Intranet security with micro-firewalls and mobile agents for proactive intrusion response

We propose a distributed multi-level architecture to solve the intranet security problem. The basic idea is to build micro firewalls on all hosts in the intranet, as a second line of defense behind the gateway firewall. A distributed intrusion detection system (IDS) is developed to achieve proactive intrusion responses with dynamic policy changes. Mobile agents, CORBA, and RMI are evaluated for dynamic policy update. We find that mobile agents are most scalable and robust for policy update, but prone to attacks by other agents and hosts. CORBA has the best speed performance. The Java-based RMI has the highest security based on the sandbox model. Key concepts, preliminary results, and continued research challenges are presented