A Graph Analysis Approach to Detect Attacks in Multi-agent Systems at Runtime

Fully self-organised and open systems consisting of a variety of heterogeneous and autonomous entities can suffer due to malicious elements or attacks. One approach to cope with this challenge is to introduce trust. Thereby, trust relationships are based on ratings among individual entities and represent system-wide information. A Trusted Desktop Computing Grid is one example, where such a trust mechanism has been applied successfully. In this paper, we investigate the possibility to add an system-level Observer to the self-organised system in order to guide the overall behaviour and to intervene in disturbed situations that are mostly a result of malicious behaviour. Therefore, we describe in detail how the observation part of this Observer can be realised and what kind of metrics can be applied to detect undesired system behaviour. Evaluations are done using the Trusted Desktop Grid and demonstrate the possibility to detect malicious behaviour quickly and reliably by considering clusters of trusted entities.