A Systematic Survey of Self-Protecting Software Systems Dustin Gardner 9/22/15 E. Yuan and S. Malek, “A taxonomy and survey of self-protecting software systems,” ICSE Work. Softw. Eng. Adapt. Self-Managing Syst., vol. 8, no. 4, pp. 109–118, 2012.

Overview Autonomic Computing Defining Self-Protection Survey Process followed Process applied Interesting observations

Autonomic Computing Self Managed Systems Joseph J. and Fellenstein C., Autonomic Computing - http://flylib.com/books/en/1.414.1.36/1/

Autonomic Element MAPE-K This is the most basic part of an autonomic system, an autonomic element. Multiple elements interact with each other to create an autonomic system. O. Jeffrey and M. David, “The Vision of Autonomic Computing,” IEEE Comput., vol. 36, no. January, pp. 41–50, 2003.

What are self-protecting software systems? Software Systems that detect and mitigate threats at runtime, not statically. Two main perspectives on protection systems Reactive – system automatically defends against attacks Proactive – system anticipates attacks and takes steps to mitigate them Pg 17:1 Kephart & Chess referenced in the text == The reference on this slide O. Jeffrey and M. David, “The Vision of Autonomic Computing,” IEEE Comput., vol. 36, no. January, pp. 41–50, 2003. Pg 17:1

Why Self-Protecting Software Systems? Increasing Cyber Threats Conficker worm Stuxnet worm Static security solutions insufficient Software is increasingly dynamic at runtime Why shouldn’t security measures? From Pg 17:2 & 17:3 The conficker worm caused largest computer infection in history. The stuxnet worm is the first known malware to target and subvert industrial control systems. Pg 17:2 & 17:3

Self-Protection - Defined Differ from ITS & IRS Not intrusion-centric & perimeter based Local (Base) & Global (Meta) loops Example: Upon sensing an unusual data retreival pattern from a windows server, the global loop shuts down the server and redirects all traffic to a backup Linux server. From Pg 17:5 One should not interpret this reference architecture to mean that the base level subsystem is agnostic to security concerns. The base-level subsystem may incorporate various security mechanisms, such as authentication, encryption, etc. It is the decision of when and how those security mechanisms are employed that rests with the meta-level subsystem. Security objectives specified by human stakeholders Pg 17:5

Moving to the ‘bread and butter’ Survey & Taxonomy 1030 papers selected 107 papers made the cut Systematic Pg 17:2 & 17:29

The Systematic System Pg 17:29

Taxonomy (RQ1) Pg 17:9 & 17:10

Taxonomy Applied (1)(RQ2) Pg 17:32

Taxonomy Applied (2) (RQ2) Pg 17:33

Taxonomy Applied (3) (RQ2) Pg 17:34

Observations From (“WHAT”)(RQ3) Self-Protection Levels Depths-of-Defense Layers Protection Goals Pg 17:15-18

Self-Protection & Depths-of-Defense Self-Protection Levels This is because of the difficulty involved with the machine learning. This issue isn’t limited to Self-protection within AC, but within all four sub-domains of self-*. Depths-of-Defense Layers Need for research applying to attack prediction and prevention Pg 17:16

Protection Goal Observations Most focus on one or two, but not all three goals. Small confidentiality & availability overlap expected E.G. – host-based intrusion, restart server Confidentiality & Integrity Preserved Not availability! Pg 17:18

Observations from (“HOW”)(RQ3) Control Topology Response Timing Enforcement Locale Pg 17:18-21

A Chart of All Three Reactive paradigm still norm, but proactive approaches catching up Why are these so skewed? Traditional focus on “perimeter” Pg 17:22

Observations from Approach Quality Validation Method Repeatability Applicability Pg 17:26

Charts of all Three Extremely low repeatability (12%) High Applicability (60%) Why? High percent of applicable implementations, prototypes, tools, etc. not available to public Pg 17:26 Low repeatability because of the nature of the business of security.

What are the applications of all this? The paper presents numerous great areas of research to focus See the page referenced Combine both reactive and proactive mechanisms for overall system protection and monitoring Leverage the techniques and communities from ID, IR, IT and others toward achieving a common goal Pg 17:28

Conclusion Self-Protection is increasingly important Faces many challenges This survey was a great starting point for my research

Questions?