Software Protection through Autonomic Representation of Knowledge (SPARK)

Cyber warfare poses a critical threat to the security of our national and military interests via acts of piracy, theft, and reverse engineering. Today"s nation-state-class attacks are increasingly difficult to differentiate from normal operations and often take advantage of users"trust in a system"s operating environment, hardware, memory, and other attack vectors. To counter such novel attacks, software protection systems must move beyond traditional and defeatable solutions that rely on signatures and integrity checks. Such protection systems must provide a near-human ability to derive meaning and draw quantitative conclusions from system event data and must adopt a machine learning approach to improve their ability to detect, prevent, and remediate novel attacks with experience. To meet these requirements, we propose to develop a Software Protection through Autonomic Knowledge Representation (SPARK) system. Key features of our system include a natural language processing-based approach to knowledge construction and representation that provides both more expressiveness and greater flexibility than traditional attack modeling approaches, and a tiered approach to software protection that allows automated defense techniques to function autonomously while providing a fall-back to human involvement when previously unseen anomalous events are encountered.