Behavior Based Detection of Unfavorable Resources

Abstract

This article considers a problem of security in a computer systems in context of some mechanisms which act in societies and which mechanisms are seen as being useful to assure security in a computer system. A new approach to the security problem is discussed, which refers to identifying computer resource (e.g. agent, program) on the basis of this resource behaviour (actions which this resource undertakes). Mechanisms are presented, which may enable to recognize and dismiss resources undesirable or harmful in the computer system on the basis of behavior observation. Proposed mechanisms were tested in simulations of the computer system under DoS attack. The results of tests are presented and discussed.

Algorithm of Behavior Evaluation in Multi-agent System

“…Presented in [4] simulations are more adequate to a real-world multi-agent system. In that simulations all actions of agents are asynchronous.…”

“…-type g=0 -agents which take one unit of randomly selected (A-50%, B-50%) resource in every full life cycle; -type g=1 -agents which take one unit of randomly selected (A-75%, B-25%) resource in every full life cycle; type g=1 agents can be treated as intruders, because increased probability of undertaking only actions of one type can cause blocking the system (what is presented in [3,4]); -type g=2 -agents which take one unit of A resource in every full life cycle; type g=2 agents are also called intruders.…”

“…Three functions of evaluation: linear, discrete and power were proposed and researched. Proposed mechanisms in algorithm of behavior evaluation allow to reduce computational complexity of earlier algorithms presented in [3,4,5].…”

“…Simulations that in every constant time period ∆t each agent in the system executes his full life cycle are presented in [3,5]. An exemplary agent a calculates his division state m a in every life cycle and chooses agent (or agents) number k, that m The environment calculates the sum of coefficients and liquidates an agent (or agents) number n which fulfills two requirements:…”

“…Description of division profile was presented in [3,4,5]. This article contain only some information that is crucial to the problem of collecting and data processing of the results of distributed behavior evaluations.…”