1 Application Communities Kick-off Meeting Arlington, Virginia July 7, 2006

2 Agenda Continental Breakfast Program Manager Welcome SRI Presentation Morning Break SRI Presentation (continued) Discussion Lunch MIT Presentation Afternoon Break MIT Presentation (continued) Wrap-up discussions 1600Side-bars

3 Lee Badger Information Processing Technology Office Defense Advanced Research Projects Agency Application Communities July 7, 2006 Program Kickoff

4 The Problem Attack Sophistication Growing (Source: CERT Coordination Center) Lines of Code 55,000,000 50,000,000 30,000,000 20,000,000 17,000,000 15,000,000 3,000,000 1,000, ,000 20, SCOMP Debian Multics ?Win2K? Win95 Win3.1 Lisp Darwin Kernel RedHat6 WinNT RedHat7 Linux Kernel Scale/Vulnerability Growing SCOMP Debian Multics ?Win2K? Win95 Win3.1 Lisp Darwin Kernel RedHat6 WinNT RedHat7 Linux Kernel Military Context DoD needs “better” COTS than adversaries have. Traditional wisdom: monocultures are weak: vulnerable to homogeneity/scale/collaboration Monocultures and Markets Market Share New idea: turn these “weaknesses” into advantages: Leverage homogeneity/scale/collaboration for the defense.

5 The Military Context DoD Cyber Foundation Voice/Data Routing Operating System Routers IM Office Productivity Firewalls Special Applications (COP, Intelligence Tactical, Imagery, …) Anti-virus COTS Applications JWICS SIPRNET NIPRNET Satellite Forward Deployment Sustaining Bases/Hqtrs Same equipment at home, deployed Frequent updates Some systems just “Show-up” Fast fielding Vulnerable COTS

6 Technology Objective Scale/homogeneity/ collaboration for defense Collaboratively diagnoses problems (attacks/bugs/errors) Transform many running copies of a (COTS) software program to behave as a self-aware Application Community that: Application Community xx% accurate problem identification, localization, and diagnosis in xx minutes. Collaboratively responds while maintaining intended functions Generate effective patches/filters in xx minutes. Prevent xx% of harmful patch/filter side effects Collaboratively generates Situation Awareness Gauge Predict likelihood and timing of problems with xx% accuracy. Value of Collaboration 0% 100% , ,000 1,000,000 … active copies untapped utility Exploit scale for problem: localization mitigation recovery learning Possible Curves unknown threshold for diminished returns Collaboration: The Source Of Traction Observe Orient Decide Act time Knowledge Browser Operating System Web Server Middle- ware possible curve

7 Evaluation Protocol Phase I (Technology Development, 18 Months) SRI Metrics Detect >80% of attacks, with <10% false alarms Recover entire community from attack <30 minutes <30% average performance slowdown >60% accurate problem effects prediction < 15 min before arrival MIT Metrics Detect 95% of code injection attacks, recover from 60% Detect 50% of all other attacks and errors, recover from >30% <5% performance slowdown July 7, 2006 Start Go No-Go Dec. 6, 2007 Phase II (Maturation, Evaluation, Transition, 12 Months) March 6, 2009 System Maturation Initial Red Team Evaluation Transition-Ready Self-Defending COTS Software Commercialization Flaw Remediation More Ambitious Metrics Detect >98% of attacks, with <1% false alarms Recover entire community from attack <10 minutes <30% average performance slowdown >80% accurate problem effects prediction < 5 min before arrival Final Red Team Evaluation Feb. 7, 2009 to March 6, 2009 March 7, 2008 Start Dec. 7, 2007 to Jan. 6, 2008

8 AC Kickoff July Washington DC 1-day meeting Present new projects PI Meeting Wednesday, Jan. 10, 2007 East Coast Location Present progress reports PI Meeting July 2007 West Coast Location Present progress reports PI Meeting early Jan East Coast Location Phase 1 Schedule 2008 Red Team Evaluations Dec on site Site Visits by the PM and selected IET Oct Site Visits by the PM and selected IET April 2007 Site Visits by the PM and selected IET Oct. 2008

9 Role of the IET Provide technical feedback to performers at PI meetings Attend site visits for in-depth reviews Review performer self-assessment strategies  Evaluate validity of progress measures  Evaluate how understandable progress measures are to SRS outsiders  Cordell Green (Kestrel)  Hilarie Orman (Purple Streak)  Alex Orso (Ga. Tech)