monitoring system may break, agents with the
task of conducting the verification and measurements may fail to
The right is common component but is not systematically fulfill their tasks and obligations for a range of raisons including:
embedded in all frameworks. Right encompasses facilities
required by an agent to fulfill his obligations e.g. the access right Erroneous assignment of their rights or alteration of the latter
that the agent gets once he is assigned responsible. during runtime [16].
The commitment pledged by the agent related to this assignment Agents capabilities may be insufficient for accomplishing a
represents his required engagement to fulfill a task and the task assigned to them
conviction that he does it in respect of good practices. The
An accumulation of tasks for an agent may result in an
commitment in MAS has already been subject to many researches overload and subsequently a failure to meet some of its
[6]. The semantic analyze of the commitment [7] and [8] responsibilities.
advocates for considering trust between agents as a pragmatic
commitment antecedent [1]. And so forth.
Table 1: Responsibilities instantiation
Obligations concerning Task Capabilities Mapping of Mapping of
Capabilities to Rights to
Level of Trust Rights Obligations Obligations
O1: Must retrieve the logs from the C1: Is on the same network as the component to control C1, C4, C6, C7 R1, R2, R4
component it monitors C2: Be able to communicate with the PDP
C3: Be able to communicate with the facilitator agent
O2: Must provide an immediate reaction if
C4: Have enough computing resource to monitor the component
necessary C1, C2, C4 R3
to control
O3: Must communicate with the facilitator C5: Be able to communicate with the MAS management layer
C6. Must be able to encrypt data
PEP

tin order to get the address of the other C3


components (PDP, ACE) C7. Be able to communicate securely with the ACE
O4: Must report the incident to the ACE in
a secure way C5, C6, C7 R5
R1. Allow to read log file on the concerned network component
T: 3,365 R2. Allow to write log in the central logs database
R3. Be able to read the Policy in the MAS management layer
R4. Allow to read and right in the alert database
R5. Allow to read the Public key database
O1: Based on the incident report from the C1: Has a fast bandwidth
PEP, must decide which reaction policy is C2: Has high CPU resources C1, C2 R1, R2, R3
appropriate to be deployed by the PEP C3: Has a central position on the network
O2: Must communicate with the facilitator C4. Be able to perform backup of the policy rules
to get the address of the other components C1, C3, C4 R1, R2
PDP

(PDP, PIE, Facilitator) and make back up


R1. Allow to read the yellow pages database
T: 4,897 R2. Allow to read the white page database
R3. Allow to read the policy rules status
O1: Must communicate with the PEP or C1: Has high CPU resources in order to make correlations.
others ACE to receive alert message C2: Has a central position on the network C2, C3, C4 R4
O2. Must correlate the Alerts from different C3: Be able to communicate with all agents
PEP or from inferior ACE C4. Must be able to decrypt data from the PEP C1 R2, R3
C5. Must be able to encrypt data to upper ACE
ACE

O3. Must confirm the alert to related PIE


C2, C3, R3
O4. Must forward the alert to the upper
ACE C2, C3, C5 R1, R4
R1. Allow to read policy rules status
T: 8,116 R2. Allow to read alert database
R3. Allow to write in the confirmed alert database
R4. Allow to read the Public key database
O1: Must provide IT addresses of the C1. Have a position in which it is always available
Facilitator

requested component C2. Has a significant bandwidth depending on the network size C1, C2 R1, R2, R3
O2: Make a mapping between the C3. Be able to perform backup of the white page and yellow page
component name and the IP address and database C3 R1, R2, R3
keep backup
R1. Allow to read and write to the white pages services database
T: 5,099 R2. Allow to read and write to the yellow pages services database
R3. Allow to read information about the topology of the network

This call for a clear definition and specification of the conditions


under which an entity part of the monitoring system [17] can, with Capability: the overall capability assigned to an agent should
be below its capability. Moreover such capability should
reasonable evidence, be expected to fulfill a required task. In
enable it to fulfill its obligations
another word, we need to provide the basis for gaining justifiable
conviction that an entity can meet its monitoring responsibilities. Level of Trust: should be higher or equal to the minimum level
required specified in Table 1.
4.1 Predetermination for Agents
Based on the above requirements the conviction for an agent
Responsibilities Fulfillment fulfilling its obligation should be based on the followings:
Although a plethora of conditions may need to be fulfilled for
expecting an agent to meet its obligations, it is imperative that the Conviction A for fulfillment of Obligation O by an Agent
with right R, Capability C and Trust T: A0 (R, C, T.)
followings are met:
(according to the assurance description from [11]):
Rights: the set of rights entrusted to the agent should be such
that they enable satisfaction of its obligations. A0 (R, C, T) = 0 if (R0 R) (C0 C) (TpT) (1)
Otherwise:
A0 (R, C, T) = 1 (2) able to encrypt data (C6) and be able to communicate securely with
the ACE (C7). The PEP is also entrusted with a set of rights to
With: satisfy O1. These include R1: is allowed to read log file on the
concerned network component, R2: is allowed to write log in the
R the current rights of the agent central logs database and R4: is allowed to read and write in the
C the current capabilities of the agent alert database. The minimum level for the trust parameter
R0 the set of rights necessary for fulfilling obligation O expected from the PEP is set to 3.
C0 the set of capabilities necessary for fulfilling obligation O
R0 include in R if for each right R0, i, part of R0, R0,i R 5. DEPLOYMENT LAB CASE
C0 include in C if for each capability C0, i, part of C0, C0,i C CONCEPTUAL VALIDATION
Tp the trust at period p.
Based on the specifications of the responsibilities associated to
Relations (1) and (2) imply that the satisfaction of an obligation each agent provided in Table 1, one can assess whether current
can only be guaranteed if the set of rights allocated to the agent and rights, capabilities and trust level of each agent can be sufficient to
its current capabilities are both subsets of the set of rights and fulfill a given obligation. Lets consider for instance Table 2, the
capabilities required for the satisfaction of that obligation and if the current deployment of ReDs agents revealed that all four agents
trust level at period p (Tp) is higher or at least equal to the PEP, PDP, ACE and the facilitator, although the level of trust is
reference T. As illustration, Table 2 provides the set of rights, always sufficient, they will not be able to fulfill respectively their
capabilities and trust possessed by the agents being assigned to obligations O2, O1, O1, O2. In the case of the PEP, the obligation to
responsibilities on the network at a period (p). The table reveals for provide an immediate reaction is hampered by the fact that the PEP
instance that to make the PEP able to fulfill obligation O1: Must lacks the capability to communicate with the PDP (C2). This means
retrieve the logs from the component it monitors, it should be on that any appropriate policy cannot be grounded to the PEP and be
the same network than the component to control (C1), have enough implemented in case of abnormally within the system.
computing resource to monitor the component to control (C4), be
Table 2: rights and capabilities of monitoring agents at period t

Obligations concerning Task Current agents Current agents Conviction of obligation


capabilities obligations fulfillment
Level of Trust

O1: Must retrieve the logs from the component it monitors C1, C4, C6, C7 R1, R2, R4 1
O2: Must provide an immediate reaction if necessary C1, C4 R3 0
PEP

O3: Must communicate with the facilitator tin order to get C3 1


the address of the other components (PDP, ACE)
O4: Must report the incident to the ACE in a secure way C5, C6, C7 R5 1
T: 3

O1: Based on the incident report from the PEP, must decide C1, C2 R1, R2, 0
which reaction policy is appropriate to be deployed by the PEP
PDP

O2: Must communicate with the facilitator to get the address C1, C3, C4 R1, R2 1
of the other components (PDP, PIE, Facilitator) and make back
up
T:4
O1: Must communicate with the PEP or others ACE to
receive alert message C2, C3, R4 0
O2. Must correlate the Alerts from different PEP or from
ACE

inferior ACE C1 R2, R3 1


O3. Must confirm the alert to related PIE C2, C3, R3 1
O4. Must forward the alert to the upper ACE C2, C3, C5 R1, R4 1
T: 8

O1: Must provide IT addresses of the requested component C1, C2 R1, R2, R3 1
Facili-

O2: Make a mapping between the component name and the R1, R2, R3 0
tator

IP address and keep backup


T: 5

Obligation O1 of the PDP also suffers the lack of R3 which gives other ACEs to receive alerts since it cannot decrypt the message
the PDP the right to actually read the policy status and deploy a protocol coming from the PEP (C4). The facilitators obligation to
problem solving mechanism. The ACE as the agent responsible for keep back up (O1) can hardly be satisfied given the required
receiving alerts from nodes within the network cannot current meet capability C3 is currently not there.
its obligation O1 which is about communicating with the PEP and
6. CONCLUSIONS [5] B. C. Stahl, Accountability and reflective responsibility in
information systems. In: C. Zielinski et al. The information society
Critical infrastructures are more and more present and needs to be - emerging landscapes. Springer, 2006, pp. 51 -68.
seriously managed and monitor regarding the increasing amount [6] P. Munindar Singh, Semantical Considerations on Dialectical and
of threats. This paper presents a solution to automatically react Practical Commitments. Proceedings of the 23rd Conference on
after an incident on a wireless network based on MAS Artificial Intelligence (AAAI). July 2008
architecture. The system initially based on static assignments of [7] M. J. Smith and M. Desjardins. 2009. Learning to trust in the
function to agents needed more dynamicity in order to stay competence and commitment of agents. Autonomous Agents and
aligned with the new arising risks. Multi-Agent Systems 18, 1, 36-82.
[8] J.Broersen, Mehdi Dastani, Zhisheng Huang, and Leendert W. N.
In this position paper, we firstly enhance our previous works by van der Torre. 2002. Trust and Commitment in Dynamic Logic.
providing a conceptual representation of the agent responsibilities. EurAsia-ICT '02, Springer-Verlag, London, UK, 677-684.
Our solution exploits the concept of agents obligations regarding [9] N.R Jennings, An agent-based software engineering, Agent
tasks, the concepts of right and capability required to satisfy an Oriented Software Engineering, in the Proceedings of the 9th
obligation and the concept of trust that represent the reliance that European Workshop on Modeling Autonomous Agents in a Multi-
an agent to act as it is requested . Secondly, based on that Agent World (MAAMAW-99), Valencia, Spain.
definition of the agents responsibilities, a conviction level can be [10] P. Ciancarini, and M. Wooldridge, AgentOriented Software
estimated in order to determine the confidence that the agent can Engineering in Procceedings of the 22nd International Conference
meet its responsibilities. In the event of such conviction level on Software Engineering, June 2000, pp. 816-817.
being low, decisions can be made as to whether to shift the [11] M.Ouedraogo, H. Mouratidis, D. Khadraoui and E.Dubois, An
fulfillment of such a responsibility to a different agent. agent based system to support assurance of security requirement., in
proceeding of the fourth IEEE international conference on secure
The architecture that we exploit to demonstrate the enhanced software integration and reliability improvement (SSIRI 2010)
reaction mechanism relies on ReD, which is being tested and [12] C. Feltus, E. Dubois, E. Proper, I. Band, M. Petit, Enhancing the
currently produced in our deployment lab case. Practically ReD ArchiMate Standard with a Responsibility Modeling Language
defines the structural bases for the alert mechanism that we have for Access Rights Management, 5th ACM International Conference
exploited in the paper in order to illustrate the BARWAN project. on Security of Information and Networks (ACM SIN 2012), Jaipur,
Rajastan, India. doi>10.1145/2388576.2388577
Additional lab case demonstrations are currently running and
more formal result are being generated within the CockpiCI [13] Jennings, N. R. (2001). An agent-based approach for building
complex software systems. Communications of the ACM, 44(4),
project [18, 19]. The outcomes of these field experiments already 35-41.
underline the accuracy of the expected conviction model
[14] Schranz, Paul Steven. "VoIP security monitoring & alarm system."
outcomes and strengthen to recalculate the assurance value within U.S. Patent Application 10/694,678.
trust function perspective.
[15] Zaher, A. S., & McArthur, S. D. J. (2007, July). A multi-agent fault
detection system for wind turbine defect recognition and diagnosis.
7. ACKNOWLEGMENTS In Power Tech, 2007 IEEE Lausanne (pp. 22-27). IEEE.
This research is supported and funded by the European FP7-
[16] Sadeghi, A. R., Wolf, M., Stble, C., Asokan, N., & Ekberg, J. E.
Security project CockpiCI, Cybersecurity on SCADA: risk (2007). Enabling fairer digital rights management with trusted
prediction, analysis and reaction tools for Critical Infrastructures. computing. In Information Security (pp. 53-70). Springer Berlin
Heidelberg.
8. REFERENCES [17] Kalinowski, J., Stuart, A., Wamsley, L., & Rastatter, M. P. (1999).
[1] Gateau, B.; Khadraoui, D.; Feltus, C., "Multi-agents system service Effects of monitoring condition and frequency-altered feedback on
based platform in telecommunication security incident reaction," stuttering frequency. Journal of Speech, Language and Hearing
Information Infrastructure Symposium, 2009. GIIS '09. Global , Research, 42(6), 1347.
vol., no., pp.1,6, 23-26 June 2009. doi: 10.1109/GIIS.2009.5307083 [18] Jonathan. Blangenois, Guy. Guemkam, Christophe Feltus, Djamel
[2] E. A. Brewer, R. H. Katz, E. Amir, H. Balakrishnan, Y. Chawathe, Khadraoui, Organizational Security Architecture for Critical
A. Fox, SS. D. Gribble, T. Hodes, G. Nguyen, V. N. Padmanabhan, Infrastructure, 8th International Workshop on Frontiers in
M. Stemm, S. Seshan, T. Henderson, A network Architecture for Availability, 8th FARES 2013, IEEE, Germany.
Heterogeneous Mobile Computing, IEEE Personal Communications [19] Djamel Khadraoui, Christophe Feltus, Critical Infrastructures
Magazine, Oct. 1998 Governance - Exploring SCADA Cybernetics through
[3] Christophe Feltus, Michal Petit, Building a Responsibility Model Architectured Policy Semantic, IEEE SMC 2013, UK.
Including Accountability, Capability and Commitment, ARES [20] Christophe Feltus, Michal Petit, and Eric Dubois. 2009.
2009, Fukuoka, Japan. doi: 10.1109/ARES.2009.45 Strengthening employee's responsibility to enhance governance of
[4] B. Gteau. Modlisation et Supervision d'Institutions Multi-Agents. IT: COBIT RACI chart case study. In Proceedings of the first ACM
PhD Thesis held in cooperation with Ecole Nationale Superieure workshop on Information security governance (WISG '09). ACM,
des Mines de Saint Etienne and CRP Henri Tudor, defended in New York, NY, USA, 23-32. DOI=10.1145/1655168.1655174
Luxembourg the 26th of June 2007. http://doi.acm.org/10.1145/1655168.1655174