A Proposed Architecture for Autonomous Mobile Agent Intrusion Prevention and Malware Defense in Heterogeneous Networks

Abstract

This paper proposes an architecture that can support autonomous mobile agents performing intrusion prevention activities on a heterogeneous network. The division of duties performed by the agents in the system ensures the agents are able to remain distributed throughout the network architecture to eliminate single points of failure. The distributed nature of the architecture reduces the workload on network clients and eliminates duplication of effort wherever possible. The use of virtual machine interfaces between the hardware and the network connection isolates the hardware interface in order to maintain trust and integrity of the connection and reduce the potential for an attacker using a trusted resource to damage network assets. Virtual machine connections allow a potential malware infection that invades the network environment to be safely observed for unusual behavior patterns using heuristic analysis to provide new evidentiary indicators that can be used to identify the malware during future outbreaks.