1. A Binary Agent Technology for COTS Software Integrity Anant Agarwal Richard Schooler

2. DARPA Aug 2002 2 Agenda n Objectives & Approach n Status n Distributed Traces n Next Steps

3. DARPA Aug 2002 3 Objectives n “First-fault” diagnosis of application mis-behavior (defects, attacks); forensic tracing. n “Always on”: obviate need to replicate failures/attacks. n Fine-grain execution monitoring. n Focus on: n Deployed applications - not just for development, QA phases. n Inside the application - not just externally- visible behavior.

4. DARPA Aug 2002 4 Status n Achievements: n Windows, Solaris C/C++ binary instrumentation technology: fine-grain (instruction-level) high- performance (<5% overhead) execution tracing. n “First-fault” diagnosis of application mis-behavior: “always on” monitoring. n Transitioned as commercial product. n Follow-on/seedling project: n Forensic tracing of distributed applications: multi- process, multi-machine. n Exploring self-healing technologies.

5. DARPA Aug 2002 5 Cross-Thread Interleaving n Previous work: individual processes. n Per-thread history buffers, interleaved through (virtual) timestamps at potential interaction points (thread creation, synch., etc.). Thread 1Thread 2

6. DARPA Aug 2002 6 Distributed Traces n Extend to multiple related processes: n Real timestamps. n Cross-process interaction points: RPC, other IPC (asynchronous messaging, etc.). n Causality: logical identity. Call A A: entry : call C : return B: entry : : return C: entry : : return Call B

7. DARPA Aug 2002 7 Requirements n Functional requirements: n When:get control for “interesting” events, ideally synchronously, in right thread context. n What: know what kind of event happened, with identity, other correlative data. n Partial:shouldn’t have to have whole system instrumented. n Performance: fast enough for production.

8. DARPA Aug 2002 8 Current Implementation n Current status: CoRegisterChannelHook : register IChannelHook interface to receive notifications for client/server send/recv. (Undocumented, but “well-known” :-) n Also can send protocol extension data: causality ids, etc. n Meets goals: When, What, Partial, Performance n Demo…

9. DARPA Aug 2002 9 Issues n “Partial” problem is hard, so how do we fill in missing events/data? n Infer it (state machine, …) n Other instrumentation technologies: n MTS/COM+ instrumentation events: but looks more oriented to external monitors. Lower-level hooking, i.e. within OLE32.DLL. CoRegisterMessageFilter : only calls, not returns? n “Universal Delegator”: wrap all objects.

10. DARPA Aug 2002 10 Next Steps - Dist. Traces n Better causality tracking, visualization n Cross-machine tracing: clock skew! n Can we derive sufficient constrains from causality? E.g send/receive ordering. n Explore “partial” problem: n Different instrumentation technologies and inference techniques.

11. DARPA Aug 2002 11 Self-Healing n Paradigm: o bserve, learn, adapt/heal. n Examples: n “Nanny” process: shoot down and restart. n Garbage collection. n Replace components n... Detection Notification Root- Cause Analysis Self-Healing