Mining and Understanding Software Enclaves (MUSE) Suresh - - PowerPoint PPT Presentation
Mining and Understanding Software Enclaves (MUSE) Suresh Jagannathan Information Innovation Office DARPA http://www.darpa.mil/Our_Work/I2O/Programs/Mining_and_Understanding_Software_Enclaves_(MUSE).aspx 1 Distribution Statement A - Approved
1
http://www.darpa.mil/Our_Work/I2O/Programs/Mining_and_Understanding_Software_Enclaves_(MUSE).aspx
Distribution Statement A - Approved for Public Release, Distribution Unlimited
2
Distribution Statement A - Approved for Public Release, Distribution Unlimited Source: Phys.org Source: The New Yorker Source: Newsweek Source: USA Today
3
Distribution Statement A - Approved for Public Release, Distribution Unlimited
Navy’s newest warship (USS Zumwalt) runs on Linux
24M
The US government is the largest consumer of OSS
4
Distribution Statement A - Approved for Public Release, Distribution Unlimited
Navy’s newest warship (USS Zumwalt) runs on Linux
24M
The US government is the largest consumer of OSS in the world
Generic Program Properties Specialized Domain Properties
Source: ohloh.net
5
Distribution Statement A - Approved for Public Release, Distribution Unlimited
Program Analysis, Theorem Proving, Testing Learning and Synthesis Property Checking and Repair
Query: “Synthesize a program that does X”
α1 α2 α3 β1 β2 β3 λ1 λ2 λ3
Program that satisfies X: f(α1) ◦ g(β2) ◦ h(λ3)
Source Binary OR Source Binary OR
Inspection Discovery
Graph Database and Mining Engine Analytics Artifact Generation
6
Distribution Statement A - Approved for Public Release, Distribution Unlimited
Redundancies in the corpus exposed as dense components (enclaves) in the mined network
evidence
Anomalous properties have small number of connections Likely invariants have large number of connections
7
Distribution Statement A - Approved for Public Release, Distribution Unlimited
8
Collector! Classifier!
Diverse, Representative,! High-fidelity corpus! Ontological Structure! Types and Proofs! Binary decompilation! Static and dynamic analyses! Theorem proving! Tests and runtime verification! Executable Specifications! Model Checking! Abstract Interpretation! Contracts and assertions! Documentation extraction! Canonical and persistent representation of analysis
Program! Analyses! Database ! construction!
Environment and platform dependencies,! Models (memory, execution, …)!
Distribution Statement A - Approved for Public Release, Distribution Unlimited
9
Query Language DSLs
Navigation and Search Queries
Inference Engine
Mining Property Checking Learning and Model Generation Protocol Discovery
Specification Language
Synthesis Framework Queries
Distributed Graph Database
Distribution Statement A - Approved for Public Release, Distribution Unlimited
10
Ontology / Classification Collection Challenge Problems Demo Workshops
Evaluator
Datalog Analyses
(static, dynamic, concolic)
Type Systems Invariant Detection Repair Specification Trace Analysis Static Analysis LLVM Binary Specification Extraction Abstract Interpretation Dependently Typed IR Deep Learning Ontic Types & Clichés Synthesis from Specifications Sketch Based Synthesis Design Pattern Flaw Detection & Repair Widget Synthesis & Repair Draft-based Synthesis Probabilistic Inference Abductive Inference & Hypothesis Generation Graph Visualization Cloud Infrastructure
Artifact Generators Mining Engine Infrastructure Analytics
Convex Optimization Artifact Store Fault Localization & Repair Protocol Repair & Patch Synthesis Datalog Bayesian Queries Multii-Layered Database
Distribution Statement A - Approved for Public Release, Distribution Unlimited
11
Distribution Statement A - Approved for Public Release, Distribution Unlimited
Currently, ~6TB Java and C, C++
12
Source: Draper Labs
Distribution Statement A - Approved for Public Release, Distribution Unlimited
13
Use of clang and Draper’s open-source Fracture decompiler support both compile down of source and binary lift to LLVM Intermediate Representation (IR)
Source: Draper Labs
Distribution Statement A - Approved for Public Release, Distribution Unlimited
14
Source: Draper Labs
Distribution Statement A - Approved for Public Release, Distribution Unlimited
170K C/C++ Projects ~400GB Artifact Generator ~20M artifacts
(calls graphs, CFGs, etc.)
Graph Layer
LLVM ANTLR4 Metadata Extractor Fracture
Math Layer
Blue-Good Red-Bad
Identify and classify design patterns (flaws and repairs)
Deep Learning Repaired Program: Added bounds checks Buggy Program: Heartbleed bug
if (1+2+16 > s->s3->rrec.length) return 0; if (1+2+payload+16 > s->s3->rrec.length) return 0; if (write_length > SSL3_RT_MAX_PLAIN_LENGTH) return 0;
Distribution Statement A - Approved for Public Release, Distribution Unlimited
16
Source: Kestrel Institute
Distribution Statement A - Approved for Public Release, Distribution Unlimited
17
Source: Kestrel Institute
Distribution Statement A - Approved for Public Release, Distribution Unlimited
18
Source: Kestrel Institute
19
Source: Kestrel Institute
Distribution Statement A - Approved for Public Release, Distribution Unlimited
130K Java Projects ~2.3B methods
Analysis & Specification Extraction ~200B facts Machine Learning
180 out of 130K projects relevant to AES
Program Specification Implementation + Proof of Correctness
Synthesis + Proof Refinement (defthm bytep-of-xtime (implies (bytep b) (bytep (xtime b))) :hints (("Goal" :in-theory (enable acl2::shl)))) public static int lookup (int[][] arr, int hex) { int row = hex >> 4; int column = hex & 0xF; return arr[row][column]; } Types Control Flow Graphs API sequences Proofs
422 Features
Distribution Statement A - Approved for Public Release, Distribution Unlimited
21
Problem Approach Synthesis from demonstrations in Swing/Eclipse Dynamic tracing analysis Synthesis of AES Specification-driven (synthesis-by-construction) Automated repair of incorrect API usage in Android Code transfer Repair of incorrect invariants (off-by-
Deep learning Synthesize a communication module for a drone User-directed cliché discovery Complete a partial implementation of binary search tree Sketch-based synthesis Graph classification and repair Repair incorrect graph implementations from specifications
Distribution Statement A - Approved for Public Release, Distribution Unlimited
www.darpa.mil
22