Are digital ants the answer to malware?

One of my favorite topics is anti-malware technology, especially when it portends “outside-the-box” thinking. Collective Intelligence, leveraged in Cloud Antivirus is one such example. Recently, I came across another interesting concept and it’s definitely unconventional.

PNNL’s research

Research coming out of Pacific Northwest National Laboratory (PNNL) always interests me. First, one of the lab’s mission is to resolve cyber-security issues. Second, their conclusions can be unorthodox. Case in point, Dr. Glenn Fink, Senior Research Scientist at PNNL believes Nature provides examples of how we can protect computers by using collective intelligence.
To help defend his position, Dr. Fink enlisted Dr. Errin Fulp, Associate Professor of Computer Science at Wake Forest University, specifically because of Dr. Fulp’s ground-breaking work with parallel processing. Together, the two researchers developed software capable of running multiple security scans contiguously, with each scan targeting a different threat. A technique it seems, Dr. Fink acquired from studying behavior exhibited by ant colonies.

Why ants?

In the Wake Forest University article, “Ants vs. Worms” by Eric Frazier, Professor Fulp describes why the researchers chose to mimic ants:
“In nature, we know that ants defend against threats very successfully. They can ramp up their defense rapidly, and then resume routine behavior quickly after an intruder has been stopped. We are trying to achieve that same framework in a computer system.”

All one has to do is watch a National Geographic special about ants to appreciate their collective capabilities. So, the doctors’ reasoning does makes sense.

Swarm Intelligence

The researchers call their technology Swarm Intelligence and for a good reason. According to Wikipedia, Swarm Intelligence is a system:
“Typically made up of a population of simple agents or boids interacting locally with one another and with their environment. The agents follow very simple rules, and although there is no centralized control structure dictating how individual agents should behave, local, and to a certain degree random interactions between such agents lead to the emergence of “intelligent” global behavior, unknown to the individual agents.”
The digital Swarm Intelligence consists of three components:
Digital ant: Software designed to crawl through computer code, looking for evidence of malware. The researchers mentioned that ultimately there will be 3000 different types of Digital Ants employed.
Sentinel is the autonomic manager of digital ants congregated on an individual computer. It receives information from the ants, determines the state of the local host, and decides if any further action is required. It also reports to the Sergeant.
Sergeant is also an autonomic manager, albeit of multiple Sentinels. If I understand correctly, the size of the network determines how many Sergeants are used. Also, Sergeants interface with human supervisors. The following slide courtesy of the researchers and the IEEE, depicts the collective arrangement:

In my world, Swarm Intelligence is complicated. So I needed to ask some questions:

Question: How do Digital Ants work? Are they similar to local anti-virus scanners?
Dr. Fulp’s answer: Ants migrate about the system checking for evidence. The evidence is typically a simple check (network statistics, process-table info), and different ant populations check for different things. If an ant finds something abnormal, it leaves a pheromone trail which will attract more ants to the same computer. Given more ants (which provide different pieces of information), a clearer understanding of the threat can be obtained. This is different from an AV program, since they have to continuously run all the scans (looking for the different pieces of evidence). Using our approach, the population of ants can change based on the threat level.
Question: On the surface, the Digital Ant, Sentinel, and Sergeant relationship appears sophisticated. Could you please explain how it works?
Dr. Fulp’s answer: Ants are simple agents that check for a piece of evidence (malware) and leave pheromone (so other ants can locate the evidence) if malware is found. Sentinels reside on individual computers and interact with ants to discover any threats based on the ants’ findings. Sergeants interact with Sentinels and can observe changes over multiple computers.
Question: When Digital Ants are checking for evidence, how do they know if a particular parameter is out-of spec? Is an initial system footprint taken?
Dr. Fulps’ answer: Yes, the Sentinel has to be initially trained to understand “normal”.
Question: How are more Digital Ants created?
Dr. Fulp’s answer: If an ant is successful (its evidence is helpful in finding a threat) then it is duplicated, if not it dies. Of course a base population of ants is maintained.
Question: You mention the Digital Ant gets rewarded or it dies. In software-speak; does that mean a counter/timer is incorporated in the Digital Ant? With death occurring when the counter/timer is not reset?
Dr. Fulp’s answer: The Digital Ant actually lives as long as it has “energy” which is supplied to it if it is rewarded. If unsuccessful, then the energy will exhaust and the ant terminates.
Question: What is the software equivalent of the term pheromone? Is it a software tag or pointer informing other Digital Ants what to focus on?
Dr. Fulp’s answer: Yes, for the current implementation it is a file provided by the Sentinel, it can be digitally signed to prevent alteration by malware.
Question: Is Digital Ant technology network-based or can it function on an individual computer?
Dr. Fulp’s answer: This technology is intended for use on a network, but could be a set of VMs in a single computer.
Question: An anti-virus developer employs what they call Collective Intelligence; is Swarm Intelligence similar?
Dr. Fulp’s answer: Similar ideas, the difference being a collection of agents provides information that an individual agent cannot.
Question: The Sentinel resides on the local host. What prevents it from being corrupted by malware?
Dr. Fulp’s answer: The Sergeant has to verify if the Sentinel is behaving correctly. The system is not perfect. One approach is to use digital signatures to prove the code has not been corrupted.
Question: TechRepublic members were concerned about Collective Intelligence relying on a single “in-the-cloud” source for management and malware diagnosis. Is Swarm Intelligence a more secure approach?
Dr. Fulp’s answer: I think it is a more scalable and robust design. One drawback is speed, as these systems require some time to ramp-up and down. Still, I think it’s a worthwhile approach for the massively parallel systems we will face in the future.
Final thoughts

This past summer, Dr. Fink invited Dr. Fulp and Wake Forest graduate students Wes Featherstun and Brian Williams to PNNL to test the theory on a live network. The results were encouraging; every time Dr. Fulp introduced a worm into the network, the Digital Ants successfully located it. I find that uniquely telling; technologists are learning from Nature.
I would like to thank Dr. Fink, Dr. Fulp, Mr. Featherstun, and Mr. Williams for their part in Swarm Intelligence. A special thanks to Dr. Fulp for taking the time to answer my numerous questions.


Thanks : teckrepublic

Microsoft's Hyper-V R2 vs. VMware's vSphere

Microsoft was late to the virtualization game, but the company has made gains against its primary competitor in the virtualization marketplace, VMware. In recent months, both companies released major updates to their respective hypervisors: Microsoft’s Hyper-V R2 and VMware’s vSphere. In this look at the hypervisor products from both companies, I’ll compare and contrast some of the products’ more common features and capabilities. I do not, however, make recommendations about which product might be right for your organization.
This table compares items in four editions of vSphere and three available editions of Hyper-V R2. Below the table, I explain each of the comparison items. (Product note: With the release of vSphere, VMware has released an Enterprise Plus edition of its hypervisor product. Enterprise Plus provides an expanded set of capabilities that were not present in older product versions. Customers have to upgrade from Enterprise to Enterprise Plus in order to obtain these capabilities.)

Click the image to enlarge.

Max host processors. Indicates the number of physical host processors that can be recognized by the system. Bear in mind that the Windows columns are Windows limits and not necessarily Hyper-V limits.
Max cores/processor. How many processor cores per physical processor are recognized?
Max virtual SMP. In an individual virtual machine, this indicates the maximum number of supported virtual processors. Note: This is a maximum value; not every guest operating system can support the maximum number of virtual processors.
Max host RAM (GB). The maximum amount of RAM recognized by the hypervisor.
Max RAM/vm. The maximum amount of RAM that can be allocated to an individual virtual machine.
Failover nodes. The maximum number of physical hosts that can be clustered together. N/A indicates that failover clustering is not supported for that particular hypervisor edition.
Memory overcommit. Does the hypervisor support memory overcommit? Memory overcommitment is a technique available in vSphere that allows administrators to allocate more RAM to virtual machines than is physically available in the host. There are numerous pro and con articles about this topic, but it’s clear that having the ability to allocate more resources than are physically available increases overall virtual machine density. The decision to use memory overcommit in a production environment is up to each organization. That said, in my opinion, when used in the right circumstances, I can see great benefit in this feature.
Transparent page sharing. Transparent page sharing is one method by which memory overcommitment is achieved. With this technique, common code shared between virtual machines is, itself, virtualized. Let’s say that you have 100 virtual machines running Windows XP for VDI. Using transparent page sharing, RAM isn’t necessarily a major limiting factor when it comes to desktop density on the server. VMware has an excellent example of this technique in action.
Live Migration/VMotion. The ability for the hypervisor to migrate virtual machines between host servers without significant downtime. This is considered one of the most significant availability benefits provided by virtualization solutions.
Simultaneous Live Migration. Can the product utilize its Live Migration capabilities to move multiple virtual machines simultaneously between nodes?
Live guests per host. The number of virtual machines that can be powered on for a maxed-out host. In the real world, I’d be extraordinarily surprised to see anyone getting close to these limits. Virtualization is a great way to lower costs, but there are limits.
Live guests/HA cluster node. If you’re running your hypervisor in a cluster, this is the maximum number of virtual machines that can be active on any single host in the cluster. For vSphere with update 1, if you have eight or fewer cluster hosts, you can run up to 160 VMs per host. With nine or more cluster hosts, that number drops to 40.
Distributed Resource Scheduler. DRS is a technology that enables the migration of virtual machines between hosts based on business rules. This can be a boon for organizations with strict SLAs.
Snapshots per VM. The maximum number of snapshots that can be taken of an individual virtual machine. A snapshot is a point-in-time image of a virtual machine that can be used as part of a backup and recovery mechanism. I find snapshots incredibly useful, particularly on the workstation side of the equation, where a lot of “playing” takes place.
Thin Provisioning. One decision that has to be made early on in the life of any server (virtual or physical) is how much storage to allocate to the system. Too much storage and you waste valuable disk space — too little storage and services crash. In order to maintain reliable services, most IT shops overprovision storage to make sure that it doesn’t run out; but that conservatism adds up over time. Imagine if you have 100 VMs all with 4 or 5 GB of “wiggle room” going unused. With thin provisioning, you can have the best of both worlds. You can provision enough disk space to meet your comfort level, but under the hood, the hypervisor won’t allocate it all. As space begins to run low, the hypervisor will make more space available up to the maximum volume size. Although thin provisioning shouldn’t be used for massive workloads, it can be a huge boon to organizations that want conservatism without breaking the bank.
Storage Live Migration. This feature enables the live migration of a virtual machine’s disk files between storage arrays and adds an additional level of availability potential to a virtual environment.
Distributed Switch. VMware and Microsoft have virtual switches in their products, but only VMware has taken it one step further with the introduction of vSphere Enterprise Plus’ Distributed Switch. According to VMware, “Distributed Switch maintains network runtime state for VMs as they move across multiple hosts, enabling inline monitoring and centralized firewall services. It provides a framework for monitoring and maintaining the security of virtual machines as they move from physical server to physical server and enables the use of third party virtual switches such as the Cisco Nexus 1000V to extend familiar physical network features and controls to virtual networks.” In short, this new capability increases VMware’s availability and security capabilities.
Direct I/O. The ability for a virtual machine to bypass the hypervisor layer and directly access a physical I/O hardware device. There is limited support for this capability in vSphere; the product supports direct I/O operations to a few storage and networking controllers. Called VMDirectPath I/O, this feature can improve overall performance since it eliminates the “virtualization penalty” that can take place when hardware access is run through the hypervisor. There are some major disadvantages to VMDirectPath; for example, VMotion can’t work anymore because of the hardware need. (Note: This feature is different than direct access to disks, which Hyper-V does support.)
Max. partition size (TB). What is the largest partition supported by the hypervisor? Although VHD-based volumes, such as those used by Hyper-V R2, can be up to 2 TB in size, read this blog by Brian Henderson for insight into maximum Windows partition sizes, particularly if you bypass the VHD option altogether and use disks directly.
Application firewall (vShield). According to VMware “VMware vShield Zones enables you to monitor, log and block inter-VM traffic within an ESX host or between hosts in a cluster, without having to divert traffic externally through static physical chokepoints. You can bridge, firewall, or isolate virtual machine between multiple zones defined by your logical organizational and trust boundaries. Both allowed and blocked activities are logged and can be graphed or analyzed to a fine-grained level.” In other words, you don’t need to run traffic through external switches and routers to protect applications from one another.
Virtual instance rights. This is a Microsoft-only right that can seriously lower the overall cost of running Hyper-V R2 in a Windows-only environment. If you use the Data Center edition of Windows, you can run as many Windows Server-based virtual machines as you like without incurring additional sever licensing costs.
Hypervisor licensing. The method by which the product is licensed. Either per host or per processor.

Thanks : teckrepublic