1. 1 Application Communities Kick-off Meeting Arlington, Virginia July 7, 2006

2. 2 Agenda 0800-0830Continental Breakfast 0830-0900Program Manager Welcome 0900-1000SRI Presentation 1000-1030Morning Break 1030-1130SRI Presentation (continued) 1130-1200Discussion 1200-1300Lunch 1300-1400MIT Presentation 1400-1430Afternoon Break 1430-1530MIT Presentation (continued) 1530-1600Wrap-up discussions 1600Side-bars

3. 3 Lee Badger Information Processing Technology Office Defense Advanced Research Projects Agency Application Communities July 7, 2006 Program Kickoff

4. 4 The Problem Attack Sophistication Growing (Source: CERT Coordination Center) Lines of Code 55,000,000 50,000,000 30,000,000 20,000,000 17,000,000 15,000,000 3,000,000 1,000,000 485,000 20,000 79 80 90 92 95 98 99 00 01 02 SCOMP Debian Multics ?Win2K? Win95 Win3.1 Lisp Darwin Kernel RedHat6 WinNT RedHat7 Linux Kernel Scale/Vulnerability Growing SCOMP Debian Multics ?Win2K? Win95 Win3.1 Lisp Darwin Kernel RedHat6 WinNT RedHat7 Linux Kernel Military Context DoD needs “better” COTS than adversaries have. Traditional wisdom: monocultures are weak: vulnerable to homogeneity/scale/collaboration Monocultures and Markets Market Share New idea: turn these “weaknesses” into advantages: Leverage homogeneity/scale/collaboration for the defense.

5. 5 The Military Context DoD Cyber Foundation Voice/Data Routing Operating System Routers Email IM Office Productivity Firewalls Special Applications (COP, Intelligence Tactical, Imagery, …) Anti-virus COTS Applications JWICS SIPRNET NIPRNET Satellite Forward Deployment Sustaining Bases/Hqtrs Same equipment at home, deployed Frequent updates Some systems just “Show-up” Fast fielding Vulnerable COTS

6. 6 Technology Objective Scale/homogeneity/ collaboration for defense Collaboratively diagnoses problems (attacks/bugs/errors) Transform many running copies of a (COTS) software program to behave as a self-aware Application Community that: Application Community xx% accurate problem identification, localization, and diagnosis in xx minutes. Collaboratively responds while maintaining intended functions Generate effective patches/filters in xx minutes. Prevent xx% of harmful patch/filter side effects. 2 3 1 Collaboratively generates Situation Awareness Gauge Predict likelihood and timing of problems with xx% accuracy. Value of Collaboration 0% 100% 1 100 1000 10,000 100,000 1,000,000 … active copies untapped utility Exploit scale for problem: localization mitigation recovery learning Possible Curves unknown threshold for diminished returns Collaboration: The Source Of Traction 00110 110 01 00110 110 01 00110 110 01 Observe Orient Decide Act time Knowledge 00110 110 01 00110 110 01 00110 110 01 00110 110 01 00110 110 01 00110 110 01 00110 110 01 00110 110 01 00110 110 01 00110 110 01 00110 110 01 00110 110 01 00110 110 01 00110 110 01 00110 110 01 Browser Operating System Web Server Email Middle- ware possible curve

7. 7 Evaluation Protocol Phase I (Technology Development, 18 Months) SRI Metrics Detect >80% of attacks, with <10% false alarms Recover entire community from attack <30 minutes <30% average performance slowdown >60% accurate problem effects prediction < 15 min before arrival MIT Metrics Detect 95% of code injection attacks, recover from 60% Detect 50% of all other attacks and errors, recover from >30% <5% performance slowdown July 7, 2006 Start Go No-Go Dec. 6, 2007 Phase II (Maturation, Evaluation, Transition, 12 Months) March 6, 2009 System Maturation Initial Red Team Evaluation Transition-Ready Self-Defending COTS Software Commercialization Flaw Remediation More Ambitious Metrics Detect >98% of attacks, with <1% false alarms Recover entire community from attack <10 minutes <30% average performance slowdown >80% accurate problem effects prediction < 5 min before arrival Final Red Team Evaluation Feb. 7, 2009 to March 6, 2009 March 7, 2008 Start Dec. 7, 2007 to Jan. 6, 2008

8. 8 AC Kickoff July 7 2006 Washington DC 1-day meeting Present new projects PI Meeting Wednesday, Jan. 10, 2007 East Coast Location Present progress reports PI Meeting July 2007 West Coast Location Present progress reports PI Meeting early Jan. 2008 East Coast Location 2006 2007 Phase 1 Schedule 2008 Red Team Evaluations Dec. 2007 on site Site Visits by the PM and selected IET Oct. 2006 Site Visits by the PM and selected IET April 2007 Site Visits by the PM and selected IET Oct. 2008

9. 9 Role of the IET Provide technical feedback to performers at PI meetings Attend site visits for in-depth reviews Review performer self-assessment strategies  Evaluate validity of progress measures  Evaluate how understandable progress measures are to SRS outsiders  Cordell Green (Kestrel)  Hilarie Orman (Purple Streak)  Alex Orso (Ga. Tech)