Scalable RADAR for Co-evolutionary Adaptive Environments

1. Scalable RADAR for Co-evolutionary Adaptive Environments Goal Scalable RADAR Biological Principles Problem Insight Measuring Diversity Through Information Flow Simulation and Modeling Dynamic Information Flow Tracking • Systems contain more errors and are more prone to attack than ever. • The balance of power favors the attacker: • Software replicates are all vulnerable to the same attack. • System complexity precludes rapid repair. • We must rethink the current cybersecurity paradigm. • Subgoal: Develop models and simulations to understand Scalable RADAR principles and adapt them to computation. • Subgoal: Extend evolutionary repair – whereby software bugs are automatically repaired using genetic programming, a technique inspired by evolution – towards a software immune system. Subgoal: compare programs based on how they use inputs in control flow decisions. Scalable Immune systems are composed of millions of cells. A Statically-compiled Linux binary Annotated assembly trace Branch/input correlation matrix Compare (Octave) Program Similarity Tracer (C) DIFT (Java) while(input[i] != ‘\0’) B Scalability • Question: How do immune systems achieve such remarkable scalability, with speed and repair independent of size? • Approach: Simulate lymphoid compartments, fixed circulatory networks, cytokine communication pathways and signals. Simulation Biology Approach: As the program runs, build a matrix relating input to branch points. Comparing the structure of two matrices gives a program similarity measurement. Model & Analyze Robust Observe & Test Redundancy, diversity, “wisdom of the crowd.” if(is_lowercase(input[i])) • Results: Distance between bubblesort and several other sorting algorithms (log scale). elif(is_uppercase(input[i])) Adaptive • Animal immune systems can defeat multiple, adaptable adversaries. Evolutionary Program Repair Genes, cells, systems adapt over multiple time scales. Feature Sweep Distributed Repair Quicksort Merge Selection Cocktail Insertion • Subgoal: conduct an in-depth study of critical representation, operator and other choices used for evolutionary program repair at the source code level. • Question: Can our approach repair specialized embedded devices? • Approach: Low-powered individual devices cooperate to find repairs more quickly. Software is a complex, evolving system. Decentralized Search Biological systems search complex spaces without a “leader.” Our simulations show: • The structure of the lymphatic network balances fast distribution of existing repairs vs. fast of recruitment of new repairs. • Inflammatory search signals speed up immune repair by orders of by orders of magnitude, particularly in large systems. Distance from bubble sort ` • Adapt Scalable RADAR to a new, clean-slate paradigm for software development/maintenance. • Demonstrate large, complex software systems that: • automatically detect attacks • repair themselves • evolve a diversity of solutions. Automated Response • Results: As the number of network nodes increases, a distributed repair strategy finds repairs faster and with a higher success rate (average over 16 programs). Cells respond to environmental signals automatically. Implement Distributed Repair in real-world platforms Results: Effect of modifying fault localization and operator selection probability distributions. Such feature choices significantly impact success rate and repair time, especially on more difficult bugs. With the feature sweep-suggested improvements, we automatically repair 5 new bugs (of 105) with a 17-43% reduction in repair time on more difficult bugs. Wes Weimer Stephanie Forrest (PI) Jed Crandall Melanie Moses