---
title: "ODISET: On-line Distributed Session Tracing using Agents"
authors:
  - "Salvador Mandujano"
  - "Arturo Galván"
doi: ""
url: "https://ijcai.org/proceedings/2003/109"
pdf: "https://ijcai.org/proceedings/2003/0109.pdf"
venue: "Proceedings of the Eighteenth International Joint Conference on Artificial Intelligence"
year: 2003
pages: "749-755"
track: ""
keywords:
---

# ODISET: On-line Distributed Session Tracing using Agents

Salvador Mandujano, Arturo Galván

*Proceedings of the Eighteenth International Joint Conference on Artificial Intelligence*, pages 749-755.

## Abstract

When a security incident occurs it is sometimes necessary to identify its causes for legal and cautionary purposes. In an attempt to hide the origin of her connection, a malicious user may have jumped from a source host h8 into a series of hosts hi E H = {h1, h2, ... , hn} before breaking into final target ht. This connection sequence describes a path that makes it difficult to find h8 given ht due, in part, to the prohibitive amount of cooperation and synchronization that is required in practice by administrators. This paper describes a distributed rule-based model that automates this tracing process on-line with a O(IHI)) worst case scenario. Autonomous agents collaborate on the tracing and detection of the origin of an interactive connection using a loop unwinding technique and incorporating public key cryptography to create ciphered channels that allow them for secure communication. To meet the challenges of minimum system workload and improved robustness, the prototype features lightweight design and implementation as well as a dynamic port-allocation scheme to prevent sniffing and denial of service attempts. We describe the proposed model and present the experimental results obtained with the prototype system ODISET.