AgentSmith-HIDS

About AgentSmith-HIDS

Technically, AgentSmith-HIDS is not a Host-based Intrusion Detection System (HIDS) due to a lack of rule engine and detection function. However, it can be used as a high performance ‘Host Information Collect Agent’ as part of your own HIDS solution. The comprehensiveness of information which can be collected by this agent was one of the most important metrics during developing this project, hence it was built to function in the kernel stack and achieve huge advantage comparing to those function in user stack, such as:

• Better performance, Information needed are collected in kernel stack to avoid additional supplement actions such as traversal of ‘/proc’; and to enhance the performance of data transportation, data collected is transferred via shared ram instead of netlink.
• Hard to be bypassed, Information collection was powered by specifically designed kernel drive, makes it almost impossible to bypass the detection for malicious software like rootkit, which can deliberately hide.
• Easy to be integrated，The AgentSmith-HIDS was built to integrate with other applications and can be used not only as a security tool but also as a good monitoring tool, or even a good detector of your assets. The agent is capable of collecting the users, files, processes and internet connections for you, so let’s imagine when you integrate it with CMDB, you could get a comprehensive map consists of your network, host, container, and business (even dependencies). What if you also have a Database audit tool at hand? The map can be extended to contain the relationship between your DB, DB User, tables, fields, applications, network, host and containers, etc. Thinking of the possibility of integration with network intrusion detection system and/or threat intelligence etc., higher traceability could also be achieved. It just never gets old.
• Kernel stack + User stack，AgentSmith-HIDS also provide a user stack module, to further extend the functionality when working with the kernel stack module.

Major abilities of AgentSmith-HIDS：

• Kernel stack module hooks execve, connect, process injects, create a file, DNS query, load LKM behaviors via Kprobe，and is also capable of monitoring containers by being compatible with Linux namespace.
• User stack module utilizes built-in detection functions including queries of User List，Listening ports list，System RPM list，Schedule jobs

Download && Use

Copyright (C) 2019 EBWi11