No description available.

Agentes móveis são programas que podem ser disparados de um computador (cliente) e transmitidos através de uma rede de comunicação para uma outra maquina (servidor) com o objetivo de executar tarefas a eles designadas. Esta dissertação apresenta uma avaliação de plataformas de desenvolvimento e servidores para agentes móveis. A tecnologia de agentes móveis tem sido alvo de grandes pesquisas, inclusive nos setores de Segurança da Informação e Comércio Eletrônico. Foram executados testes e com as informações foi feita uma análise comparativa, levando-se em consideração questões como características de desempenho dos agentes, desempenho e segurança. Para efetuar os testes foram necessários o entendimento do funcionamento do servidor e o desenvolvimento de seus agentes. Os testes de desempenho serviram para definir quais agentes são mais ágeis e quais são os gastos de processamento dos servidores. Já o teste de segurança teve a finalidade de classificar os servidores quanto à segurança. Os resultados obtidos serviram para indicar qual a melhor plataforma a ser utilizada no desenvolvimento do Sistema de Detecção de Intrusão (SDI) do ICMC. As plataformas que obtiveram destaques nos testes foram o ASDK 1.1 e Grasshopper. A plataforma escolhida para o SDI foi o ASDK 1.1. / Mobile agents are programs able to migrate from a client computer to a server computer through communication networks. There are several mobile agent technologis application, includind Information Security and Eletronic Commerce. This work describes the valuation of mobile agent plataforms. A test environment was desired and 5 plataforms were compared in terms of the security and performance provided. To make the assessment it was necessary to understand the server functionality an the methodologies to develop the agents. The test of performace helped to define which agents are more agile and what are their processing needs while in the server. The security test aimed to classify the servers in them security. The results were used to determine which is better mobile agente plataform to be used in the on going ICMC’s Intrusion Detection System (IDS). The best performance plataforms were the ASDK 1.1 and the Grasshopper. The chosen plataform for the IDS was the ASDK 1.1.

Cette thèse porte sur l’étude de la complexité de l’exploration de graphes dynamiquespar agent mobile. Une entité mobile (appelée agent) se déplaçant dans un graphe dynamiquedoit traverser/visiter au moins une fois chacun de ses sommets. (Le tempsde traversée d’une arête est unitaire.) Ce problème fondamental en algorithmique paragents mobiles a été très étudié dans les graphes statiques depuis l’article originel deClaude Shannon. Concernant les graphes dynamiques, seul le cas des graphes dynamiquespériodiques a été étudié. Nous étudions ce problème dans deux familles degraphes dynamiques, les graphes dynamiques périodiquement variables (PV-graphes)et les graphes dynamiques T-intervalle-connexes. Les résultats obtenus dans cette thèseaméliorent des résultats existants et donnent des bornes optimales sur le problèmeétudié. / In this thesis, we study the complexity of the problem of exploration by a mobileagent in dynamic graphs. A mobile entity (called agent) moving in a dynamic graph hasto traverse/visit each of its vertices at least once. This fundamental problem in computatingby mobile agents has been well-studied in static graphs since the original paper ofClaude Shannon. However, for highly dynamic graphs, only the case of periodic dynamicgraphs has been studied. We study this problem in two families of dynamic graphs,periodically-varying graphs (PV-graphs) and T-interval-connected dynamic graphs. Theobtained results improve the existing results and give optimal bounds on the studiedproblems.

Nous avons développé dans le cadre de cette thèse deux aspects complémentaires liés à la sécurité des systèmes d’agents mobiles : l'aspect statique et l'aspect dynamique. Pour l’aspect statique, nous avons proposé une spécification formelle des politiques de sécurité qui traite les différentes préoccupations de sécurité dans les systèmes à base d'agents mobiles et couvre les différents concepts liés à la définition de tels systèmes. L'aspect dynamique, s'intéresse à définir formellement l'ensemble des opérations élémentaires de reconfiguration de ces politiques et de définir un cadre qui exprime l'adaptabilité de la politique de l'agent aux nouvelles exigences de sécurité du système visité. Pour les deux aspects, nous avons porté un intérêt considérable à la vérification formelle. Les démarches de vérification élaborées sont implémentées et validées sous l'outil de preuve Z/EVES. D’un point de vue opérationnel, nous avons défini un cadre pour l'imposition des politiques de sécurité. Ce dernier tire profit du cadre théorique, que nous avons défini, et applique une approche de génération de code basée sur le paradigme de la POA. / We develop two complementary aspects related to the security of mobile agent systems: the static and dynamic aspect. The first is related to the specification of security policies which treats the various security concerns in mobile agent systems and covers the various concepts related to the modeling of such systems. The dynamic aspect takes an interest to define a set of elementary operations which may change a given policy and a framework that expresses the adaptability of the agent policy to the security requirements of the new visited system. All Specifications are coded in Z notation.Another main contribution consists in providing a formal verification framework which gives more completeness and more consistency to the proposed specifications for both aspects. All checking processes are implemented under the Z/EVES theorem prover. Finally, we have take advantage from this theoretical work and we have defined an operational framework for enforcement security policies which combine the strengths of AOP with those of formal methods.

Mobile agents hold significant benefits for the rapid expansion of Internet applications and current trends in computing. Despite continued interest, the promised deployment has not taken place, indicating a need for a programming model to introduce novice mobile agent programmers to this environment/paradigm. Accordingly the research question asked was, ”Since novice mobile agent programmers1 require a paradigm shift to construct successful systems, how can they be equipped to grasp the contextual issues and gain the necessary skills within reasonable time limits?” To answer the question, a complete reference providing contextual information and knowledge of mobile agent system development was compiled. Simultaneously novices are introduced to agent orientation. A generic mobile agent system architectural model, incorporating guidelines for programming mobile agents, further provides a framework that can be used to design a mobile agent system. These two structures are presented in a knowledge base that serves as a referencing tool to unlock concepts and knowledge units to novices while developing mobile agent systems. / Computing / (M.Sc. (Computer Science))

Les agents mobiles peuvent physiquement migrer à travers un réseau informatique dans le but d’effectuer des tâches sur des machines, ayant la capacité de leur fournir un support d’exécution. Ces agents sont considérés comme composants autonomes, une propriété qui leur permet de s'adapter à des environnements dynamiques à l'échelle d'un réseau large. Ils peuvent également échanger des informations entre eux afin de collaborer au sein de leur groupe, nous parlerons ainsi d'une communauté d'agents mobiles. Nous avons développé ce concept de communauté, en se référant aux recherches et aux études précédentes pour définir un nouveau modèle comportemental d'agent mobile. Ce modèle est utilisé pour répondre aux besoins de la surveillance logicielle. Celle ci consiste à collecter des événements à partir de plusieurs sources de données (Log, événements système…) en vue de leur analyse pour pouvoir détecter des événements anormaux. Cette démarche de surveillance s'appuie sur plusieurs types d'agents mobiles issus du même modèle. Chaque type d'agent gère un domaine fonctionnel précis. L'ensemble des ces agents constitue une communauté pouvant collaborer avec différentes autres communautés lorsqu'il existe plusieurs sites à surveiller. Les résultats de cette approche nous ont permis d'évoquer les limites liées à la taille des données collectées, ce qui nous amène à de nouvelles perspectives de recherche et à penser un agent mobile "idéal". Enfin, nous nous intéressons également à l'application de la communauté d'agent mobile pour les systèmes de détection d'intrusion et la remontée d'anomalie / Mobile agents can physically travel across a network, and perform tasks on machines, that provide agent hosting capability. These agents are autonomous; this property allows them to adapt themselves on a dynamic environment in a large network. Also, they can exchange information and data in order to collaborate within their group; in this case we can talk about community of mobile agents. We refer to previous studies and research to develop this concept of community by defining a new behavioural pattern of mobile agent. This pattern is used in monitoring software approach which consist of collecting events from various data sources (log file, OS events…) and analyse them to detect abnormal events. This approach is based on different kind of mobile agents, each kind manages some features. Whole of those mobile agents constitute a community which collaborate with other communities if there are a several sites to supervise. The results of this approach allow us to evoke some limits related to size of collected data. This limit pushes us to have a new possibility of research and probably define an ideal mobile agent. Lastly, we illustrate our mobile approach with results about intrusion detection system application to retrieve anomalies

Mobile agents hold significant benefits for the rapid expansion of Internet applications and current trends in computing. Despite continued interest, the promised deployment has not taken place, indicating a need for a programming model to introduce novice mobile agent programmers to this environment/paradigm. Accordingly the research question asked was, ”Since novice mobile agent programmers1 require a paradigm shift to construct successful systems, how can they be equipped to grasp the contextual issues and gain the necessary skills within reasonable time limits?” To answer the question, a complete reference providing contextual information and knowledge of mobile agent system development was compiled. Simultaneously novices are introduced to agent orientation. A generic mobile agent system architectural model, incorporating guidelines for programming mobile agents, further provides a framework that can be used to design a mobile agent system. These two structures are presented in a knowledge base that serves as a referencing tool to unlock concepts and knowledge units to novices while developing mobile agent systems. / Computing / (M.Sc. (Computer Science))

Ce mémoire décrit et évalue un système de module qui améliore la migration de code dans le langage de programmation distribuée Termite Scheme. Ce système de module a la possibilité d’être utilisé dans les applications qu’elles soient distribuées ou pas. Il a pour but de faciliter la conception des programmes dans une structure modulaire et faciliter la migration de code entre les nœuds d’un système distribué. Le système de module est conçu pour le système Gambit Scheme, un compilateur et interprète du langage Scheme utilisé pour implanter Termite. Le système Termite Scheme est utilisé pour implémenter les systèmes distribués. Le problème qui est résolu est la diffusion de code compilé entre les nœuds d’un système distribué quand le nœud destination n’a aucune connaissance préalable du code qu’il reçoit. Ce problème est difficile car les nœuds sont hétérogènes, ils ont différentes architectures (x86, ARM). Notre approche permet d’identifier les modules de façon unique dans un contexte dis- tribué. La facilité d’utilisation et la portabilité ont été des facteurs importants dans la conception du système de module. Le mémoire décrit la structure des modules, leur implémentation dans Gambit et leur application. Les qualités du système de module sont démontrées par des exemples et la performance est évaluée expérimentallement. / This thesis presents a module system for Termite Scheme that supports distributed computing. This module system facilitates application modularity and eases code migration between the nodes of a distributed system. This module system also works for developing non-distributed applications. The Gambit Scheme system is used to implement the distributed Termite and the Module system. The problem that is solved is the migration of compiled code between nodes of a distributed system when the receiving node has no prior knowledge of the code. This is a challenging problem because the nodes are not homogenous, they have different architectures (ARM, x86). Our approach uses a naming model for the modules that uniquely identifies them in a distributed context. Both ease of use and portability were important factors in the design of the module system. The thesis describes a module system and how it was integrated into Gambit. The system allows developing distributed modular systems. The features of this system are shown through application examples and the performance is evaluated experimentally.

Infrastructure as a Service (IaaS) is a cloud service provisioning model which largely focuses on data centre provisioning of computing and storage facilities. The networking aspects of IaaS beyond the data centre are a limiting factor preventing communication services that are sensitive to network characteristics from adopting this approach. Cloud networking is a new technology which integrates network provisioning with the existing cloud service provisioning models thereby completing the cloud computing picture by addressing the networking aspects. In cloud networking, shared network resources are virtualized, and provisioned to customers and end-users on-demand in an elastic fashion. This technology allows various kinds of optimization, e.g., reducing latency and network load. Further, this allows service providers to provision network performance guarantees as a part of their service offering. However, this new approach introduces new security challenges. Many of these security challenges are addressed in the CloNe security architecture. This thesis presents a set of potential techniques for securing different resource in a cloud network environment which are not addressed in the existing CloNe security architecture. The thesis begins with a holistic view of the Cloud networking, as described in the Scalable and Adaptive Internet Solutions (SAIL) project, along with its proposed architecture and security goals. This is followed by an overview of the problems that need to be solved and some of the different methods that can be applied to solve parts of the overall problem, specifically a comprehensive, tightly integrated, and multi-level security architecture, a key management algorithm to support the access control mechanism, and an intrusion detection mechanism. For each method or set of methods, the respective state of the art is presented. Additionally, experiments to understand the performance of these mechanisms are evaluated on a simple cloud network test bed. The proposed key management scheme uses a hierarchical key management approach that provides fast and secure key update when member join and member leave operations are carried out. Experiments show that the proposed key management scheme enhances the security and increases the availability and integrity. A newly proposed genetic algorithm based feature selection technique has been employed for effective feature selection. Fuzzy SVM has been used on the data set for effective classification. Experiments have shown that the proposed genetic based feature selection algorithm reduces the number of features and hence decreases the classification time, while improving detection accuracy of the fuzzy SVM classifier by minimizing the conflicting rules that may confuse the classifier. The main advantages of this intrusion detection system are the reduction in false positives and increased security. / Infrastructure as a Service (IaaS) är en Cloudtjänstmodell som huvudsakligen är inriktat på att tillhandahålla ett datacenter för behandling och lagring av data. Nätverksaspekterna av en cloudbaserad infrastruktur som en tjänst utanför datacentret utgör en begränsande faktor som förhindrar känsliga kommunikationstjänster från att anamma denna teknik. Cloudnätverk är en ny teknik som integrerar nätverkstillgång med befintliga cloudtjänstmodeller och därmed fullbordar föreställningen av cloud data genom att ta itu med nätverkaspekten.  I cloudnätverk virtualiseras delade nätverksresurser, de avsätts till kunder och slutanvändare vid efterfrågan på ett flexibelt sätt. Denna teknik tillåter olika typer av möjligheter, t.ex. att minska latens och belastningen på nätet. Vidare ger detta tjänsteleverantörer ett sätt att tillhandahålla garantier för nätverksprestandan som en del av deras tjänsteutbud. Men denna nya strategi introducerar nya säkerhetsutmaningar, exempelvis VM migration genom offentligt nätverk. Många av dessa säkerhetsutmaningar behandlas i CloNe’s Security Architecture. Denna rapport presenterar en rad av potentiella tekniker för att säkra olika resurser i en cloudbaserad nätverksmiljö som inte behandlas i den redan existerande CloNe Security Architecture. Rapporten inleds med en helhetssyn på cloudbaserad nätverk som beskrivs i Scalable and Adaptive Internet Solutions (SAIL)-projektet, tillsammans med dess föreslagna arkitektur och säkerhetsmål. Detta följs av en översikt över de problem som måste lösas och några av de olika metoder som kan tillämpas för att lösa delar av det övergripande problemet. Speciellt behandlas en omfattande och tätt integrerad multi-säkerhetsarkitektur, en nyckelhanteringsalgoritm som stödjer mekanismens åtkomstkontroll och en mekanism för intrångsdetektering. För varje metod eller för varje uppsättning av metoder, presenteras ståndpunkten för respektive teknik. Dessutom har experimenten för att förstå prestandan av dessa mekanismer utvärderats på testbädd av ett enkelt cloudnätverk. Den föreslagna nyckelhantering system använder en hierarkisk nyckelhantering strategi som ger snabb och säker viktig uppdatering när medlemmar ansluta sig till och medlemmarna lämnar utförs. Försöksresultat visar att den föreslagna nyckelhantering system ökar säkerheten och ökar tillgänglighet och integritet. En nyligen föreslagna genetisk algoritm baserad funktion valet teknik har använts för effektiv funktion val. Fuzzy SVM har använts på de uppgifter som för effektiv klassificering. Försök har visat att den föreslagna genetiska baserad funktion selekteringsalgoritmen minskar antalet funktioner och därmed minskar klassificering tiden, och samtidigt förbättra upptäckt noggrannhet fuzzy SVM klassificeraren genom att minimera de motstående regler som kan förvirra klassificeraren. De främsta fördelarna med detta intrångsdetekteringssystem är den minskning av falska positiva och ökad säkerhet.

Nearly all present-day commercial intrusion detection systems are based on a hierarchical architecture. In such an architecture, the root node is responsible for detecting intrusions and for issuing responses. However, an intrusion detection system (IDS) based on a hierarchical architecture has many single points of failure. For example, by disabling the root node, the intrusion-detection function of the IDS will also be disabled. To solve this problem, an IDS inspired by the human immune system is proposed. The proposed IDS has no single component that is responsible for detecting intrusions. Instead, the intrusion-detection function is divided and placed within mobile agents. Mobile agents act similarly to white blood cells of the human immune system and travel from host to host in the network to detect intrusions. The IDS is fault-tolerant because it can continue to detect intrusions even when most of its components have been disabled. / Computer Science (School of Computing) / M. Sc. (Computer Science)