Smart Information Flow Technologies - self-adaptive immunity

Self-Adaptation Metrics for Active Cybersecurity

sfriedman — Thu, 10 Sep 2015 19:05:11 +0000

FUZZBUSTER is a host-based adaptive security system that automatically discovers, refines, and repairs vulnerabilities in hosted applications in order to prevent cyberattacks. FUZZBUSTER must decide when to adapt its applications, when to revoke its previous adaptations, and when to sacrifice functionality to improve security. This requires an adaptation quality metric that captures (1) an application’s susceptibility to cyberattacks and (2) an application’s functionality, since adapting an application affects both of these factors. FUZZBUSTER uses different types of test cases to measure security and functionality. In this paper, we describe FUZZBUSTER’s adaptation metrics and we present two different policies for balancing security and functionality. We provide empirical results comparing these policies, and we also demonstrate how FUZZBUSTER can temporarily sacrifice the functionality of hosted applications to increase host security, and then restore functionality when more favorable adaptations are found.

Citation:

David J. Musliner, Scott E. Friedman, Tom Marble, Jeffrey M. Rye, Michael W. Boldt, Michael Pelican. (2013). Self-Adaptation Metrics for Active Cybersecurity. Second annual SASO workshop on Adaptive Host and Network Security. Philadelphia, PA.

Date Published:

Thursday, September 5, 2013

Publication File:

ahans13.pdf

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages:

Meta-control for Adaptative Cybersecurity in FUZZBUSTER

sfriedman — Thu, 10 Sep 2015 18:54:08 +0000

Modern cyber attackers use sophisticated, highly-automated vulnerability search and exploit development tools to find new ways to break into target computers. To protect against such threats, we are developing FUZZBUSTER, a host-based adaptive security system that automatically discovers faults in hosted applications and incrementally refines and repairs the underlying vulnerabilities. To perform this self-adaptation, FUZZBUSTER uses meta-control to coordinate a diverse and growing set of custom and off-the-shelf fuzz-testing tools. FUZZBUSTER's greedy meta-control strategy considers adaptation deadlines, the exploit potential of vulnerabilities, the usage schedule of vulnerable applications, and the expected performance of its various fuzz-testing and adaptation tools. In this paper, we demonstrate how FUZZBUSTER's meta-control reasons efficiently about these factors, managing task selection to maximize the system's safety and effectiveness.

Citation:

David J. Musliner, Scott E. Friedman, Jeffrey M. Rye, Tom Marble. (2013). Meta-control for Adaptative Cybersecurity in FUZZBUSTER. Proceedings of SASO 2013. Philadelphia, PA.

Date Published:

Thursday, September 12, 2013

Publication File:

saso13.pdf

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages:

FUZZBUSTER: A System for Self-Adaptive Immunity from Cyber Threats

admin — Tue, 04 Aug 2015 19:32:50 +0000

Today’s computer systems are under relentless attack from cyber attackers armed with sophisticated vulnerability search and exploit development toolkits. To protect against such threats, we are developing FUZZBUSTER, an automated system that provides adaptive immunity against a wide variety of cyber threats. FUZZBUSTER reacts to observed attacks and proactively searches for never-before-seen vulnerabilities. FUZZBUSTER uses a suite of fuzz testing and vulnerability assessment tools to find or verify the existence of vulnerabilities. Then FUZZBUSTER conducts additional tests to characterize the extent of the vulnerability, identifying ways it can be triggered. After characterizing a vulnerability, FUZZBUSTER synthesizes and applies an adaptation to prevent future exploits.

Citation:

Musliner, David J., Rye, Jeffrey M., Thomsen, Dan, McDonald, David D., Burstein, Mark H., and Robertson, Paul. FUZZBUSTER: A System for Self-Adaptive Immunity from Cyber Threats. ICAS-12: Eighth International Conference on Autonomic and Autonomous Systems, St. Maarten, Netherlands Antilles (March 2012).

Date Published:

Thursday, March 1, 2012

Publication File:

icas12.pdf

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages:

Using Concolic Testing to Refine Vulnerability Profiles in FUZZBUSTER

admin — Tue, 04 Aug 2015 19:24:16 +0000

Vulnerabilities in today’s computer systems are relentlessly exploited by cyber attackers armed with sophisti- cated vulnerability search and exploit development toolkits. To protect against such threats, we are developing FUZZBUSTER, an automated system that provides adaptive immunity against a wide variety of cyber threats. FUZZBUSTER uses custom and off-the-shelf fuzz-testing tools to find vulnerabilities, create vulnerability profiles identifying the inputs that drive target programs to the corresponding faults, and synthesize adap- tations that prevent future exploits. We have adapted the CREST concolic testing tool so that FUZZBUSTER can refine a vulnerability profile by extracting the symbolic constraints stemming from concrete execution of a target program. This novel use of concolic testing enables FUZZBUSTER to automat- ically generalize a single fault-inducing input example into a symbolic description of the vulnerability, and thus create more effective adaptations.

Citation:

Musliner, D. J., Rye, J. M., and Marble, T. Using Concolic Testing to Refine Vulnerability Profiles in FUZZBUSTER. SASO-12: Adaptive Host and Network Security Workshop at the Sixth IEEE International Conference on Self-Adaptive and Self-Organizing Systems, Lyon, France (September 2012).

Date Published:

Wednesday, September 5, 2012

Publication File:

ahans12.pdf

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages: