The Hive Mind at UC Davis
| Home | Members | Publications | Software | Contact |
Latest News
Mar. 13–15, 2012
Hive Mind demo at GEC13 in Los Angeles, CA.
Nov. 2–4, 2011
Hive Mind demo at GEC12 in Kansas City, MO.
Aug. 4, 2011
The Hive Mind project uses the DETER testbed extensively for security evaluations.
Jul. 26–28, 2011
Poster of the Hive Mind at GEC11 in Chicago Denver
May 25–27, 2011
Digital ants for the power grid to be presented at PETRA in Greece
Apr. 11–13, 2011
"Ant-Based Cyber Security" to be presented at ITNG 2011
Nov. 2–4, 2010
Demo of the Hive Mind at GEC9 in Washington, D.C.
Sept. 2010
Early, Java-based software prototype of digital ants is released.
The Hive Mind project seeks to to define and prototype a security layer underlying GENI that will allow providers of the system to collaboratively defend against attacks and misuse of GENI resources. To do this, it explores an innovative method of intrusion detection based on mobile agents and swarm intelligence. The project's goal is to provide a lightweight, decentralized, intrusion detection method that is adaptable to changing threats while communicating suspicious activity across hierarchical layers to humans who can respond when needed.
The Hive Mind approach to intrusion detection provides event correlation over an infrastructure comprised of one or more administrative enclaves, each made of a collection of device level nodes. These represent the devices in the network being monitored. Swarming sensor agents modeled after biological elements such as ants, wasps, termites, crows, and/or immune systems. These roam from node to node, searching for security relevant activity, leaving markers to communicate with other wandering agents.
The Hive Mind interposes logic-based rational agents between humans and the swarm, providing a basis for communication, interaction, and shared initiative. The goal is to augment, not replace, more traditional security mechanisms. For example, the Hive Mind should be effective where computing power is highly limited, e.g., where host-based IDSs would be impossible or in highly distributed systems without well-defined monitoring points making network-based detection infeasible. The Hive Mind could then be used in parallel with traditional firewall and intrusion detection systems.
The result of this will enable GENI to support experiments where there is communication between internal nodes (sensors or routers). In the context of networking, such experiments might be used to test if bandwidth usage can be improved through the communication of capacity and usage information between routers. In the context of security, such experiments might be used to test the tradeoffs among different approaches to exchanging security information between sensors, and where that information might affect firewall rules or pro-active, forensic logging efforts.
Prototypes of the Hive Mind are currently implemented and running on the ProtoGENI and DETER testbeds.
This project is funded by the National Science Foundation and the GENI Project Office under grant # CNS-0940805. More documentation is located on our page on the GENI wiki.
