Publications: Autonomic Computing
Autonomic Computing studies techniques for making computing systems self-configuring, self-tuning, self-diagnosing, self-repairing, and self-protecting. Our current work in the area focuses on using machine learning techniques to allow computing systems to configure and tune themselves to adapt to changing workloads and to automatically acquire patterns for detecting and blocking Internet worms.
- Fast and Effective Worm Fingerprinting via Machine Learning
[Details] [PDF]
Stewart Yang, Jianping Song, Harish Rajamani, Taewon Cho, Yin Zhang and Raymond Mooney
In Proceedings of the 3rd IEEE International Conference on Autonomic Computing (ICAC-2006), Dublin, Ireland, June 2006. Poster Session.As Internet worms become ever faster and more sophisticated, it is important to be able to extract worm signatures in an accurate and timely manner. In this paper, we apply machine learning to automatically fingerprint polymorphic worms, which are able to change their appearance across every instance. Using real Internet traces and synthetic polymorphic worms, we evaluated the performance of several advanced machine learning algorithms, including naive Bayes, decision-tree induction, rule learning (RIPPER), and support vector machines. The results are very promising. Compared with Polygraph, the state of the art in polymorphic worm fingerprinting, several machine learning algorithms are able to generate more accurate signatures, tolerate more noise in the training data, and require much shorter training time. These results open the possibility of applying machine learning to build a fast and accurate online worm fingerprinting system.
ML ID: 194
- Fast and Effective Worm Fingerprinting via Machine Learning
[Details] [PDF]
Stewart Yang, Jianping Song, Harish Rajamani, Taewon Cho, Yin Zhang and Raymond Mooney
Technical Report AI-06-335, Artificial Intelligence Lab, The University of Texas at Austin, August 2006. This is a longer version of our ICAC-2006 paper.As Internet worms become ever faster and more sophisticated, it is important to be able to extract worm signatures in an accurate and timely manner. In this paper, we apply machine learning to automatically fingerprint polymorphic worms, which are able to change their appearance across every instance. Using real Internet traces and synthetic polymorphic worms, we evaluated the performance of several advanced machine learning algorithms, including naive Bayes, decision-tree induction, rule learning, and support vector machines. The results are very promising. Compared with Polygraph, the state of the art in polymorphic worm fingerprinting, several machine learning algorithms are able to generate more accurate signatures, tolerate more noise in the training data, and require much shorter training time. These results open the possibility of applying machine learning to build a fast and accurate online worm fingerprinting system.
ML ID: 183
- Towards Self-Configuring Hardware for Distributed Computer Systems
[Details] [PDF]
Jonathan Wildstrom, Peter Stone, E. Witchel, Raymond Mooney and M. Dahlin
In The Second International Conference on Autonomic Computing, 241-249, June 2005.High-end servers that can be partitioned into logical subsystems and repartitioned on the fly are now becoming available. This development raises the possibility of reconfiguring distributed systems online to optimize for dynamically changing workloads. This paper presents the initial steps towards a system that can learn to alter its current configuration in reaction to the current workload. In particular, the advantages of shifting CPU and memory resources online are considered. Investigation on a publically available multi-machine, multi-process distributed system (the online transaction processing benchmark TPC-W) indicates that there is a real performance benefit to reconfiguration in reaction to workload changes. A learning framework is presented that does not require any instrumentation of the middleware, nor any special instrumentation of the operating system; rather, it learns to identify preferable configurations as well as their quantitative performance effects from system behavior as reported by standard monitoring tools. Initial results using the WEKA machine learning package suggest that automatic adaptive configuration can provide measurable performance benefits over any fixed configuration.
ML ID: 162
