Cyber forensics “robots” clean up infected code
Posted April 16, 2007
When Bart Miller became interested in code debugging, he had no idea it would lead him into the world of cyber sleuthing, where programmers duel in a world reminiscent of MAD magazine’s “Spy vs. Spy.”
In the early 1990s, Miller and graduate student Jeff Hollingsworth set out to build tools that could analyze the operation of programs running on high-performance computing systems. The key to their program, called dynamic instrumentation or Dyninst, was developing a way to grab onto a running code without knowing anything about its source code, analyze it, and patch it without disturbing it, all while it’s still running.
Miller says that when he first presented the idea, other computer scientists met it with severe skepticism.
“People thought these ideas were crazy when we proposed them,” says Miller, a professor of computer science at the University of Wisconsin-Madison. “The idea that you could grab onto a binary program without knowing anything about it and safely trace its behavior to control it, to monitor it, to do whatever you wanted to do, that just seemed to be a futile exercise.”
Miller says without strong support from the Department of Energy’s Office of Advanced Scientific Computing Research, he would not have been able to pull it together. But by 1995 the group had a working program they named Paradyn. The demand for it became so strong that the researchers pulled out the portion of the code that performed the performance audits and assembled a publicly accessible library of Dyninst code anyone could use to build program analysis and instrumentation tools. Miller says users worldwide have built tools for analyzing performance, debugging, security audits, and software engineering.
