MULTI-AGENT SYSTEM FOR NETWORK ATTACK DETECTION

Transcription

1 Intenational Jounal of Civil Engineeing and Technology (IJCIET) Volume 9, Issue 6, June 2018, pp , Aticle ID: IJCIET_09_06_032 Available online at ISSN Pint: and ISSN Online: IAEME Publication Scopus Indexed MULTI-AGENT SYSTEM FOR NETWORK ATTACK DETECTION Aleksei A. Sychugov Associate Pofesso, Depatment of Infomation Secuity, Tula State Univesity, Tula, Russian Fedeation Vycheslav L. Tokaev Associate Pofesso, Depatment of Infomation Secuity, Tula State Univesity, Tula, Russian Fedeation ABSTRACT Vius potection is necessay to peseve infomation. Netwok data esouce secuity is povided with the help of fiewalls, antivius solutions, attack detection systems, integity monitoing systems and encyption. This aticle offes a method fo netwok attack detection, based on a multi-agent system, in which each agent is installed on each of the netwok nodes. A knowledge-based achitectue, in which the agents ae inteconnected accoding to fuzzy elational model, is intoduced as the fundamental pinciple of the system. The offeed method povides eal-time anomaly detection. he study has showed that the poposed method can be applied to detect anomalies in eal-time mode, which is the majo advantage of the method. Method implementation poved that its efficiency depends on the chosen pogamming language. Key wods: netwok attacks, apid anomaly detection, poposed method, communication, incoming agent. Cite this Aticle: Aleksei A. Sychugov and Vycheslav L. Tokaev, Multi-Agent System fo Netwok Attack Detection, Intenational Jounal of Civil Engineeing and Technology, 9(6), 2018, pp INTRODUCTION Netwok data esouce secuity is povided with the help of fiewalls, antivius solutions, attack detection systems, integity monitoing systems and encyption. All of these systems ae chaacteized eithe by thei peiodic o shot-tem application fo solving a paticula poblem, o by pemanent use with static settings [1]. As a esult, the analysis methods used in such systems fo the detection of stictly specified netwok intusion types tun out to be inefficient in case of yet unknown intusion types o modifications of the existing ones. Theefoe, ou cuent task is to find the methods to detect fobidden events in the netwok that is to say, the anomalies caused by unauthoized intusions. One of the majo equiements edito@iaeme.com

2 Multi-Agent System fo Netwok Attack Detection fo such methods is the ability to detect unspecified anomalies, including new and distibuted ones [2]. Most of the netwok attacks can be conditionally divided into thee types: 1) econnaissance attack aimed at gaining infomation about the tageted compute (ping sweep, DNS zone tansfe, TCP o DNS pots scanning, econnaissance, etc.); 2) exploit, which is a piece of softwae attacking softwae vulneabilities (the aim is to gain contol ove the system, to cause its malfunction, etc.); 3) denial-of-sevice attacks by means of unauthoized oveloading of CPU, exhausting had dive stoage space o binging down the sevices. The attacks may oiginate eithe fom a single souce o fom seveal ones [3]. Distibuted attacks constitute a type of denial-of-sevice attacks, fo example, flood and stom attacks, emote intusion (NetBus, BackOifice), local intusion (GetAdmin), emote denial of sevice (Teadop, tin00) o local denial of sevice. 2. TYPES OF NETWORK ATTACKS Thee is a huge numbe of ways to implement these attacks and that numbe is constantly gowing. This point can be illustated by bief desciption of seveal netwok attacks. Data fagmentation. When tansmitting IP data packets ove the netwok, the packet can be divided into seveal fagments. Late, upon eaching the ecipient, the packet is ecoveed fom these fagments. The attacke can send a lage numbe of fagments, which leads to the oveflow of softwae buffes at the ecipient s compute and sometimes to system cash. Ping flooding attack. To pefom this attack the malefacto needs an access to high-speed Intenet connection. Ping sends ICMP echo equest packet with specified time and identifie. The coe of the taget compute sends back an ICMP echo eply. Upon eceiving it, the pogam epots the ound-tip time. Nomally the packets ae sent with some time intevals in ode not to cause netwok oveload. But in the aggessive mode the flow of ICMP echo equest/eply-packets can oveload a small channel, causing a disuption of useful infomation tansmission. IP encapsulated non-standad potocols. IP packet contains a field, that specifies the potocol of encapsulated packet (TCP, UDP, ICMP). The attackes can use a non-standad field value to tansmit the data, that can not be detected by standad means of flow contol [4]. Smuf attack consists in flooding the netwok with boadcast ICMP equests on behalf of the victim. As a esult, the computes, eceiving these boadcast packets, eply to the victim, which leads to a consideable bandwidth decease and in some cases to complete isolation of the attacked netwok. Smuf attack is exceptionally effective and widespead. In ode to detect this attack it is necessay to analyze the channel load and identify the easons of low bandwidth. DNS spoofing. This attack esults in foced matching of IP-addess and domain name in DNS seve cash. Consequently all uses of the DNS seve get false infomation about domain names and IP-addesses. DNS spoofing is chaacteized by a huge numbe of DNS packets with the same domain name due to the need to match some DNS exchange paametes. To detect such attack it is equied to analyze DNS taffic content o use DNSSEC edito@iaeme.com

3 Aleksei A. Sychugov and Vycheslav L. Tokaev IP spoofing. Many Intenet attacks ae associated with spoofing of the souce IP-addess. One of these attacks is called syslog spoofing and consists in sending a message to the victim compute on behalf of anothe compute within the intenal netwok. As fa as syslog potocol is used to log system events, it is possible to impose data o cove up tacks afte an unauthoized intusion by sending false messages to the victim compute. IP spoofing can be detected by means of monitoing souce addess matching in sent and eceived packets within a single inteface o by means of contolling the eceipt of packets with intenal netwok IP-addesses on the extenal inteface. Replay attack. The malefacto sends packets with a fake etun addess. This way the attacke can get access to the connection between othe computes. In this case attacke s access ights ae equal to those of the use, whose seve connection was switched to malefacto s compute. Sniffing. This type of attack can occu only in a local aea netwok. All netwok inteface cads have the option of captuing packets, tansmitted ove a shaed LAN channel. Futhemoe the wok station compute is able to eceive packets, addessed to othe computes of the same LAN segment [5]. Thus the entie data exchange pocess within the netwok segment can be accessed by the attacke. Malefacto s compute and the tageted one have to be connected to the same LAN segment fo the successful ealization of the attack. Route packets sniffing. Route netwok softwae has an access to all the netwok packets, tansmitted via the oute, and this allows captuing the packets. The attacke needs to have pivileged access at least to one of the netwok outes. Since a oute usually tansmits a lot of packets, thei total sniffing becomes impossible. Howeve some sepaate packets can be captued and kept fo futhe analysis by the attacke. The most efficient type of this attack is sniffing FTP packets with uses pofile and passwods. The above mentioned findings demonstate that thee is a specific set of chaacteistics that can seve as a sign of anomalies caused by unauthoized intusions, when occuing sepaately (o collectively, which is even bette). Theefoe ou majo task is to povide apid and automatic detection of these anomalies Detect Netwok Attacks This aticle investigates poblem solution with the help of multi-agent system that is to say, a numbe of intelligent agents ( softwae obots ) distibuted ove the netwok, moving aound it in seach of elevant data, knowledge and pocedues and coopeating while solving the poblems [6]. An agent is an entity in the envionment, poviding data, capable of eflecting and intepeting the events in that envionment and of executing commands. In ode to detect netwok attacks the agent needs to have softwae components, which allow having the following chaacteistics: autonomy (the ability to function with total self-contol of the actions and intenal state); coopeativity (the ability to coopeate with othe agents, exchanging messages encoded with the help of a common language); fast esponse (the ability to peceive the state of the envionment and esponse to the changes in due time); poactivity (the ability to take up the unning, that is the ability to geneate tasks and act ationally); edito@iaeme.com

4 Multi-Agent System fo Netwok Attack Detection awaeness (possession of pemanent knowledge, unchangeable duing agent s activity and of opeational knowledge, which can vay with time and even become false); sense of pupose (the ability to plan the actions, aimed at achieving goals, that is the equied states and situations); ationality the ability to act in such a way as to achieve the goals with minimal time and esouces. Thee ae two types of poblems to be solved fo the pupose of fomal desciption of mental notions: syntactic and semantic ones. Knowledge fomalism (as well as the desciption of any othe infomation) should have the following two aspects: its own language fo fomal desciption and its own semantic model [7]. It is poposed to apply fuzzy logic to the desciption of syntax. Howeve due to the dynamic natue of agent s activity and multi-agent system, these logic should be supplemented by desciption methods applied to tempoal aspects of knowledge, and in some cases by means of desciption of eal-time chaacteistics. Fom the point of view of fomalization semantics, symbolic stuctues can be intepeted with the help of coesponding functions (algoithms) and data stuctues. 3. THE PROPOSED METHOD FOR DESIGNING A MULTI-AGENT SYSTEM The distibuted solution fo netwok anomaly detection by seveal agent can be divided into the following stages: 1) agent-manage (cental agent) decomposes the oiginal task into sepaate tasks, which ae distibuted among executive agents; 2) each executive agent solves its task, also dividing it into subtasks in some cases; 3) sepaate esults fo the selected tasks ae integated to get a geneal solution. We offe the following fuzzy elational model to be used as the basis of the executive agent R : A B, R m m2 jk 1 p 2 p mp whee A A 1,A2,...,A m functions A x0,1 fo j=1,,m; x x x x i 1, 2,..., m paametes of netwok opeation; B 1,B 2,...,B m Y with membeship functions B y0,1 k a value anging fom 0 to 1 this value estimates the pesence of anomalies; 0,1 j=1,,m, k=1,,p. is a set of linguistic tems, defined on X with membeship is the vecto of fuzzy cuent B is a set of linguistic tems defined on fo k=1,,p; y is a fuzzy output vaiable with When obtaining the tem values of A A,A (1), 1 2,...,A m - a fuzzy set, eflecting the vecto of values of diffeent vaiables, including the symbolic ones, with the values of jk edito@iaeme.com

5 membeship functions x0,1 fuzzy infeence: Aleksei A. Sychugov and Vycheslav L. Tokaev allows estimating the anomaly esulting fom the Ai B A A B (2) The pocess of finding a coopeative solution can be divided into fou stages: 1. Detection. Coopeative solution finding pocess stats at the moment when the agent detects the easonability of such actions. Fo example, in case when the agent lacks infomation to ensue the eliability of the logical infeence. 2. Agent teaming. At this stage the agent, that has detected the feasibility of coopeation, is seaching fo patnes. If this stage is successfully completed, a team of agents with equal esponsibilities in collective actions is fomed. 3. Collective planning. At this stage the agents exchange the infomation (messages) in ode to wok out a collective plan aimed at the ealization of the equied goal. 4. Collective actions. At this stage the agents ae acting accoding to the obtained plan, inteacting within the potocol. Detection is based upon the estimation of agent coopeation potential. Thee is a coopeation potential in elation to the goal g of an agent i if: (1) thee is a team q, such that i believes that q can collectively gain g and eithe (2) i can not each g acting sepaately o (3) i believes that fo each action а, that could be pefomed in ode to get a goal g it has anothe goal esulting in failue to pefom action а. Team fomation pocedue is as follows: agent i (with goal g), that has a potential fo coopeation with the team q, is tying to each such state of the team q in which it could collectively get the goal g and in which the team q is obliged to pefom the actions collectively [8]. Collective planning stats if the pevious stage was successful. Then thee is a team of agents, obliged to pefom the actions collectively. Howeve collective opeation can not stat until the team agees upon the specific functions of each agent. Collective actions begin at the end the pevious stage. In the initial state of collective actions stage thee is a geneal plan of the team q and it (q) intends to continue woking togethe. Nomally the actions duing this pocess ae pefomed accoding to the accepted plan until the moment of its completion. Howeve sometimes collective actions can be inteupted. The system is managed only due to the local inteactions among the agents. A coodinating agent is needed to suppot such management. The coodinating agent can be attached to АМР (Agent Meeting Place) [9]. АМР is the agent acting as a boke between the agents, equesting some esouces belonging to othe agents and the agents that can povide these esouces. It is a egula agent, supplemented by auxiliay components. These auxiliay components should contain a unified desciption of agents available at AMP and thei abilities (esouces, functions, etc.) on the one hand and on the othe hand they should povide a unified access to them [10]. These conditions ae guaanteed by the following АМР components: 1. Basic sevices; these can include emote invoking of the objects, thei systematization, doubling and othe basic options. 2. Linked pots fo eceiving and sending agents to AMP with the help of elevant potocols. 3. Agent name authentication component (agent identification, authoization ) edito@iaeme.com

6 Multi-Agent System fo Netwok Attack Detection 4. Access subsystem, monitoing the functions of the incoming agent, pesence of the equied sevice at АМР and helping the agent select futhe oute, etc. 5. Suface oute, acting as an inteface between the agents and AMP components, egisteed in this inteface. This oute has a limited vocabulay to satisfy agents equests. 6. Linguistic log which is a database helping agents and AMP successfully communicate. The log egistes vocabulaies and languages, but instead of languages desciption o tems definitions thee ae links to them, i.e. the log povides the infomation that can possibly be undestood at АМР. 8. Resouce manage egistes the agents at AMP and thei esouces and manages AMP esouces. 9. Agent execution envionment, egisteed at AMP. It contols the access to agent s components, analyzes scipts and povides access to the basic featues, etc. 10. Message delivey system; any local tools, esident agents of AMP, etc. can send the messages; the system logs the events and seaches fo the agents fo specific type of events o messages. 4. MULTI-AGENT SYSTEM ARCHITECTURE In geneal multi-agent system fo netwok attack detection has a knowledge-based achitectue. The following equiements define the featues of the poposed achitectue. 1. In the eal application the agent deals with unfoeseen events in space (netwok) and time and in the pesence of othe agents. 2. The agent has to etain the ability to espond adequately and to make decisions. 3. The agent must have an achitectue that would allow coping with uncetainty and lack of infomation, esponding to unfoeseen events using elatively simple ules [11]. The agent s competence in such achitectue is based upon the following types of knowledge: 1) knowledge of the netwok; 2) knowledge of agents capabilities; 3) knowledge of othe agents capabilities; 4) knowledge of inteaction with netwok nodes; 5) knowledge of communication with othe agents (which types of communication ae feasible and useful fo obtaining additional infomation) [12]. The achitectue includes thee levels, with each one coesponding to diffeent types of agent s capabilities: event esponse level helps maintain agent s ability to espond to the events coming fom uppe levels, even if they wee not planned; planning level geneates, executes and dynamically econstucts patial plans, fo example, fo choosing mobile obot s oute; expectance and modeling level simulates the behavio of extenal envionment entities and of the agent itself, which can be used fo intepetation of the obseved behavio and pediction of a possible one in futue. Each of these levels has its own featues. 5. CONCLUSIONS The system is implemented as a combination of message exchange technology and a contextual activation of contolling ules (accoding to the chaacteistics of the subject aea), acting as an intemediay examining data at diffeent levels (peceived input and output data of diffeent levels), adding new data at diffeent levels and deleting some old one edito@iaeme.com

7 Aleksei A. Sychugov and Vycheslav L. Tokaev In fact subsystem ules act as a filte between the sensos of the agent and its intenal levels as well as between the levels and the executive elements. Othe components of the analyzed system consist of intemediate memoy, communication manage and man-machine inteface. Intemediate memoy seves to stoe use s and communication manage s cuent data, geneated by contolling level. Thee ae the following types of infomation stoed in the memoy: goals to be achieved, state of the tasks in pocess of making ageements with othe agents. Expeimental studies of the system have showed: 1) athe high accuacy of anomaly detection (96% on aveage); 2) athe wide ange of detected anomalies. To estimate the poposed method we used KDD Cup 1999 Data. kdd.ics.uci.edu/databases/kddcup99/ kddcup99.html. This aticle has intoduced a method fo netwok attack detection with the help of the detection of compute netwok malfunctions, caused likely by an unauthoized intusion into the netwok. The study has showed that the poposed method can be applied to detect anomalies in eal-time mode, which is the majo advantage of the method. Method implementation poved that its efficiency depends on the chosen pogamming language. The choice is esticted by the equiements to suppot: 1) netwok inteaction, 2) multithead pocessing, 3) symbolic computation, and to conside pocedue calls as messages between the objects. ACKNOWLEDGEMENTS The esults of the eseach poject ae published with the financial suppot of Tula State Univesity within the famewok of the scientific poject PUBL REFERENCES [1] Ayatollahi H., Khansai M., Rabie H. R. A push-pull netwok coding potocol fo live pee-to-pee steaming. Compute Netwoks 130, (2017), pp [2] Cui Y., Lai Z., Dai N. A fist look at mobile cloud stoage sevices: achitectue, expeimentation, and challenges. IEEE Netwok Vol. 30 No 4, (2016), pp [3] Aslam S., Ul Islam S., Khan A., Ahmed M., Akhundzada A., Khan M.K. Infomation collection centic techniques fo cloud esouce management: Taxonomy, analysis and challenges Jounal of Netwok and Compute Applications Vol. 100 No 15, (2017), pp [4] Ha T., Yoon S., Risdianto A.C., Kim J.W., Lim H. Suspicious Flow Fowading fo Multiple Intusion Detection Systems on Softwae-Defined Netwoks IEEE Netwok Vol. 30 No 6, (2016), pp [5] Vieia T.P.B., Tenóio D.F., Da Costa J., Feitas E., Del Galdo G., De Sousa Júnio R.T. Model ode selection and eigen similaity based famewok fo detection and identification of netwok attacks Jounal of Netwok and Compute Applications Vol. 90 No 15, (2017), pp [6] Russell S. and Novig P Atificial Intelligence: A Moden Appoach. Willians, Moscow. [7] Anwa S., Inayat Z., Zolkipli M.F., Zain J.M., Gani A., Anua N.B., Khan M.K., Chang V. Coss-VM cache-based side channel attacks and poposed pevention mechanisms: A edito@iaeme.com

8 Multi-Agent System fo Netwok Attack Detection suvey Jounal of Netwok and Compute Applications Vol. 100 No 15, (2017), pp [8] Poject of multi-agent technology in difficult systems. Open Univesity of the Nethelands, Available at: [9] Nieto A., Roman R., Lopez J. Digital Witness: Safeguading Digital Evidence by Using Secue Achitectues in Pesonal Devices IEEE Netwok Vol. 30 No 6, (2016), pp [10] Choi J. Secet Key Tansmission fo OFDM based Machine Type Communications Jounal of Communications and Netwoks Vol. 19 No 4, (2017), pp [11] Kamal A.E., Iman M., Chen H.-H., Vasilakos A.V. Suvivability stategies fo emeging wieless netwoks Compute Netwoks 128, (2017), pp [12] Izaddoost A., Heydai S.S. Risk-Adaptive Stategic Netwok Potection in Disaste Scenaios Jounal of Communications and Netwoks Vol. 19 No 5, (2017), pp [13] Dimplepeet Kau, Tanisha and Amit Vema, A Fast Handoff Technique in VANET to Decease Delay in Netwok Using Mobile Nodes. Intenational Jounal of Electonics and Communication Engineeing and Technology, 7(6), 2016, pp edito@iaeme.com