1. 1 Approved for Public Release, Distribution Unlimited Lee Badger Information Processing Technology Office Defense Advanced Research Projects Agency Self-Regenerative Systems July 20, 2004 Kickoff Meeting

2. 2 Approved for Public Release, Distribution Unlimited Program Objectives time Ability to deliver service Self-Regenerative System (Reconfigures and Self Optimizes) Intrusion Tolerant Systems (Gracefully degrade) Conventional System (Crashes) Initial Operational Capability 100% Critical Functionality Theoretical Optimal Performance (Reliability Growth) (attack or error) W/S LAN PC LAN COTS COP, Intelligence, Imagery, Messaging Develop Military Exemplar System Show it is possible to: Provide 100% critical functions at all times in spite of attacks. Learn own vulnerabilities to improve survivability over time. Regenerate service after attack. :

3. 3 Approved for Public Release, Distribution Unlimited History Study Panel Convened Nov Mar Oct Feb Jul 2001 2002 Study Panel Report Delivered May Study Projects Fred Schneider (Cornell) – Chair Jim Anderson (UNC) Stephanie Forrest (UNM) Kishor Trivedi (Duke) Teresa Lunt (PARC) Mike Reiter (CMU) Carl Landwehr (NSF) Scalable Redundancy for Infrastructure Systems (Reiter) Automated Diversity in Computer Systems (Reiter, Forrest) Using Enhanced Credentials for Mitigating the Insider Threat (Rajagopalan) Scalable Data Redundancy for Network Centric Military Applications (Birman) SRS Workshop New Start briefing New Start briefing Today Program development by: Dr. Jaynarayan Lala Mr. Lee Badger 2003 Sep BAA Issued 2004 Initial closing Nov Feb Decisions Completed Program approved April Contract awards July June

4. 4 Approved for Public Release, Distribution Unlimited SRS Kickoff July 20-21 2004 Washington DC 2-day meeting Present new projects SRS architecture workshop PI Meeting Jan. 2005 East Coast Location Redundancy Baselines Due Present progress reports SRS architecture workshop II Insurmountable opportunities PI Meeting July 2005 East Coast Location Preliminary project results [Demonstrations] Challenge problems PI Meeting Jan. 2006 East Coast Location Final project results 2004 2005 Site visits by the PM and IET Going Forward

5. 5 Approved for Public Release, Distribution Unlimited Technical Areas Cognitive Immunity and Healing Service Regeneration identify 10% of root causes 5% self corrected Granular, Scalable Redundancy Massive Defense Reserve Reasoning About Insider Threats Pre-empt Insider Attack Detect System Overrun Biologically-Inspired Diversity Genetically-Diverse Computing Fabric Goal: Deny Service Goal: Become Insider outside attacker inside attacker crash, corruption, exhaustion privilege escalation bad command Attacker Objective Foiled generate 100 functionally equivalent versions of a module, with <33 having the same deficiency 3-fold Byzantine update latency reduction 15-fold epidemic update latency reduction 10% attacker goals thwarted or delayed

6. 6 Approved for Public Release, Distribution Unlimited Biologically-Inspired Diversity Attacker Work Factor Number of Target Components Identical Software Total Diversity Genetically-Diverse Computing Fabric generate 100 functionally equivalent versions of a module, with <33 having the same deficiency fine-grained diversify at the module level  removes common vulnerabilities automatically generate diverse software versions  (note: n-version programming is manual) metric Technical Approach Goal: want to be here n-version programming (n <= 3) software module M software diversity transformation random seed we are here (today) State of Art software module M’ (tomorrow) diversity cycle compatible but with different vulnerabilities randomize APIs, instructions, algorithms, cryptography, etc. Back

7. 7 Approved for Public Release, Distribution Unlimited Cognitive Immunity and Healing System inputs actions crash, other anomaly causes? Reflect Highest Order of Cognition Introspection, Learning Self-Healing, Repair Vulnerability, Formulate Novel-Attack Defense, Predictively Adapt, Diagnose Root Cause of Failure Automated Cyber Immune Response and System Regeneration Goal: Technical Approach Biologically inspired response strategies. Machine learning (reflection). Automated cause-effect chain analysis. identify 10% of root causes 5% self corrected metric client time Attack 1 Attack 2

8. 8 Approved for Public Release, Distribution Unlimited Reasoning About Insider Threats Pre-empt insider attack Detect system overrun 10% attacker goals thwarted or delayed metric Technical Approach Intrusion Detection Rate False-Positive Rate we are here hundreds/day 98% Goal: Combine and correlate information from system layers, direct user challenges, etc. Infer user goals. Enable effective anomaly detection. Program Event Network Event Policy Event Resource Event semantic correlation, reasoning cognitive user model Knowledge about users Knowledge about mission low high semantic content want to be here state of the art Real File False File Wrapper Back-up

9. 9 Approved for Public Release, Distribution Unlimited Granular, Scalable Redundancy Survive massive attack, extreme hostility 3-fold Byzantine update latency reduction 15-fold epidemic update latency reduction metric Technical Approach Number coordinated replicas Assumptions about Environment Goal: Adaptive scalable quorums  exploit environment knowledge to scale Develop probabilistic consensus protocols.  survive extreme hostility  “good-enough” service (benign) (malicious) (asynchronous) 5 20 hundreds we are here want to be here (transient comms) Back-up TBD Command Center Normal recover... Trusted?