* The Hummingbird System is divided into several parts. Each of the parts of the program listed below will be executing on every host in the Hummingbird network. Data gathering tools will only be executing when that tool is being used to gather data. They will be invoked by the system administrator. The interface program between the data gathering tools and the Hummer will be invoked by the data gathering tools and will only run when the tools are actually sending messages to the Hummer. The Hummer server will be invoked by the system administrator and will remain running as long as the Hummer is in the Hummingbird network. The configuration server will also remain running as long as the Hummer is active in the Hummingbird network. It is invoked by the system administrator. Another part of the Hummingbird system is the alert tools. These tools are not unlike the data gathering tools. They are invoked by the system administrator and remain running as long as the alert condition they pertain to is wanted to be monitored.
* The data gathering tools gather security related data on each host system. These tools as developed to this point are small scripts that read log files and format them to be passed into the Hummers. In general, the data gathering tools will send all messages sent to a log file to the Hummer.
* A second executable, TOOLI is a small program that is called by the data gathering tools. Its only job is to pass the plain text messages into the Hummer. It passes the messages to the Hummer through network sockets. TOOLI takes the messages as command line parameters.
* A third program is the Hummer server. This program is the one that actually receives messages from TOOLI or other Hummers, and takes action depending on its configurations. It may ignore messages, pass messages on to other Hummers, log the messages in its own log, or alert the console. The actions the Hummer takes will depend on its configuration. When Hummers send messages on to other Hummers, the messages will be in the same format as if they were received from TOOLI on their host computer. The messages will be distinguishable by their host names.
The HummingBird package also includes a special configuration system in which managers of HummingBird networks may configure their subordinates. This is done through a GUI via an html web browser. A manager may set all trust levels of subordinate Hummers, as well as integrity levels, system settings, system filtering, and other information.
In addition, HummingBird provides a way of communication for HummingBird group managers (called "peers") via the internet. This system is maintained by a peer group manager. The peer group manager is an arbitrary person (or entity), which uses a web interface to maintain peer group related information. In this manner, the peer group manager receives HummingBird relevant information and passes it on to other members of the peer group. HummingBird managers (peers) are responsible for receiving and sending this information from and to the peer group manager. The individual peers are allowed to filter all information and send any information allowed in the group (or none at all). This is all done through a web interface.
* The last component of the Hummingbird system are the alert tools. The alert tools are like the data gathering tools but they read from the Hummer log rather than system logs. The alert tools will make decisions (such as counting the number of times an event takes place) and pass an alert message back into the Hummer when they reach an alert condition. The alert conditions are programmed into each alert tool. An example would be three failed login attempts for a user. The Hummer will be configured to alert the console of the machine it is running on when the alert messages are received from the alert tools.
See figure 6.1 for a graphical interpretation of the architectural design and the data that flows between components. Also see figure 6.2 for a structure chart.
* Information taken from Team A HummingBird Final Release Version Notebook, Spring 1997, UICS481.
* The Hummingbird system was designed as a near real-time monitor of system events. Another alternative would be to look at old log files to determine whether or not security violations had occurred. By designing the system as near real-time, it will be possible for system administrators to stop break-ins as they occur rather than finding out about them when the administrator cannot do anything but try to prevent future attacks.
* This system also does not have built in alarm conditions for security break-in conditions. This allows the user to set alarm conditions that can be changed easily without having to change the Hummingbird system.
* Along with the Alert tools, the data gathering tools are also not built into the Hummingbird system, this is for the same reason, flexibility without having to change the Hummingbird system.
* The data that is stored by the Hummingbird system is in the form of a log file. Each Hummer executing on different hosts has the ability to generate a log file. These log files, just like other log files in Unix systems, have the ability to get large. The user will have to delete or archive the files periodically.
The interface for configuration management is web based. An alternative interface could be done with a Java Applet. Perhaps Java could be an easier medium for programmers to work with. However, much more of the HummingBird system is web based. For this reason, the interface is done in html and used with a web browser.
The peer management system does not allow all parents in a HummingBird
tree hierarchy to be a member of a peer management group. Instead,
it only allows for the root node to be a peer. This simplifies things
quite a bit, and it makes sense. Since the root manager would know
everything about its subordinates, it may relay this information to other
peers without information relay from its subordinates (which would be redundant).
However, this also restricts subordinates to belonging only to the same
group as their root parent.
* Information taken from Team A HummingBird Final Release
Version Notebook, Spring 1997, UICS481.
6.3 User Interface Description
* The user interface for the Hummingbird system also consists of several parts. The only user interface that generally exists between the data gathering tools and the user is the command line execution of the tools. Some tools may include a message to the console that they have started running.
* TOOLI will have no interface with the user. It will only be invoked when a data gathering tool executes it.
* The Hummer will have display messages to the user console. These messages come from any alerts the user configures the Server to display.
* The configuration server will be the main user interface for the Hummingbird system. The configuration server will display html pages to a WWW browser and allow the user to change the configuration of a Hummer. The interface will use standard html buttons and text boxes.
This interface will allow the user to setup all subordinate hummers within a HummingBird hierarchy all from the manager. The interface, like above, uses standard html buttons and text boxes.
The peer manager will also be using a web based interface. In addition, the peers will use a web interface to make appropriate configurations within a peer group.
* The alert tools, like the data gathering tools will only be interfaced
by the user when they are executed. The data they display will depend on
how they are written.
* Information taken from Team A HummingBird
Final Release Version Notebook, Spring 1997, UICS481.