Logo image
Back
Reverse Engineering Utility Functions Using Genetic Programming to Detect Anomalous Behavior in Software
Conference proceeding

Reverse Engineering Utility Functions Using Genetic Programming to Detect Anomalous Behavior in Software

Sunny Wong, Melissa Aaron, Jeffrey Segall, Kevin Lynch and Spiros Mancoridis
2010 17th Working Conference on Reverse Engineering
Oct 2010
DOI: https://doi.org/10.1109/WCRE.2010.23

Abstract

autonomic computing Genetic programming Instruction sets Measurement Monitoring Security software fault tolerance utility function Web server
Recent studies have shown the promise of using utility functions to detect anomalous behavior in software systems at runtime. However, it remains a challenge for software engineers to hand-craft a utility function that achieves both a high precision (i.e., few false alarms) and a high recall (i.e., few undetected faults). This paper describes a technique that uses genetic programming to automatically evolve a utility function for a specific system, set of resource usage metrics, and precision/recall preference. These metrics are computed using sensor values that monitor a variety of system resources (e.g., memory usage, processor usage, thread count). The technique allows users to specify the relative importance of precision and recall, and builds a utility function to meet those requirements. We evaluated the technique on the open source Jigsaw web server using ten resource usage metrics and five anomalous behaviors in the form of injected faults in the Jigsaw code and a security attack. To assess the effectiveness of the technique, the precision and recall of the evolved utility function was compared to that of a hand-crafted utility function that uses a simple thresholding scheme. The results show that the evolved function outperformed the hand-crafted function by 10 percent.

Metrics

35 Record Views
8 citations in Scopus

Details

Logo image