Information Technology Reference
In-Depth Information
They may be new agents (agents of a new type) which have arrived at the system
(have been inserted into it). Such events occur when we deal with so-called
open
systems
.
Agents may also appear as a result of the transformation of certain agents existing
in the system.
If agents behaving in a unusual way are responsible for atypical behaviour, then
the task is to identify these agents.
One of the approaches is an attempt to analyse the agent's identifying features
and establish its distinctness. It may be done on the basis of the analysis of:
features of a given agent's structure
features of a given agent's behaviours
The analysis of the features of the agent's structure has been used for a long
time in different applications, e.g., for the identification of viruses in the computer
systems. However, this approach suffer from some serious drawbacks. Namely, the
agent (a piece of code) of certain distinct features may not always be dangerous. The
computer system is often complemented with new elements (in our approach-agents)
while being modernised-errors removed, or new functionalities installed (so-called
upgrade).
It seems that the analysis and assessment of the behaviour of a given sub-system
(agent), its influence on the system and especially on the resources of the system
would be a better approach. This approach is easier to realize if we use the concept
of the agent and the approach to the system as the agent system.
The general schema of the operation of the agent system recognizing atypical
behaviours may be presented as follows:
The system is considered as the agent system with agents of one particular type, or
agents of different types. The agents act in the environment which consists of (inter
alia) resources, and by acting the agents change the properties of these resources. In
other words, the resources and their properties may be observed and changed by the
agents acting in the system.
Apart from the agents' action connected with the functioning of the whole system,
the agents also act with the intention of recognising atypical behaviours of the system
caused by the agents acting in the environment. It means that in order to recognize
atypical functioning of the system, it is necessary to recognize and identify atypical
action (or rather behaviour) of agents (Fig.
5.16
).
Let us consider the following example (Fig.
5.17
):
The system consists of a certain number of agents and two resources (resource
a
and resource
b
). The resources are kept in the containers and their maximum as
well as minimal amount is specified.
The action of agents is to load a certain amount of a chosen resource from a cho-
sen container. Every time the agent downloads the same amount of the resource,
however, it may do it with varied frequency. The frequency of the load of a given
resource is established randomly for a given agent. The difference between the