EEL 5937 Mutable agents EEL 5937 Multi Agent Systems Lecture 21, March 23, 2003 Lotzi Bölöni

EEL 5937 Self-modifying programs Every programmer learns at his first assembly language class that program code can be changed by simply writing to it. But then he also learns that self-modifying programs are a big no-no. Still… As early as 1975, the Microsoft Basic interpreter for Altair contained self-modifying code, introduced to overcome resource limitations (only 4K of space available for the interpreter). And many other unknown instances from early systems.

EEL 5937 Self-modifying programs today Current programming techniques frequently rely on self modifying applications, without making too much fuss about it. Just-in-time compilers (Java, SQL etc.) compile and optimize system independent code to the particularities of the system. Persistency systems: some of them rely on modifying source code or object code. Aspect oriented programming. Code weavers –AspectJ Debuggers and profilers. Code instrumentation for obtaining better quality traces, find memory leaks. Code obfuscators: rewrite the code without changing its execution characteristics such that they prevent reverse engineering of the code.

EEL 5937 More self modifying programs Automatic downloads, updates Skins, themes Plug-ins: –Audio and video decoders and encoders –Processing plug-ins (e.g. Photoshop) Self editing documents –E.g. Word documents with macros which generate the document through user interaction.

EEL 5937 The dark side of the self- modifying programs Viruses –Modify applications by attaching themselves to the source code. –They are capable of self-replication –The application will execute the virus code – in addition to the regular code. –Frequently viruses compress the application code such that they maintain the same size. –Recent years, eclipsed by macro viruses (typically relying on security problems in the Visual Basic implementations in Microsoft Outlook and Word. –Some viruses are capable of mutation, to thwart anti-virus programs based on virus signatures. Computer worms –Similar to viruses, they self-replicate, but they are also self- contained (they don’t need to be attached to programs to run).

EEL 5937 More on the dark side Trojan horses –Malicious programs, installing themselves into operating systems. –Sometimes they are used by remote users to get control of the computers. Buffer overflow security attacks –Are relying on the fact that unchecked C buffers can overflow into the executable code of the programs (or into adjacent data areas). Spy-ware –Spyware is computer software that aids in gathering information about a person or organization without their knowledge. –The most common use is to relay it to advertisers –It has been used by law enforcement to collect evidence against criminal suspects. –Frequently installed by viruses, trojans, or as a side-effect of the installation of programs (e.g. Comet Cursor, was installed as a side effect of installation of RealPlayer 8.0)

EEL 5937 Preliminary conclusion Our computing environment is, for good or bad, full with self-modifying programs. We need to study, understand and use them. Security implications are very complex. Software engineering techniques needs to be adapted. The identity of the programs / agents become questionable – especially when the mutation is coupled with mobility.

EEL 5937 Classifying mutable programs

EEL 5937 Weak mutability Weak mutability is the technique to extend the functionality of the application using coarse grain external components. The application still keeps its essential characteristics and functionality. This is the currently most accepted form of mutability in applications. –Examples include: Java applets, ActiveX controls, data format plugins, active plugins, skins and themes, applets and embedded applications, automatic upgrades etc. In many cases, weak mutability also implies the existence of well defined extension API’s (e.g. plugin API’s). Still, weak mutability can sometimes radically change the behaviour of the program: e.g. transform a web browser into a calculator.

EEL 5937 Strong mutability In case of strong mutability, applications are able to change their behavior in a radical manner. Strong mutability can be implemented at any level of granularity. At the machine-code level, typical examples are viruses and anti-virus programs. Source code level: example: aspect oriented programming –An example of this approach is the current approach taken by the JBoss Enterprise JavaBean team. Component level: runtime assembly and modification of programs (e.g. Bond) Of course, in the current world of just in time compilers and runtime recompilations, the distinctions tend to be blurry.

EEL 5937 Applications of mutability (scenarios)

EEL 5937 Reconfiguration for migration Mobile agents need to maintain their identity through the migration process. –Perform (preferably) the same task. –At the possible maximum performance. So what happens when we have agents migrating between hosts with high heterogeneity: –For example, from a Unix server to a cellphone? Performance is a multidimensional issue, with many complex relationships: –Memory vs. processing speed –Bandwidth vs. latency We can shoot for the lowest common denominator, but this limits the performance of the agent. Solution: reconfigure at the time of migration.

EEL 5937 Reconfiguration for optimal performance Similar to the case of migration: programs need to be configured, changed to achieve optimal performance on the system. Example: SmartApps system (L.Rauchwerger, Texas A&M University)

EEL 5937 SmartApps Run-time systems are too general. Little or no information flows from the application to the run-time system to allow the latter to fully tailor its services to the application. The overriding philosophy of SMARTAPPS is “measure, compare, and adapt if beneficial." That is, the application will continually monitor its performance and the available resources to determine if, and by how much, the application could improve its performance by restructuring. Then, if the potential performance benefit outweighs the projected overhead costs, the application will restructure itself and the underlying system accordingly. The adaptation can occur at various levels including selection of an algorithmic approach suitable for the current problem, run-time parallelization and other related compiler optimizations, tuning reconfigurable OS services (e.g. scheduling policy), and system configuration (e.g., selecting which computational resources to use). The SMARTAPPS framework provides performance monitoring and modeling components, as well as mechanisms for performing the actual restructuring, to integrate these levels of adaptation.

EEL 5937 Discovery agents Used in network discovery, software installation, grid environments etc. –Yes, in spying, too. At the moment when a discovery agent migrates to the remote host, it does not know its resources, characteristics, etc. One solution: –Send the most lightweight agent possible. –As the resources are discovered, step by step “build up” the agent on the remote system.