A Binary Agent Technology for COTS Software Integrity Anant Agarwal Richard Schooler

DARPA Mar Agenda n Objectives & Approach n Prototype n Recent Work n User Experience n Next Steps

DARPA Mar Objectives n “First-fault” diagnosis of application mis- behavior (defects, attacks). n “Always on”: obviate need to replicate failures. n Fine-grain execution monitoring. n Focus on: n Deployed applications - not just for development, QA phases. n Inside the application - not just externally- visible behavior.

DARPA Mar Approach n Approach: n Run-time execution monitoring. n Binary instrumentation to inject probes into release-built executables. n Targets & Assumptions: n Similarity between explicit attacks and accidental faults. n Assume system-level mechanisms in-place - not guarding against replacement of entire executable, compromise of OS, etc.

DARPA Mar Prototype Tasks n Core technology for customizable agent insertion into Windows NT/2000/XP and SPARC/Solaris. n Anomaly detection and reporting. n Rapid recovery and problem pinpointing.

DARPA Mar Major Components Snapshot Files Trace Reconstruction Trace Reconstruction Block sequence User logging Post-Mortem info Map Files Instrumentation Engine Instrumentation Engine Executables Instrumented Executables Instrumented Executables Block->Address Map Debug Info Debug Info Address Line Map Source Module Name Trace (XML) Trace (XML) Source Line/Module Thread Annotations Platform- dependent interface Service Runtime

DARPA Mar User Interface

DARPA Mar Configuration

DARPA Mar Recent Work n Solaris instrumentation & runtime. n User deployments. n Performance measurement.

DARPA Mar Solaris Implementation n New binary platform: SPARC ISA (delay slots, register windows), COFF format, ELF/STAB debug format, Solaris signal interface, TSD, etc. n Compilers: Forte (SunPro) C/C++ & gcc C. n Some new issues: n 64 bit support. n How to hook runtime (interposition via LD_PRELOAD). n How to get relocation info (no /fixed:no). n Balance between using Solaris-specific features, and staying generic-Unix-portable.

DARPA Mar User Experience n Complex, multi-component application architecture. E.g., pharmaceutical trials ASP: Deployed on 100s of servers! IIS Data- base Custom Service DLL Handled exception: HTTP HTML MTS

DARPA Mar Performance n Typical scenario: business application n Custom business application logic is instrumented. n Runs on stock framework (application server, OS, database, etc.) n Relevant metrics are end-to-end transaction throughput, latency. n Results: n Range from imperceptible up to ~10% n Matches “5%” threshold most enterprises quote to go into production deployment.

DARPA Mar Next Steps n Distributed application architectures: n Multiple machines. n Multiple technologies. n Larger-scale deployment issues: n Analysis/correlation across many application traces. n Clusters and server farms.

DARPA Mar Combined Trace