CT-T: Enabling Collaborative Self-Healing Software Systems

Angelos Keromytis哥伦比亚大学启用协作自愈软件系统0627473面板P060975摘要协作自愈系统（COSS）是保护软件系统的新范例。软件单一文化是广泛使用的应用程序，共享共同的漏洞。因此，任何利用易受攻击的应用程序的一个实例的攻击都提供了广泛破坏的手段。协作安全的新兴概念，其中独立但合作的实体形成一个组，以提高他们的个人安全，提供了机会，利用软件单一文化的同质性集体和相互保护。可以利用单一文化来提高应用程序的整体安全性和可靠性。运行同一应用程序的独立实例的COSS成员将不断交换信息，使他们能够共同识别新的应用程序故障和攻击（协作监控），识别所有应用程序实例共享的核心漏洞（漏洞识别），并自动开发，测试和应用修复程序（修复应用程序）。识别应用程序漏洞可能需要在每个应用程序实例中的检测和监视方面花费大量成本。我们利用COSS的大小，通过将监控任务分布在大量人群中来分摊每个实例上监控应用程序行为的成本;每个实例只监控公共应用程序的一部分，但总体上覆盖了整个应用程序。COSS可以被看作是一个大规模的、多样化的软件测试工具，它允许其成员在非常精细的粒度级别上识别一个潜在的大型和复杂的主机应用程序的行为。该项目开发，原型设计和评估自动构建协作，自我保护的软件系统的技术，使可靠和安全的商品软件。

Angelos KeromytisColumbia UniversityEnabling Collaborative Self-healing Software Systems0627473Panel P060975AbstractCollaborative Self-healing Systems (COSS) is a new paradigm for protecting software systems. Software monocultures are widely used applications that share common vulnerabilities. Hence, any attack that exploits one instance of a vulnerable application provides the means for wide-spread damage. The emerging concept of collaborative security, wherein independent but cooperative entities form a group to improve their individual security, provides the opportunity to exploit the homogeneity of a software monoculture for collective and mutual protection. Monocultures can be leveraged to improve an application's overall security and reliability. COSS members running independent instances of the same application will continuously exchange information that allows them to collectively identify new application faults and attacks (collaborative monitoring), identify the core vulnerability shared by all instances of the application (vulnerability identification), and to automatically develop, test and apply fixes (heal the application). Identifying the application vulnerability requires potentially substantial costs in instrumentation and monitoring in each application instance. We leverage the size of a COSS to amortize the cost of monitoring the application's behavior on a per-instance basis by distributing the monitoring task across a large population; each instance only monitors a portion of the common application but collectively the entire application is covered. COSS may be viewed as a large-scale, diverse software-testing facility that allows its members to identify how a potentially large and complex host application behaves at a very fine level of granularity. This project develops, prototypes and evaluates technologies for automatically building collaborative, self-securing software systems, enabling reliable and secure commodity software.