No abstract

We present ClearView, a system for automatically patching errors in deployed software. ClearView works on stripped Windows x86 binaries without any need for source code, debugging information, or other external information, and without human intervention.ClearView (1) observes normal executions to learn invariants that characterize the application's normal behavior, (2) uses error detectors to monitor the execution to detect failures, (3) identifies violations of learned invariants that occur during failed executions, (4) generates candidate repair patches that enforce selected invariants by changing the state or the flow of control to make the invariant true, and (5) observes the continued execution of patched applications to select the most successful patch.ClearView is designed to correct errors in software with high availability requirements. Aspects of ClearView that make it particularly appropriate for this context include its ability to generate patches without human intervention, to apply and remove patches in running applications without requiring restarts or otherwise perturbing the execution, and to identify and discard ineffective or damaging patches by evaluating the continued behavior of patched applications.In a Red Team exercise, ClearView survived attacks that exploit security vulnerabilities. A hostile external Red Team developed ten code-injection exploits and used these exploits to repeatedly attack an application protected by ClearView. ClearView detected and blocked all of the attacks. For seven of the ten exploits, ClearView automatically generated patches that corrected the error, enabling the application to survive the attacks and successfully process subsequent inputs. The Red Team also attempted to make ClearView apply an undesirable patch, but ClearView's patch evaluation mechanism enabled ClearView to identify and discard both ineffective patches and damaging patches.

Our ability to control emergent phenomena depends on decomposing them into aspects susceptible to independent engineering. The amorphous medium abstraction separates what behavior is desired on a continuous space and how the behavior is implemented on a sensor/actuator network approximating the space, while the Proto language provides a means of composing self-organizing primitives on an amorphous medium. We thus separate the engineering problem into three components: a discrete kernel to emulate an amorphous medium and distribute code, a compiler for Proto, and implementations of high-level coordination and homeostasis primitives, allowing simple and concise expression of programs controlling spatial behaviors. Programs written using our implementation of this framework have been verified in simulation on over ten thousand nodes, as well as on a network of Berkeley Motes. Self-Managing Systems EngineeringThe study of self-organizing systems has now reached the tool-building phase, in which a new discipline of self-managing systems engineering can begin to emerge. The next step is to refine the principles of self-organization into a system of composable parts suitable for engineering-as the principles of electromagnetism are captured for electronic engineering in components like capacitors, transistors and resistors.To transform a science into an engineering discipline, we must identify an operating range, decouple aspects of the problem from one another, create standard interfaces for composition, identify primitive components which conform to the standards, and create rules of abstraction which hide the complexity of systems of components.We have begun this process in the domain of sensor/actuator network applications, observing that in many applications, the network is deployed to approximate a physical space, and that what is being programmed is the space rather than the network. This observation allows us to decouple self-management problems using the amorphous medium abstraction, so that global behavior descriptions in our Proto language can be compiled automatically into locally executed code which produces emergent phenomena matching the global description. We have experimentally verified our code both in simulation and (for small programs) on a network of sensor/actuator nodes.

m a ss a c h u se t t s i n st i t u t e o f t e c h n o l o g y, c a m b ri d g e , m a 02139 u s a -w w w. c s a il . mi t . e d u AbstractWe introduce Simultaneous Localization and Tracking (SLAT), the problem of tracking a target in a sensor network while simultaneously localizing and calibrating the nodes of the network. Our proposed solution, LaSLAT, is a Bayesian filter providing on-line probabilistic estimates of sensor locations and target tracks. It does not require globally accessible beacon signals or accurate ranging between the nodes. When applied to a network of 27 sensor nodes, our algorithm can localize the nodes to within one or two centimeters.

No abstract