A Trojan horse is a program that does something that the programmer intended, but the
user would not approve of if he knew about it in advance. Because most current security systems are based primarily on user-level
privilege rather than program-level privilege, any program that you run can read any object you have read-access to, write
to any object that you have write-access to, and execute any program or command that you are authorized to execute.
A Trojan horse concealed in a random game program downloaded from your favorite newsgroup can
read any file you have read access to, and mail it anywhere in the world. It can erase, or just shuffle around a few bytes
in, any file you can write to. It can send obscene messages to the White House, or post embarassing things to random newsgroups.
And it can copy itself into any program that you have write access to (see Viruses and Worms
below).
In a mobile-agent system, it is critical to ensure that arriving agents execute in a controlled
environment, and are able to do only those things that they are authorized to do. Agents should be trusted only as far as
the least-trusted entity that may have been able to alter the program or internal state of the agent; secure authentication
methods (such as digital signatures) must be used carefully when it is necessary to establish the real author or sender of
an agent. See Itinerant Agents for Mobile Computing for some related security considerations in these sorts of systems.
A virus is a program (generally a Trojan horse) that spreads, by making copies of iteslf
in one way or another. In the microcomputer environment, viruses generally spread by writing copies of themselves into other
programs, or into boot records of disks and diskettes. (For more information on computer viruses and related subjects, see
our "antivirus online" site.)
A worm in a networked environment is generally a self-sufficient program that spreads
by spawning copies of itself on other hosts in the network. One famous worm caused great disruption on the Internet in 1988.
There is no hard line between viruses and worms; in general, if the spreading entity is a self-sufficient program, it will
be called a worm, whereas if it embeds itself inside other programs or boot code, it will be called a virus.
Can a virus spread between agents in a mobile-agent system? So far, the consensus
seems to be that there is no particular reason to allow one agent to alter the code of another already-existing agent. If
the agent infrastructure does not allow this, no virus will be able to spread from agent to agent. On the other hand, if the
infrastructure accidentally or purposely does allow one agent to alter another, inter-agent viruses will be possible.
Are worms possible in mobile-agent systems? If one agent can create another agent,
the possibility of runaway worm reproduction exists. Agent reproduction must be controlled in one way or another to limit
the possibility; if agents can create other agents, they must be charged in some scarce currency, or limited in how large
their tree of descendants can get, or otherwise kept from having children and grandchildren without bound.
Flash Crowds
The term Flash Crowd was first used by Larry Niven, in a science fiction short story.
In the story, cheap local teleportation has become possible; now, the sites of attractive news stories are instantly innundated
with rubberneckers teleporting in to watch.
As systems become more interconnected and more powerful, we have the equivalent of cheap
teleportation; if a Web site becomes known as particularly interesting, its usage curve can go exponential, causing network
bottlenecks and server crashes. In networks of agents, a vast number of similarly-programmed agents, like a horde of similarly-programmed
trading programs causing a market crash, can cause network congestion and server overload. And if the agents all adopt similar
fallback strategies in response to overload, the flash crowd can migrate from server to server on the net, leading to surging
hard-to-remedy travelling overloads.
Weeds, Freeloaders and Flying Dutchmen
A weed is a program (or anything else in a system) that does no one any good, but that
uses such a small amount of resources that it's often not cost-effective to do anything about it. Eventually, weeds start
to accumulate, and it's time to get out the clippers. Or the herbicide.
A freeloader is a program that uses some system or server resources to survive and possibly
benefit its creator, without paying for them. Servers may provide some minimal service for free, in order to attract paying
customers, or unintentionally, as an unintended effect of complex cost structures; there may be ways to arrange for some transaction
charges, especially small ones, to be lost in the shuffle. A freeloader exploits these sorts of things to operate free of
charge.
Named for the legendary ghost-ship, a Flying Dutchman is a freeloader that manages to
become effectively immortal, without paying for the resources that it uses to survive. A Flying Dutchman may move from host
to host, never quite using enough resources to be killed; it may spawn a copy of itself on another host just before it is
terminated, ensuring an unending gene-line.
A Zombie is similar to a Flying Dutchman; it is a program that has been terminated, but
continues to consume some resources anyway, due to (sometimes infinite) delays in cleaning up all the resources associated
with it. Zombies can sometimes get enough resources to do actual processing; more often, they exist only as the undead owners
of various kinds of space.
A single freeloading or immortal program will not in itself damage a distributed system, and
we anticipate that a typical agent-based system will tolerate a low level of freeloading. An analogy is to physical stores,
which will tolerate a certain number of people coming in to get out of the rain and using the restrooms, on the chance that
they may eventually buy something.
Uncontrolled, a large number of weeds can waste significant amounts of system resources;
distributed systems will need the ability to monitor this sort of activity, and impose controls if it gets out of hand. Requests
from known freeloaders may be charged for, even in cases that are normally free. Intelligent monitoring processes may be needed
to identify and terminate intentionally or accidentally immortal programs that are serving no useful purpose. Other sorts
of weeds will no doubt require other sorts of solutions; the unexpected is likely.
