Software Protection through Autonomic Representation of Knowledge (SPARK)

Cyberspace is a war-fighting domain, and cyber warfare poses a real and significant threat to the security of the United States. Today’s nation-state-class attacks target critical software applications and intellectual property via acts of piracy, theft, and reverse engineering. They are increasingly difficult to differentiate from normal operations and often take advantage of users’ trust in a system’s operating environment, hardware, memory, I/O, and other attack vectors. To counter such novel attacks, software protection systems must move beyond traditional and defeatable solutions that rely on signatures and integrity checks. Such protection systems must provide a near-human ability to derive meaning and draw quantitative conclusions from system event data and must adopt a machine learning approach to improve their ability to detect, prevent and remediate novel attacks with experience. To meet these requirements, we propose to develop a Software Protection through Autonomic Knowledge Representation (SPARK) system to provide human-assisted knowledge construction and machine learning within an otherwise autonomic attack detection and software protection system. Key features of our system include the use of multiple modeling techniques to ensure a “best fit” to the underlying state, events and run-time context and a natural language processing-based approach to knowledge construction and representation.