Extracting and Representing Knowledge for Software Protection Systems

The key innovation of our proposed approach is an extensible pluggable framework for the creation of knowledge-based, autonomic host-based software protection systems. The architecture will consist of an integrated knowledge representation approach across and within abstraction levels. It enables the autonomic system to map from low level concepts (events, logs) to high level concepts and incorporate human knowledge about the operational environment and domain. It will enable the integration of disparate models of the software system, including both static analysis and runtime observation. Pluggable elements within the architecture include filters, preprocessors and log analyzers, clustering, data mining and trace analysis frameworks, and pluggable dependencies and behavior patterns analysis and visualization approaches. The approach will use both static analysis of software code as well as stored software application profiles to characterize baseline and anomalous application state. Outputs of the system include human understandable representations and visualizations of anomaly types, detected event patterns and classifier outputs.