Anti-Terrorism - Detection, Indications, and Warnings

Agent software has emerged as the preferred means to enable a new class of distributed networking and Internet applications including; secured data and resource information, secured on-line transactions, secured data distribution and procurement, andsecured asset management. With the advent of distributed agent computing, arises the opportunity to engineer software that specifically addresses the protection of distributed networks using innovative concepts.The ability to detect anomalous behavior at the Internet Protocol (IP) level in a runtime environment is one such concept. The Internet Control Management Protocol (ICMP), for instance, has nearly twenty data points that can be tracked and analyzed forbehavior that is outside the norm. As an example, if one were to track the number of initiated ports on a session it would be apparent when a port scan was being implemented. This exposure of an initial probe of network services would provide an earlywarning to an attempted exploitation on the system, allowing the host system to take appropriate counter-measures to fend off the attack.This proposal addresses these concepts and provides an extendable architecture for future capabilities by the integration and enhancement of the Object Management Group's (OMG) [2] CORBA specifications for object-oriented middleware. CORBA provides open,secure industry architecture for the interoperation of intelligent agents and has an object-oriented basis to wrapper existing and newly developed systems. An intelligent security agent module opens up a new class of potential commercial applications in many industry sectors. Following are examples of such applications:1. Enterprise intelligent security anomaly detection, data collection and interpretation. There is a strong need today for an integrated threat management system with easy to use and understand interfaces.2. Secured access and use of Intranet-based applications that access and manipulate sensitive corporate customer and product data. This scenario would include threat deterrent for such vertical applications as banking and investment brokering whereanomalous behavior threat constitutes financial loss.3. Use as a validation and verification tool to test networks for potential risk and assessment. Deploying an Anomaly detector Module can act as an agent to identify and assess network vulnerability by identifying and assessing abnormal usage.4. The Anomaly detector Agent can be modified to securely detect and deter any number of external and internal threats to network and host based assets.Many other applications can be enabled with intelligent agent security based systems. The above list is representative of the types of applications possible with this technology.