Stealth and Real-time Program Execution Monitoring

Modern software development has introduced a wide variety of functionality in modular chunks that can be rapidly reconfigured to create new applications. This leads to large, complex systems that, while providing the desired capabilities, may also include non-obvious and undesirable behavior. Such behavior can often be used to compromise the security of a computer system, leaving the system vulnerable to attacks that may disrupt the system"s behavior or exfiltrate sensitive information. Autonomy-oriented computation offers the potential to allow complex computer systems to police themselves, detecting intrusion, performing self-healing, and directly countering cyber threats. An autonomic computing system tracks its own state to reason about properties such as system security and integrity. When anomalies are detected, the system can react to restore itself to its intended operation. A key first step in creating autonomic computing systems is developing self-monitoring technology. GrammaTech envisions the creation of SySense, a system monitoring tool that efficiently operates below the operating system, deploying sensors that implement a wide variety of monitoring techniques.