Maintaining network resource reliability using a decentralized
system of autonomous agents

Background
The rapid growth of computer networks over the past ten years has resulted in a highly complicated operating environment. Networks are susceptible to a variety of attacks and malfunctions capable of compromising reliability at all levels.  Whether network resource reliability is lost due to malicious behavior, device failure, administrative misconfigurations, or even congestion from valid traffic, the cost of this loss can be astronomical, in terms of lost productivity, the possible theft or destruction of sensitive documents, and civilian or military health, safety, and mission risks resulting from the loss of communication and control.

Computer networks are composed of an assortment of computer platforms, network devices, communication protocols, architectures and configurations. Networks are subject to a number of failures stemming from hardware and software faults, power outages, or demands that exceed capacity. The difficulty is compounded by vulnerabilities, known and unknown, that allow new attacks to be found and exploited.

In order to maintain network reliability in the face of this complexity, a software solution is needed that not only works across heterogeneous networks and inter-networks, but is also scalable to a variety of network sizes and able to continue functioning even when portions of the network are unavailable or have become compromised. SHAI introduces MASRR, a "Multi-Agent System for network Resource Reliability".

Top of page     MASRR home page
 

MASRR focuses on meeting the following criteria:
Scalability: The agents operate autonomously or semi-autonomously within a decentralized architecture, allowing MASRR to manage large networks with varying topologies. Additionally, agents employ message passing protocols that minimize bandwidth consumed by management operations.

Robustness: Each agent operates by observing the state of its own network element(s) and those of neighboring elements. One agent will continue operating even when faced with failures in other parts of the network, adapting to and minimizing the effect of failures by providing alternate routing, modifying security policies, or taking other remedial actions.

Interoperability: Agents are developed using platform-independent code. They are designed to operate within the current TCP/IP and SNMP framework. While they obtain information from their neighbors, they make decisions based on their observations and do not need to be concerned with implementation details of neighboring elements.

Pro-active management: MASRR agents use models of network element and user behavior and misbehavior to detect both known and unknown network-degrading events. Agents reason about their observations, assess the source of a fault, and select and execute actions to mitigate, contain, and recover from problems in the network. 

Top of page     MASRR home page

Innovations:
In developing MASRR, SHAI contributes to the development of these technologies: 

• Decentralized network monitoring and maintenance. Agents respond to network degrading events at the local level and with as much information as might be available from peer MASRR agents.  In addition, the MASRR agents can perform tasks autonomously and semi-autonomously. 
• Reconciliation of differing local views. Agents reconcile their own views of the network with the views from peer agents, allowing each agent to utilize data from disparate sources in the selection of appropriate network maintenance and security actions.
• Acting under uncertainty. MASRR agents will be able to select reasonable responses to network degrading events even though available information is incomplete, enabling the agent to, unlike signature-based intrusion detection systems, respond to situations never previously observed.

Recent Developments:
The contract for this project has been completed. We are currently looking for potential partners who can provide domain expertise and are interested in pursuing additional research funding with us.

Summary: SHAI has developed an architecture to support distributed monitoring agents that share information and perform localized correlation and decision making. Lacking an actual network on which to deploy our agents, we have created a prototype system that uses the Scalable Simulation Framework (SSFNet) network simulator as its runtime platform. We have created a simple scenario to illustrate detection and resolution of a problem cause by an attack. The simulator also confirms the potential of an important project innovation, Change Detection modeling:

Change Detection modeling. A critical ability for MASRR agents is change detection -- noting when network traffic and application behaviors have departed from what is normal or expected. But this expectation varies throughout the day, the week, the month; moreover, the network itself changes as stations and devices are added, removed, and reconfigured. The appearance of "normal" is unique to each network element and thus differs from the perspective of individual agents. We must, therefore, build a system in which each agent can learn patterns for itself and adapt to changes, and yet detect when changes signal faults or attacks. SHAI is using recent advances in data mining to enable agents to model fluctuating, normal patterns of behavior and to classify current observations. When the agent encounters anomalous behaviors, additional diagnostics and reasoning are performed as the agent decides on a course of action.