2.1 Organisation modelling languages

Different models are manipulated within an MAS that can be described by using vowel approach AEIO (Agent, Environment, Interaction, Organisation) introduced in Demazeau (Reference Demazeau1995). Agents deal with the models (or architectures) used for the active part of the agent, from a simple automata to a complex knowledge-based system. Environments are the places where the agents are located. Interactions concern the infrastructures, the languages, and the interaction protocols between agents, from simple physical interactions to complex communicative acts. Organisations structure the agents in groups, hierarchies, and relations.

Our primary focus will be on the latter. That is to say that, how MAS organise agents and set up a self-governing behaviour through cooperation between agents? There exists two possible ways of obtaining an organisation in an MAS, namely: a bottom-up or a top-down approach. Contrary to the top-down approach, the bottom-up one does not manipulate any organisational model defined a priori but the organisation emerges from interactions between goal-oriented agents (with objectives dedicated to themselves and not to the global society). Indeed, this approach utilises some interaction capabilities to dynamically create and adapt the MAS organisations. In this work, we consider a whole hierarchical organisation of agents dedicated to infrastructure monitoring. The mapping of the MAS and architecture to the monitored system infrastructure justifies the choice of a top-down approach. To represent the complex social organisation within an MAS, OML have been proposed that rely on several dimensions, such as structural, functional, dialogic, environmental, and contextual.

The structural dimension represents the structure of the collective level of an MAS, generally in terms of roles/groups/links. Such a structural specification (SS) is used in AGR (Ferber & Gutknecht, Reference Ferber and Gutknecht1998), Islander (Esteva et al., Reference Esteva, Padget and Sierra2002), M OISE⁺, and M OISE^Inst. The functional dimension specifies the global functioning of the system, as used in TAEMS (Lesser et al., Reference Lesser, Decker, Carver, Garvey, Horling, Neiman, Podorozhny, NagendraPrasad, Raja, Vincent, Xuan and Zhang2004), TeamCore (Pynadath & Tambe, Reference Pynadath and Tambe2003), or M OISE⁺. Some models, such as Islander, add a dialogical dimension that specifies MAS interactions in terms of communications between agents. The environmental dimension allows to constrain the anchoring of the organisation in an environment, such as in AGRE (Ferber et al., Reference Ferber, Michel and Baez2004). Inspired by Islander, M OISE^Inst introduced a contextual specification (CS) to define a priori the transition between different configurations of norms, structures, and plans (Boissier & Gâteau, Reference Boissier and Gâteau2007). We do not intend to provide an exhaustive comparison of the aforementioned OML in terms of the primitives or modelling power that each can offer. The interested readers are encouraged to refer to Coutinho et al. (Reference Coutinho, Sichman and Boissier2007) for a systematic comparison of OML.

As mentioned in Boissier and Gâteau (Reference Boissier and Gâteau2007), depending on the various dimensions, the influence on the agents’ behaviour may be quite different. In models, such as TAEMS, where only the functional dimension is specified, the organisation has nothing to ‘tell’ to the agents when no plan or task can be performed. Otherwise, if only the structural dimension is specified as in AGR, the agents have to reason for a global plan every time they want to work collectively. Because the agent’s options are restricted by the structure, even with a smaller search space of possible plans, the problem is deemed a difficult proposition. Moreover, plans will be lost as no organisational memory exists. Therefore, in the context of open systems, we hypothesise that if the organisation model specifies both dimensions as in M OISE^Inst or TeamCore or a third one as in Islander then the MAS that follows such a model can be more effective in leading the group behaviour to the desired objectives. On the agent’s side, the models can develop richer reasoning abilities about agents and the organisation. Agents may gain more information on the possible cooperation (in terms of roles, groups, and on the possible goals, or on the performative structures) that may be conducted with other agents within the MAS.

Besides the aforementioned dimensions, the deontic and normative dimensions proposed in M OISE⁺ and Islander or M OISE^Inst, respectively, address the agents autonomy problematic and consider organisations as normative constructs aiming at explicitly controlling the underlying MAS. While in other OMLs, the agents are supposed to be benevolent and must comply with the organisational specification (OS), the M OISE^Inst paradigm adds the possibility for agents to develop explicit reasoning on their autonomy with respect to the organisational constraints (Boissier & Gâteau, Reference Boissier and Gâteau2007).

2.2 Responsibility in multi-agent systems

A number of works have focused on the responsibility held by agents in an MAS system. According to Sommerville (Reference Sommerville2007), such a responsibility can be considered as a duty, held by some agents, to achieve, maintain, or avoid a given state, subject to conformance with organisational, social, and cultural norms. In this work, the responsibility is modelled using (a) the rights necessary for the agent to achieve a task or obligation, (b) the accountability, and (c) the assignment of tasks to agents that focuses on the necessity to have an agent commitment before the assignment. Li and Hoang (Reference Li and Hoang2009) have stressed the importance of using the responsibilities of a role in an organisation to dynamically interact with the agents but does not address the dynamic assignment of tasks to those agents. They proposed a role-interaction-organisation security model and applied the model to an e-health system, which is modelled as an MAS. These roles in this model not only determine access rights passively, but also initiate requests to interact dynamically with the agents who meet the security requirements. That is to say that, the confidential e-health data from unauthorised access is mandated. The interaction and the organisation models help in identifying the actions and responsibilities that a role can assume in the system within the organisation and any dynamic interactions that the system can partake. In Guemkam et al. (Reference Guemkam, Feltus, Schmitt, Bonhomme, Khadraoui and Guessoum2011), the authors have proposed an agent-based framework to support an alert mechanism for power distribution systems by using a reputation-based trust approach. The architecture provides a framework for dynamically assigning responsibilities to agents depending on the context (e.g. crisis situation). This permits the management of the agents’ access rights towards critical information. This reputation-based trust measure relies on the similarity views between two agents during the assignment process. However, this scheme does not take into account the assurance or body for evidence that is necessary for an agent to fulfil a task.

2.3 Monitoring of security

MAS have also been extensively used for monitoring the security of a given system. For instance, the authors in Boudaoud et al. (Reference Boudaoud, Labiod, Boutaba and Guessoum2000) proposed an intelligent multi-agent approach for the design of an intrusion detection system (IDS) with a clear specification of the responsibilities of each monitoring agent. The proposed scheme operates at two layers. First, at a higher level, the manager layer operates and manages the security of the network. Three different agent types are involved. The Security Policy Manager agent manages the policies specified by the network security administrator. The Intranet Manager agents control the local agents that monitor the network traffic flow and report to them. These are managed by the Extranet Manager agent which assigns and delegates them intrusion detection tasks. Finally, the operations of the Extranet Manager agents are controlled by the policies of the Security Policy Manager agent.

Later, Kolaczek and Juszczyszyn (Reference Kolaczek and Juszczyszyn2007) proposed an attack pattern ontology and a formal framework within a distributed multi-agent IDS. In this approach it is assumed that the network system consists of a set of nodes. Two types of agents are considered. Monitoring agents observe the nodes, process captured information, and draw conclusions that are necessary to evaluate the current state of system security within their areas of responsibility. Managing agents are responsible for gathering information from Monitoring agents and generating reports about global threats and ongoing attacks. Each Monitoring agent monitors its area of responsibility that may consist of a set of network nodes.

Servin and Kudenko (Reference Servin and Kudenko2008) introduced a reinforced learning-based approach for the design of an intelligent multi-agent IDS to detect new and complex distributed attacks. In this reinforced learning architecture, each network sensor agent learns to interpret local state observations, and then communicates the information to a central agent higher up in the hierarchy. These central agents, in turn, learn to send signals up the hierarchy, based on the signals that they receive. The agent at the top of the hierarchy learns when to signal an intrusion alarm.

Abielmona et al. (Reference Abielmona, Petriu, Harb and Wesolkowski2011) propose an architecture which is referred to as retroactive. It cumulates both proactive and reactive features and enables a given agent to implement a reaction strategy based on the occurrence of an event in the environment. By ensuring that each agent records the strategy associated with a given event, the architecture allows an autonomous robot to learn over a period of time. This ultimately prepares these robots to respond in real time to actual events in the environment, as they occur (Baig, Reference Baig2012).

The BUGYO methodology (Ouedraogo et al., Reference Ouedraogo, Khadraoui, De Remont, Dubois and Mouratidis2008) adopts a three-layer hierarchical MAS architecture for the monitoring of security assurance. The first level includes a single agent that is embedded within the server. When the server receives a request to perform a security assurance evaluation, the server agent handles the request and identifies the appropriate multiplexer agent or MUX agent (using a role directory). Finally, probe agents trigger the associated probe in the event of receiving a measurement request from an MUX agent. The probe agents also collect measurements from instrumentations and transmit them to the MUX agents. Similarly, Pham et al. (Reference Pham, Baud, Bellot and Riguidel2008) present a security assurance evaluation approach based on attack graphs. The MAS architecture proposed in this approach is also built upon the BUGYO methodology. The concept of an attackability metric is introduced to characterise the possibility of attack along with other metrics for anomaly detection that assess both the static and dynamic visions of the underlying system.

In summary, the multi-agent-based architectures for the monitoring of distributed systems examine the capacity of a software agent to achieve tasks through respect of norms or rules, and as mechanism to ensure security. However, the aforementioned models do not propose any method to reassign the responsibilities to peers when a given agent fails to fulfil its task.

3.1 Responsibility and role

In our responsibility model, an obligation is a duty which links a responsibility with a task that must be performed. In M OISE^Inst a norms is an obligation or a permission that links a role with a mission to achieve.

More precisely, the accountability concept denotes a duty to justify achievement, maintenance, or avoidance of some given state to an authority under threat of sanction (Stahl, Reference Stahl2006). Therefore, the accountability parameter contributes to the valuation of trust. An agent’s right encompasses facilities required by an agent to fulfil the desired obligations, such as the access right that the agent gets once it is assigned with a responsibility. Capability describes the required qualities, skills, or resources necessary to perform a task. The capability parameter depends on number of parameters relating the agents. These include the (a) ability to make decisions, (b) processing time, and (c) ability to analyse a problem and the location within the network. The commitment pledged by the agent represents the engagement to fulfil a task. The commitment concept has been the subject of many researches in MAS as explained in great detail in Singh (Reference Singh2008).

M OISE^Inst (Gâteau et al., Reference Gâteau, Boissier, Khadraoui and Dubois2007) is a language to describe normative organisational model through the definition of rights and duties of autonomous agents by means of unambiguous specifications. This language is founded on the M OISE⁺ organisational model (Hübner et al., Reference Hübner, Sichman and Boissier2002). It is composed of the following components that are used to specify an organisation of agents in terms of structure, functioning, evolution, and norms as depicted on Figure 1 (for a complete formal description of M OISE^Inst and organisation example see Gâteau, 2007). An OS is composed of:

• ∙ An SS defines (i) the roles that agents will play in the organisation, (ii) the relations between these roles in terms of authority, communication, or accointance, (iii) the groups, additional structural primitives used to define and organise sets of roles.

• ∙ A functional specification (FS) defines global business processes that can be executed by the different agents participating to the organisation according to their roles and groups.

• ∙ A CS specifies, a priori, the possible evolution of the organisation in terms of contexts and transitions between the specifications (such as state/transition graph).

• ∙ A normative specification (NS) defines the deontic relations gluing the three independent specification (SS, FS, CS). Norms define rights (i.e. permission) or duties (i.e. obligation, prohibition) for a role or a group to execute a mission in a particular context and during a given time. This is supervised by an issuer which can apply a sanction on the bearer if the norm is not respected. A norm is active when the context referred in the norm equals the current organisation context. A norm is valid as long as its condition is satisfied. A norm could be respected or violated as long as it is active and valid. We represent a norm as the following expression:

$$norm:\varphi \to op(cont,\,issuer,\,bearer,\,m,\,sanc,\,w,\,tc)$$

Figure 1

M OISE^Inst: a normative organisation specification language

where $\varphi $ is the condition that defines the particular state of the organisation in which the norm may be valid; op $\in $ {O, P, F} defines if the norm is an obligation (O), a permission (P), or a prohibition (F); cont the context of the CS in which the norm becomes active (see below); issuer and bearer refer to structural entities of the SS (i.e. the whole groups and roles) from which the norm is issued and on which it is applied. Let us notice that the expression of norms refers to the notions of roles and groups and not to agents themselves. In this way, the norm expressions are independent of the kinds of agents that could populate the system at one time. m the mission of the FS concerned by the norm; sanc contains the reference of a different norm in the NS. It expresses a ‘sanction’ to apply in case of norm violation. w defines a priority used for solving conflicts between norms in case of incoherence (Kollingbaum et al., Reference Kollingbaum, Norman, Preece and Sleeman2006), when, for instance, an agent could be constrained by two contradictory norms. tc specifies when the norm is valid: before (‘<’), while (‘=’), or after (‘>’) a date.

Obligations of the responsibility model are composed of a deontic operator (Obligation must of time) and a task (for instance, ‘Must retrieve the log’ is composed of the operator ‘Must’ and the task ‘retrieve the log’). In order to perform a parallel between the responsibility model and the normative organisation model of MAS, each task composing an Obligation of the responsibility model is transformed into a root goal of the FS. These root goals are then decomposed in sub-goals coming from the capabilities needed to achieve the Obligation and gathering in mission (m). Rights needed to achieve Obligations are seen as condition $(\varphi )$ making the corresponding norm (norm) been valid. To summarise, a Responsibility and its linked Obligations is seen as a role and all norms where it is the bearer. Figure 2 illustrates main elements of a simplified view of M OISE^Inst (in blue) pointing their matches in a detailed view of responsibility model in green.

Figure 2

Match between responsibility model and normative organisation model

3.2 Assurance and trust

Although many conditions may need to be fulfilled to ensure that an agent meets its responsibilities, it is imperative that the following ones are met:

1. 1. Rights: the set of rights entrusted to the agent must enable the satisfaction of the agent’s obligations.

2. 2. Capability: the overall capability assigned to an agent must be below the agent’s intrinsic capability. Moreover, such capability should enable the agent to fulfil its obligations.

3. 3. Level of trust: should be higher or equal to a minimum (predefined) threshold (T _min).

Based on the above requirements the assurance for an agent fulfilling the obligation should be based on: Assurance for fulfilment of obligation ‘o’ by an agent with right ‘R’, capability ‘C’, and trust ‘T _P’: A _o(R, C, T _P).

No assurance:

(1) $$A_{o} \left( {R,C,T_{p} } \right)\,{\rm =}\,0\,if\,\left( {R_{o} \,\notin \,R} \right){\cup}\left( {C_{o} \,\notin\, C} \right){\cup}\left( {T_{p} \geq T_{{{\rm min}}} } \right)$$

Otherwise:

(2) $$A_{o} \left( {R,C,T_{p} } \right)\,{\rm =}\,1$$

where R is the current rights of the agent; C the current capabilities of the agent; R _o the set of rights necessary for fulfilling obligation o; C _o the set of capabilities necessary for fulfilling obligation o; T _p the trust at period p.

Relations (1) and (2) imply that the satisfaction of an obligation can only be guaranteed if the set of rights allocated to the agent and the current capabilities are both subsets of the set of rights and capabilities required for the satisfaction of the obligations and if the trust level at period (T _p) is higher or at least equal to the reference T _min. It is noteworthy to mention that more than one agent may fulfil such requirements and subsequently, the decision to select one of those as an alternative to a faulty agent will be based on the highest level of T _p.

From the MAS point of view the main concern is how to develop an organisation infrastructure that ensures the satisfaction of the organisational constraints and norms (e.g. agents playing the right roles, committing to the allowed missions). Many implementations of the organisation infrastructure follow the general architecture depicted in Figure 3. Domain agents are responsible to achieve organisational goals and use an organisational proxy component to interact with the organisation. The organisational layer is responsible to bind all agents in a coherent system and provides some services for them (Kitio et al., Reference Kitio, Boissier, Hübner and Ricci2007). In particular, they are in charge of verifying above conditions in order to decide of a potential reorganisation. The level of trust T _p of each of the component is provided by the organisational layer based on direct information as detailed in Guemkam et al. (Reference Guemkam, Feltus, Schmitt, Bonhomme, Khadraoui and Guessoum2011).

Figure 3

Common organisation implementation architecture for open multi-agent systems (Kitio et al., Reference Kitio, Boissier, Hübner and Ricci2007)

The next section describes a case study that we adopt to illustrate the reassignment of an obligation based on assurance and trust values.

5.1 Implementation

The architecture is composed of different types of agents that play a collaborative role. The agent architecture presented in Figure 4 is based on the ReD’s one (Gâteau et al., Reference Gâteau, Khadraoui and Feltus2009). It proposed a solution to enhance the detection/reaction process and to improve the overall resilience of critical infrastructures. We extended the aforementioned architecture to accommodate the need for the responsibilities reassignment. The main agents involved include the (a) ACE, (b) PIE, (c) MSP, and (d) Message Broadcasting Point (MBP).

The MSP (Figure 5) is composed of two modules: (a) the policy analysis (PA) and (b) the Component Configuration Mapper. The PA is in charge of analysing the policies previously instantiated by the PIE. For that, the Policy Status database stores all of the communication policies and the corresponding status (in progress, not applicable, bypassed, enforced, removed) so that the PA module can check the consistency of the newly received message to be deployed. The Component Configuration Mapper module selects the appropriate communication channel.

Figure 5

Message Supervising Point (MSP) architecture

The MBP is in charge of receiving the generic alert messages from the MSP. Then a specific parser converts the incoming alert message to the appropriate format according to the channel. Figure 6 presents two different kinds of MBPs. Different communication channels (e.g. SMS, e-mail, micro-blogging) to send alerts to citizens, hospitals, etc. are used. Consequently, our electric blackout prevention system is easily extensible for future communications facilities.

Figure 6

Message Broadcasting Point (MBP) architecture

To consider the centralised trust of each agent, the organisational layer instantiated here with ${\cal U}$ TOPIA from Schmitt et al. (Reference Schmitt, Bonhomme, Aubert and Gâteau2011) maintains a database of levels of trust of agents regarding the status of the accomplishment of their missions. This means that the MBP, the ACE, and the MSP have dedicated levels of trust. ${\cal U}$ TOPIA’s context permits to assign and manage the responsibilities of the components, such as MBP and MSP. Thereby, ${\cal U}$ TOPIA controls the assignment of roles in an intelligent manner by taking into account the current level of assurance of a given norm to be respected as well as the trust level T _p of the agents.

Figure 7 introduces the extended ReD architecture illustrated with the weather broadcast alert system. The flow begins with an alert detected by a probe (voltmeter and weather station). The alert is sent by the MBP to the ACE agent (city layer) that confirms or not the alert to the PIE. Afterwards, the PIE decides to apply new policies or to forward the alert to an ACE from a higher layer (region layer). The PIE agent sends the policies to the MSP agent that decides which MBP is able to transform the high-level alert message into an understandable format for the selected communication channel (Feltus et al., Reference Feltus, Khadraoui and Aubert2010).

Figure 7

Detailed reaction architecture for power distribution adaptation based on weather parameters

To manage access rights, we add to the architecture a context rights management (CRM) module (right-hand side of Figure 7). The CRM is linked to the database storing information on the agents’ rights which allows it to provide and amend the access rights to agents. It is also linked to the Context Manager of $${\cal U}$$ TOPIA to detect changes in the context, particularly when an agent has not sufficient capabilities anymore, as described in Guemkam et al. (Reference Guemkam, Feltus, Schmitt, Bonhomme, Khadraoui and Guessoum2011).

5.2 Organisation

Based on the agents’ responsibility model shown in Figure 2, we define the responsibilities of each agent within the architecture. Table 1 summarises the necessary capabilities and the rights for the agents playing the MBP role to accomplish a given obligation. We observe that the responsibilities include obligations, such as the obligation O ₁ to retrieve the logs from the component it monitors and O ₂ to provide an immediate reaction if necessary. To perform the latter obligation O ₂, it must have the capabilities to be on the same network as the component it controls, such as voltmeter, thermometer, or barometer (C ₁), to be able to communicate with the MSP (C ₂), with the facilitator agent (C ₃), etc. It also must have the rights R ₁ to read the log file on the concerned network component, R ₂ to write the log in a central logs database, and finally R ₃ to be able to read the Policy in the MAS management layer.

Table 1

Message Broadcasting Point responsibilities specifications

ACE=Alert Correlation Engine; MAS=multi-agent systems; MBP=Message Broadcasting Point; MSP=Message Supervising Point.

5.3 Reorganisation

In the considered scenario, we assume that at time t, the GSM/GPRS network is down, which impacts the rights and capabilities of the agents to fulfil their respective obligations. Table 2 provides the new capabilities and rights of the agent MBP-SMS as well as the corresponding assurance values to meet a given obligation. Such assurance value is based on the metrics provided in Section 3. After taking into account the specifications of the responsibilities associated with each MBP agent (cf. Table 1), one can assess whether current rights, capabilities, and trust level of MBP agents can be sufficient to fulfil a given obligation.

Table 2

Rights and capabilities of MBP-SMS at time t

ACE=Alert Correlation Engine; MAS=multi-agent systems; MBP=Message Broadcasting Point; SMS=Short Message Service.

Let us consider, for instance, the information of MBP-SMS in Table 2. The current status of that MBP is such that it will not be able to fulfil the obligation O ₂. The obligation to provide an immediate reaction is hindered by the fact that the MBP does not have the capability to communicate with the MSP (C ₂). This means that any appropriate policy cannot be grounded to the MBP and be implemented in case of abnormality within the infrastructure. In the event that the assurance value for meeting a given obligation is ‘0’, like in the cases discussed above, such an obligation is dedicated to an agent having the required rights and capabilities and belonging to the same group. For that, the following steps are executed (labelled from 1 to 3 in Figure 7):

1. 1. The CRM inspects the contextual state of the institution and detects that MBP-E-MAIL has the capability to take the MBP-SMS’s responsibility. In order to transfer the responsibility from MBP-SMS to MBP-E-MAIL, the CRM simply sends the suitable transitions to ${\cal U}$ TOPIA in order to change the contexts (more information about contexts and responsibilities in Guemkam et al., Reference Guemkam, Feltus, Schmitt, Bonhomme, Khadraoui and Guessoum2011).

2. 2. This allows $${\cal U}$$ TOPIA to reorganise the agents’ responsibilities taking into consideration their obligation fulfilment assurance (i.e. having rights and capabilities to accomplish the missions and having a trust level higher than the T _p needed). As a consequence, MBP-SMS looses its access rights, is isolated, and its responsibilities are transferred to the MBP-E-MAIL.

3. 3. The MBP-E-MAIL agent that receives the additional MBP-SMS’s responsibilities requests the underlying access rights to the CRM.

This top-down approach based on an a priori OS is centralised (one ${\cal U}$ TOPIA instantiating one organisation linked to one CRM with centralised databases), however, agents are autonomous (they are supervised by $${\cal U}$$ TOPIA but not controlled) and able to choose which goal to reach. In this use-case, some agents are only used as sensors (e.g. MBP) and thus do not achieve their mission because they are able to do it. Goals of MBP agents are mainly to sense the distributed system and deploy some new responsibilities. We could imagine other use-cases in which agents would be able to respect or not their obligation because of local objectives to reach. Responsibilities are considered as security policies and are translated and interpreted in M OISE^Inst’s norms. M OISE^Inst is an OML, not a security policy language. Our MAS system framework based on ReD architecture is able to take into account several standard security message formats such as XACML or OrBAC for access control, CIM-SPL for policy language, and even IDMEF for intrusion detection. In this work, we add to the framework the possibility to interpret responsibilities of the model and evaluate the assurance of obligation fulfilment. Assurance evaluation and trust-based reorganisation is a solution to improve security. If an agent becomes malicious, it will no more respect its obligations and as a consequence its responsibilities will be transferred.