Mitigation of Insider Risks Using Distributed Agent Detection, Filtering, and Signaling

10.6633/IJNS.200603.2(2).09

Adam J. Rocke；Ronald F. DeMara

File systems management ； multiagent systems ； network-level security and protection ； security kernels ； user profiles and alert services

International Journal of Network Security

2卷2期（2006 / 03 / 01）

141 - 149

英文

An insider-robust approach to file integrity verification is developed using interacting strata of mobile agents. Previous approaches relied upon monolithic architectures, or more recently, agent frameworks using a centralized control mechanism or common reporting repository. However, any such distinct tampering-point introduces vulnerabilities, especially from knowledgeable insiders capable of abusing security-critical resources. In the Collaborative Object Notification Framework for Insider Defense using Autonomous Network Transactions (CONFIDANT), the mechanisms for tampering detection, decision-making, and alert signaling are distributed and corroborated by autonomous agents. In this paper, the CONFIDANT file integrity verification framework is presented focusing on insider defense aspects. User capability classes are defined and critical physical tampering points in intrusion detection architectures are identified. CONFIDANT mitigation techniques of insider tampering exposures and example scenarios are presented.

1. 周建宏(2011)。室內對講機產業分析與既有廠商應對策略之研究。國立臺灣大學國際企業學系學位論文。2011。1-78。