International Defense Security & Technology Your trusted Source for News, Research and Analysis
During the past decade information technologies have driven the productivity gains essential to U.S. economic competitiveness, and computing systems now control significant elements of critical national infrastructure. As a result, tremendous resources are devoted to ensuring that programs are correct, especially at scale. Unfortunately, in spite of developers’ best efforts, software errors are at the root of most execution errors and security vulnerabilities.
To help improve this state, DARPA has created the Mining and Understanding Software Enclaves (MUSE) program. MUSE seeks to make significant advances in the way software is built, debugged, verified, maintained and understood. The collective knowledge gleaned from MUSE’s efforts would facilitate new mechanisms for dramatically improving software correctness, and help develop radically different approaches for automatically constructing and repairing complex software.
“Our goal is to apply the principles of big data analytics to identify and understand deep commonalities among the constantly evolving corpus of software drawn from the hundreds of billions of lines of open source code available today,” said Suresh Jagannathan, DARPA program manager. “We’re aiming to treat programs—more precisely, facts about programs—as data, discovering new relationships (enclaves) among this ‘big code’ to build better, more robust software.”
Central to MUSE’s approach is the creation of a community infrastructure that would incorporate a continuously operational specification-mining engine. This engine would leverage deep program analyses and foundational ideas underlying big data analytics to populate and refine a database containing inferences about salient properties, behaviors and vulnerabilities of the program components in the corpus. If successful, MUSE could provide numerous capabilities that have so far remained elusive.
“Ideally, we could enable a paradigm shift in the way we think about software construction and maintenance, replacing the existing costly and laborious test/debug/validate cycle with ‘always on’ program analysis, mining, inspection and discovery,” Jagannathan said. “We could see scalable automated mechanisms to identify and repair program errors, as well as tools to efficiently create new, custom programs from existing components based only a description of desired properties.”
DARPA’s MUSE program
The code repository is being built in another DARPA program “Mining and Understanding Software Enclaves (MUSE)”, whose aim is to scan billions of open-source code, and create databases of code properties, vulnerabilities and behaviors.
Draper is developing DeepCode under DARPA’s MUSE program. “Draper is applying big-data analytics to automatically discover software vulnerabilities,” said Draper President and CEO Kaigham J. Gabriel. DeepCode will examine terabytes of open-source software and by using machine learning and pattern analysis techniques, researchers hope that DeepCode will learn what good code and bad code looks like.
Once the system is trained to recognize vulnerabilities, DeepCode will analyze new and existing software projects (both binary and source), automatically identify flawed program segments, and recommend code repairs to replace the vulnerable software components with more secure versions,”
This program represents the first time deep learning techniques, a set of algorithms that enable software to mimic the human brain’s ability to recognize patterns, being applied to analyze software structure and semantic content. In an earlier study, Draper’s DeepCode team used deep learning analytics to successfully identify synthetic Advanced Persistent Threats from within large volumes of otherwise benign network traffic.
Vulnerabilities manifest when implementations do not conform to design. Determining program correctness thus fundamentally requires a precise understanding of a program’s intended behavior, and a means to convey this understanding unambiguously in a form suitable for automated inspection. Having useful, comprehensible and efficiently checkable program specifications is therefore critical for gaining high assurance and confidence of complex software systems, says DARPA. Often, however, the behaviors exposed by a program’s implementation do not match those defined by the program’s specification, in large part because the task of writing useful, correct and efficiently checkable specifications is often as hard as the task of writing the implementations that purport to satisfy it.
An integral part of the envisioned infrastructure would be a continuously operational specification mining engine. This engine would leverage deep program analyses and foundational ideas underlying big data analytics to populate and refine a database containing inferences about useful properties, behaviors and vulnerabilities of the program components in the corpus. The collective knowledge gleaned from this effort would facilitate new mechanisms for dramatically improving software reliability, and help develop radically different approaches for automatically constructing and repairing complex software.
Among the many envisioned benefits of the program are scalable automated mechanisms to identify and repair program errors, and specification-based tools to create and synthesize new, custom programs from existing corpus elements based on properties discovered from this mining activity.
DARPA’s PLINY program
DARPA (Defense Advanced Research Projects Agency) has provided four year $11 million dollar grant to University of Texas at Austin, University of Wisconsin-Madison (UW-Madison), and Rice University to develop Pliny system whose goal is to make future code more secure and less buggy.
Pliny can flag areas of a code that differ from its billions of lines of code repository.By highlighting such regions, Pliny will help software engineers make an informed decision whether to fix or keep the differing code, Alternatively, it can act as an autocomplete and/or autocorrect system by finding code in the repository that will best fit the gaps in the program.
“Software today is far more complex than it was 20 years ago, yet it is still largely created by hand, one line of code at a time,” said co-PI Swarat Chaudhuri, assistant professor of computer science at Rice. “We envision a system where the programmer writes a few of lines of code, hits a button and the rest of the code appears. And not only that, the rest of the code should work seamlessly with the code that’s already been written.”
“Imagine the power of having all the code that has ever been written in the past available to programmers at their fingertips as they write new code or fix old code,” said Vivek Sarkar, Rice’s E.D. Butcher Chair in Engineering, chair of the Department of Computer Science and the principal investigator (PI) on the PLINY project. “You can think of this as autocomplete for code, but in a far more sophisticated way.”
The core of the system will be a data-mining engine that continuously scans the massive repository of open-source code. The engine will leverage the latest techniques in deep program analyses and big-data analytics to populate and refine a database that can be queried whenever a programmer needs help finishing or debugging a piece of code.
“The engine will formulate answers using Bayesian statistics,” said co-PI Chris Jermaine, associate professor of computer science at Rice. “Much like today’s spell-correction algorithms, it will deliver the most probable solution first, but programmers will be able to cycle through possible solutions if the first answer is incorrect.”
PLINY is part of DARPA’s Mining and Understanding Software Enclaves (MUSE) program, an initiative that seeks to gather hundreds of billions of lines of publicly available open-source computer code and to mine that code to create a searchable database of properties, behaviors and vulnerabilities
