Skip to main content

Seminar:  Exploring System Security and Dependability through Big Data Techniques

Date:January 14, 2013 
Talk Title:Exploring System Security and Dependability through Big Data Techniques
Speaker:Tudor Dumitras, Symantec Research Labs
Time & Location:12:00pm - 1:00pm
CIC Building, Pittsburgh


Because computer systems are increasingly complex, and they operate in an ecosystem of users, attackers and inter-dependent software, their failure modes and vulnerabilities are often specific to the deployment environments and cannot be addressed by evaluating the systems in isolation, at development time. In this talk, I will explore the security and dependability of systems in active use. In the real world, these properties represent moving targets because the systems are targeted by sophisticated cyber attacks or because they undergo software upgrades. 

To build better systems we need Internet-scale models, derived empirically and updated frequently, for the behavior and failures of software (both benign and malicious) in the field. I built the Worldwide Intelligence Network Environment (WINE), a platform for Big Data experiments in cyber security that gives access to data collected by Symantec on 10+ million hosts around the world. Five academic groups and several engineering teams within Symantec have conducted research using WINE in 2012. For example, WINE allowed us to measure, for the first time, the typical length of zero-day attacks in the real world (approximately 10 months, on average)---a question that had remained open for more than a decade because zero-day attacks are rare events that are unlikely to be observed in honeypots or in lab experiments. Additionally, a WINE experiment revealed that, while vulnerabilities and programming bugs continue to follow a growing trend, the fraction of vulnerabilities that are actually exploited in the real world has been steadily decreasing over the past ten years.  

These findings have important implications for public policy and for the future security technologies. For example, they suggest that we should shift the focus of the debate around software vulnerabilities from trying to accelerate patch creation, through vulnerability disclosures, to accelerating patch deployment, through efficient mechanisms for online software upgrade. However, software upgrades often fail or require downtime, which threatens the dependability of actively used systems. I will also describe an upgrade-centric fault model, derived empirically, that emphasizes the main reasons why upgrades fail (they break hidden dependencies) and why they require planned downtime (they involve migrating persistent data). This fault model suggests that dependable upgrade mechanisms must satisfy the AIR properties (atomicity, isolation and runtime-testing), and I will discuss the design of an upgrading system, Imago, that provides these properties.

Speaker Bio

Tudor Dumitras is a senior research engineer at Symantec Research Labs (SRL), and his research interests are in Big Data approaches to problems in system security and dependability. At SRL he built the Worldwide Intelligence Network Environment (WINE), which is currently used by several research teams in academia, as well as by Symantec's engineers. Tudor's prior research focused on improving the dependability of large-scale distributed systems (addressing operator errors during software upgrades), of enterprise systems (addressing the predictability of fault-tolerant middleware), and of embedded systems (addressing soft errors in networks-on-chip). He received the 2011 A. G. Jordan Award, from the ECE Department at Carnegie Mellon University, for an outstanding Ph.D. thesis and for service to the community, the 2009 John Vlissides Award, from ACM SIGPLAN, for showing significant promise in applied software research, and the Best Paper Award at ASP-DAC'03. Tudor holds a Ph.D. degree from Carnegie Mellon University.