1. Computer Genomics: Towards Self- Change and Configuration Management (http://research.microsoft.com/sn/strider) Yi-Min Wang Senior Researcher & Group Manager Systems Management Research Group (http://research.microsoft.com/sm/)

2. OUTLINE Change & Configuration Management Genomics & Computer Genomics What We’ve Learned From The Analogy Systems Management –Configuration Troubleshooting –Patch Impact Analysis –Spyware Management Towards Self-Management

3. Change & Configuration Management Problem Scope –Setting changes through Control Panel, program executions, etc. –Software installations, updates, and patching –Drive-by downloads of spyware … O(10 1 ) to O(10 2 ) processes … … O(10 5 ) Registry entries and files Setting Change Spyware Download Patching

4. Configuration Errors Persistent: cannot be solved by restart / reboot A major contributor to Internet service unavailability and computer user frustration Executable Files Process Persistent Configuration Settings Aging Volatile State App Restart Rejuvenation Machine Reboot App Reinstallation System Restore OS Re-imaging Patching

5. Genomics & Computer Genomics “A”, “C”, “G”, and “T” are the four DNA letters of the genetic alphabet –“1” and “0” are the binary letters of the computer genetic alphabet 3 billion base pairs arranged into 24 distinct chromosomes –Windows Registry is typically 50MB (or 400 mega bits) arranged into several hives

6. Gene: a stretch of sequence in a specific position on a DNA strand –Computer gene: a Registry entry (a stretch of bit sequence) in a specific position of a hive identified by a hierarchical path name Gene carries the instructions for making a particular protein through gene expression –Registry entry carries the instructions for configuring a particular process instantiation

7. Less than 2 percent of the human genome is made up of protein-coding sequences The rest labeled as ‘junk’ DNA –A lot of Registry entries are not configuration settings, but rather “operational states” such as usage counts, most recently used files, etc. –They can be labeled as ‘junk’ entries as far as configuration management is concerned

8. Any two persons’ genome is >99.9% identical –Registry snapshots from two different days on the same machine typically have about 99% of the entries identical between them Even between mouse and human genes, the similarities range from 70% to 90% –Even across different machines, there is a high degree of similarity

9. Majority of variations in the genome sequence simply create diversity –Majority of variations in Registry simply reflect diversity in hardware/software installation and user preferences But some genetic differences are responsible for causing diseases: the gene for Huntington’s disease was found at the tip of the short arm of Chromosome 4 –Some differences in Registry data are responsible for configuration problems. –For example, the gene for the “Short-cuts-do-not- work” problem was found at the following Registry location: HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000- C000-000000000046}\shellex\MayChangeDefaultMenu

10. Huntington’s Gene & Human Chromosomes http://www.hdsa-wi.org/chromosomes.gif Short-cuts-do-not-work’s Gene

11. Most diseases involve the interaction of several genes Studies have shown irrefutable evidence of the role environment plays in gene expression –Studies of Registry problems reveal that the “healthy” or “sick” values of many entries are not absolute on their own and very often depend on the environment of individual machines

12. Gene therapy can potentially treat diseases by using normal genes to replace a defective gene But some failed experiments have shown the risk of unexpected side effects of creating new diseases –The equivalent of gene therapy can be easily performed with a Registry or file editor –But direct modifications to these low-level state information can potentially cause inconsistency and lead to more serious problems

13. What We’ve Learned From The Analogy Configuration problems are solvable –One order of magnitude easier than the genomics problem Techniques for complexity reduction –Noise filtering through “junk” labeling –Diff can be very powerful: two orders of magnitude reduction –Attack the Mess with the Mass: statistical analysis across multiple machines Computer Genomics Database for problem detection and repair –Problems with known root causes: which gene causes which problem and how to fix it –Problems with unknown root causes: which action should be tried to provide safe gene therapy

14. No.1: Configuration Troubleshooting “It worked yesterday, but not today.” “It worked for that user, but not this user.” “It worked on that machine, but not this machine.” “I restarted the application, rebooted the machine, but still can’t fix the problem!”

15. Noise Filtering Strider Process for Configuration Troubleshooting Context Information Gathering phase Complexity Reduction Phase It was working Now it doesn’t work User Tool State Diff The program keeps failing Tracing Support Database Lookup Support Articles Intersection Filtered & Ranked Candidate Set State Ranking PC Genomics Database Ownership Mapping Config Action UI App Info Doc

16. Cross-Restore-Point Results Average Registry size After diff & trace intersection Another Two Orders Of Magnitude After state diff Two Orders After noise filtering Root cause Order-ranking

17. No.2: Patch Impact Analysis “If I apply this security patch, which one of the 3,000 applications in my company is going to be affected?”

18. Strider Process for Patch Impact Analysis Context Information Gathering phase Complexity Reduction Phase Before Patching After Patching User Tool State Diff All Program Executions Tracing Intersection Filtered & Ranked Candidate Set State Ranking (Process Criticality) Noise Filtering (System Processes) PC Genomics Database Process-to-Application Mapping Applications Requiring High-Priority Testing

19. No.3: Spyware Management “I’m getting lots of pop-ups and my browser is crashing a lot. What software got installed on my machine?”

20. Strider Process for Spyware Management Context Information Gathering phase Complexity Reduction Phase Before Spyware Infection After Spyware Infection User Tool State Diff Reboot Machine & Launch IE Tracing Known-* Database Lookup Objective Criteria Evaluation, Bundle Information, & Support Articles Intersection Filtered & Ranked Candidate Set State Ranking (Behavior Criticality) Noise Filtering (Known Goods) PC Genomics Database

21. Towards Self-Management Flight Data Recorder (FDR) –Always-on tracing, diff’ing, intersection, noise filtering, and state ranking –Automatic genomic lookup for known problems “Self-healing”, “known-bad”, and “wait for user complaint” –Automatic PeerPressure analysis for anomaly detection –Automatic generation of black-box application dependency database –Automatic trace analysis for new ASEP hooks ASEP = Auto-Start Extensibility Point

22. Summary The Strider Process for Handling Persistent-State Complexity 1.Diff 2.Trace 3.Intersection 4.Noise Filtering 5.State Ranking 6.Look-up

23. For More Information Google  “MSR Strider” or http://research.microsoft.com/sn/strider/ Configuration Management –Strider Troubleshooting: DSN’03, LISA’04, DSN’04, LISA’05 –Glean: ICAC’04 –Flight Data Recorder (FDR): LISA’05 –Friends Troubleshooting Network (FTN): IPTPS’04 –PeerPressure: SigMetrics’04 (poster) Patch Management –ICAC’04 Spyware Management –LISA’05

24. Thank You! International Conference on Autonomic Computing (ICAC’05) –Tentative: May 2005 in Seattle