1. ` Question: How do immune systems achieve such remarkable scalability? Approach: Simulate lymphoid compartments, fixed circulatory networks, cytokine communication pathways and signals. Examine relationships between: 1.Lymph node size/number and flow locality and time for T cells to reach an infection. 2.Inter-cell communication and system size. 3.Communication pathway types and sufficient antibody production. Question: How do immune systems achieve such remarkable scalability? Approach: Simulate lymphoid compartments, fixed circulatory networks, cytokine communication pathways and signals. Examine relationships between: 1.Lymph node size/number and flow locality and time for T cells to reach an infection. 2.Inter-cell communication and system size. 3.Communication pathway types and sufficient antibody production. Size and number of lymph nodes scale sublinearly with mass. Approximate remote attacker control of a vulnerable and invulnerable machine, over time. Research 2: Information-Theoretic Fuzz Tester Subgoal: Fuzz tester that estimates distance between an input and an exploit. Problem: Fuzz testers only indicate whether an input succeeds, regardless of how close it is to an exploit. Fuzz testers generate unexpected program input; they are useful for assessing fix quality. Insight: Attacks have unique information flow signatures. Approach: Extend our existing simulation platforms: AntGA: Quantifies how pheromone communication improves ant foraging behavior. CyCells: Implements 3-D simulations of immune response. Systems contain more errors and are more prone to attack than ever. The balance of power favors the attacker:  Software replicates are all vulnerable to the same attack.  System complexity precludes rapid repair. We must rethink the current cybersecurity paradigm. Subgoal: Develop models and simulations to understand Scalable RADAR principles and adapt them to computation. Scalable RADAR for Co-evolutionary Adaptive Environments Wes Weimer Stephanie Forrest (PI)Jed CrandallMelanie Moses Biological systems search complex spaces without a “leader.” Biological Principles Insight Cells respond to environmental signals automatically. Research 1: Evolutionary Program Repair Competitive Co-evolution: Simultaneously generate tests, attacks, and repairs. Improving Programs via Evolution: Evolve more efficient but less accurate vertex and pixel shader programs. Iterative Repairs: Mimic gradual evolutionary change. Iteration and Co-evolution Approach: Evolve a version of a buggy program that passes all of its test cases. Result: Automatically repairs 8 error types in 12 programs (> 2.2M lines of code) containing 8 error types (most from public vulnerability reports), in 2200 s on average. Patches vary in size from 4 - 11 lines of code. Subgoal: Extend evolutionary repair – whereby software bugs are automatically repaired using genetic programming, a computational technique inspired by evolution – towards a software immune system. Question: What is the trade-off between learning (i.e., naïve T-cells) and memory (i.e., memory T- cells)? Approach: Use GA to learn an optimal probability for the replacement of a naïve cell with a memory cell. Investigate the effect of biasing naïve cells to contain memory cell signatures. Problem Animal immune systems can defeat multiple, adaptable adversaries. Adapt Scalable RADAR to a new, clean-slate paradigm for software development/maintenance. Demonstrate large, complex software systems that:  automatically detect attacks  repair themselves  evolve a diversity of solutions. Goal Question: Are the limitations of the adaptive immune system inherent to scalable RADAR? Approach: Simulate co- evolution and new rule sets to determine viability of systems that attempt to predict future attacks or eliminate undesirable behaviors, such as: 1.Destroying host cells. 2.Killing the host. 3.Succumbing to infection. 4.Behaving reactively. Limitations Learning/Memory Scalabilit y Approach: Exploit information theoretic features of program behavior, exploits and vulnerabilities: An exploit is an input X correlated with a low-level behavior L—I(X;L)—to gain control over a high-level behavior H with which L correlates: I(H; L). Program behavior on X reveals patterns:  An increase in I(X;L) for some L followed by an increase in I(X;H) when the attacker has control.  A decrease in I(H; L|X) relative to I(H; L), as X is more closely correlated with H and L than expected. A good repair for a vulnerability should eliminate the increase in I(X; L) and, by extension, in I(X; H). Approach: Exploit information theoretic features of program behavior, exploits and vulnerabilities: An exploit is an input X correlated with a low-level behavior L—I(X;L)—to gain control over a high-level behavior H with which L correlates: I(H; L). Program behavior on X reveals patterns:  An increase in I(X;L) for some L followed by an increase in I(X;H) when the attacker has control.  A decrease in I(H; L|X) relative to I(H; L), as X is more closely correlated with H and L than expected. A good repair for a vulnerability should eliminate the increase in I(X; L) and, by extension, in I(X; H). Immune systems are composed of millions of cells. Redundancy, diversity, “wisdom of the crowd.” Genes, cells, systems adapt over multiple time scales. Software is a complex, evolving system. 1`. Distributed Repair: Use multiple, independent, trusting agents to cooperatively evolve repairs. N-Variant Systems: Deploy different program variants in parallel. Anomaly Detection: Repair in the face of a noisy automatic intrusion detection signal. Anomaly Detection, Automation Immune Memory: Generate a population of useful repair structures and substructures. Immune Memory: Generate a population of useful repair structures and substructures. Repair Templates Research 3: Simulation and Modeling