1. Application Communities Phase 2 (AC2) Project Overview Nov. 20, 2008 Greg Sullivan BAE Systems Advanced Information Technologies (AIT) gregory.sullivan@baesystems.com

2. 2 11/20/2008Greg Sullivan AC2 Project Plan Overview – Tasks for Phase II Instrumentation for learning. Collect profiles of normal behavior Learning automation Scripting, collecting Grammar for context-sensitive call profile properties Monitors for call profile invariant violations Lightweight. Return context of violation Repairs for call profile invariant violations AC Runtime System Server: Invariant DB, tracks, installs patches (instrumentation, monitors, repairs), analyzes repair effectiveness. Workstation: accepts incoming patches, local invariant collection, logs invariant violations. Exploit (re)creation Can be very costly Red Team interaction Agreement on metrics, experiment protocol, attacks in bounds.

3. 3 11/20/2008Greg Sullivan AC2 Project Plan Instrumentation for Learning Instrumentation for Learning Context-Sensitive Traces Parameterized: Which functions to trace calls to. Which regions of app to trace calls from. How much context to include for each call. Stack depth Stack and other memory data. Implement “shadow stack” Account for inconsistent calling conventions. Challenge: limiting / tuning amount of data sent to learning component. Challenge: limiting # of “compound program points”. Have types for system functions, but not application functions. Identify tracing technology. Distributed tracing – distribute tracing burden across community. Traced data determined by property grammar from learning component.

4. 4 11/20/2008Greg Sullivan AC2 Project Plan Learning Automation Learning Harness Script / Automate learning phase Inject tracers, collect data, invoke learning components. Grammar for context-sensitive call profile properties Add support for compound program points Add properties to the grammar

5. 5 11/20/2008Greg Sullivan AC2 Project Plan Monitors for call profile invariant violations Application-Specific Attack/Vulnerability Detection Construct lightweight detectors based on property violations. When triggered, will send complete context. Repairs for call profile invariant violations Generate repairs Distribute repairs Evaluate repair effectiveness.

6. 6 11/20/2008Greg Sullivan AC2 Project Plan Phase II Infrastructure – AC Server In phase 2, replacing Determina “liveshield” functionality. Can re-use some logic of “protection manager” from phase 1. Some lessons learned from repair generation and effectiveness analysis AC Workstation registration and management What/where are AC members, what software running, what patches applied? Patch construction (Trace, Monitor, Repair) Patch distribution and installation Includes AC Workstation component Robust, secure transfer of large amounts of data Server ↔ Workstation

7. 7 11/20/2008Greg Sullivan AC2 Project Plan Phase II Infrastructure – AC Workstation On startup, register with AC Server Listen for Application start up Patches to apply? Incoming patches Communicate info from patches to server Trace data, during learning phase Attack data: invariant violated + context. Repair data: repair patch executed.

8. 8 11/20/2008Greg Sullivan AC2 Project Plan Phase II Tasks – Exploit Re-creation Can be very time consuming For lots of reasons: Some submitted exploits are not published. Stack/memory corruption is sufficient to be a security vulnerability, even if no POC. Many exploits are probabilistic.

9. 9 11/20/2008Greg Sullivan AC2 Project Plan Phase II Tasks – Red Team Interaction Negotiate details of Red Team Exercise with Red Team and DARPA. Characterize vulnerabilities in scope. Agree on metrics. Phase II Tasks – Misc. Tools Patch creation templates. Parameterized patch creation, code generation, compilation.

10. 10 11/20/2008Greg Sullivan AC2 Project Plan AIT and MIT Tasking and Coordination AIT Work with MIT in discussions with Red Team Lead development of infrastructure AC Server AC Workstation Learning Harness Patch generation, distribution, and installation tools. Work with MIT to parallelize and “incrementalize” Daikon. Work with MIT to choose instrumentation / patching tech. MIT Lead definition of grammar for context-sensitive call invariants. Lead creation of candidate repair patches (using patch tools from AIT). Work with AIT on exploit re-creation

11. 11 11/20/2008Greg Sullivan AC2 Project Plan END

12. 12 11/20/2008Greg Sullivan AC2 Project Plan Backup Slides

13. 13 11/20/2008Greg Sullivan AC2 Project Plan Notes Considering alternatives to DynamoRIO. PIN, http://rogue.colorado.edu/pin/http://rogue.colorado.edu/pin/ Dyninst, http://www.dyninst.org/http://www.dyninst.org/ Adaptive tracing. In/De-creasing amount of tracing, incl. stack depth, parameter info, etc.

14. 14 11/20/2008Greg Sullivan AC2 Project Plan Application + Tracing DynamoRIO Daikon Invariant Learning Invariant Database Binary Invariant Learning Vulnerability Detection Application + Detection DynamoRIO Detector Construction Invariant-based detectors traces invariants Monitor Construction alarms invariants Application + Monitors DynamoRIO Invariant-based monitors Invariant-Attack Correlation, Repair Construction Application + Repairs DynamoRIO Invariant-Attack Correlation Alarms, Invariant violations Candidate repairs invariants Repair Analysis, Validation Repair Analysis Alarms, Invariant violations Repaired Application + Detection DynamoRIO Validated Repair Repair Construction correlates

15. 15 11/20/2008Greg Sullivan AC2 Project Plan Application Communities Phase II Goal: Turn software monoculture into a strength instead of a weakness Use set of executing applications to detect & repair bugs & attacks Phase II technical approach Learn models of “normal” execution Detect model violations Diagnosis: correlate model violations with possible sources (attacks, bugs) “Repair” incorrect behavior Code injection to trace, monitor, & repair applications in network Testing in native windows binaries Applied to SW security & reliability 12 Months Code Injection Tracing for learning Model-based monitors: Error detectors Invariant violation Model-based repairs Models Detection Diagnosis Repair Model Learning Monitoring Data Nominal behavior Model violation Attack/bug invariant correlation Repair efficacy Software Monoculture Normal Behavior Attack-Invariant Correlation Repair Efficacy

16. 16 11/20/2008Greg Sullivan AC2 Project Plan AC Server Components Invariant Database Daikon Repair Strategies Invariant Patterns Protection Manager Repair Generator Invariant Monitor Generator Trace Generator … Application Community Patched Application AC Server