Indiana University-Purdue University Indianapolis (IUPUI) / This thesis investigates techniques for improving real-time software instrumentation techniques of software systems. In particular, this thesis investigates two aspects of this real-time software instrumentation. First, this thesis investigates techniques for achieving different levels of visibility (i.e., ensuring all parts of a system are represented, or visible, in final results) into a software system without compromising software system performance. Secondly, this thesis investigates how using multi-core computing can be used to further reduce instrumentation overhead. The results of this research show that reservoir sampling can be used to reduce instrumentation overhead. Reservoir sampling at a rate of 20%, combined with parallelized disk I/O, added 34.1% additional overhead on a four-core machine, and only 9.9% additional overhead on a sixty-four core machine while also providing the desired system visibility. Additionally, this work can be used to further improve the performance of real-time distributed software instrumentation.

Este trabalho apresenta um estudo da instrumentalização de software em Redes de Sensores Sem Fio, complementado pela aplicação, em um estudo de caso, de uma instrumentalização. A proposta da instrumentalização visa ampliar o conhecimento sobre essas redes em termos de desempenho, permitindo ao usuário tomar decisões suportadas pelo instrumento. Nesse sentido, foi realizada a abordagem conceitual em termos de Redes de Sensores Sem Fio, da tendência de padronização para essas redes e de instrumentalização por meio de software. Para a comprovação dos benefícios da adoção da utilização do conceito de instrumentalização de software nessas redes, foi desenvolvida uma rede de sensores utilizando esses conceitos, na qual foi possível avaliar o perfil dos aspectos temporais e da manutenção da qualidade da conexão. Os resultados obtidos evidenciam que é possível conhecer, com maiores detalhes, o comportamento da rede, o que melhora a qualidade da tomada de decisão do usuário em relação à sua utilização em aplicações com restrições temporais, nas quais os tempos de resposta envolvidos devem respeitar os limites máximos permitidos. / This thesis aims at the study of software instrumentation handling in terms of wireless sensor networks which is supplemented with the its application in a case study. The instrumentation purposes go towards the networks knowledge extension concerning its performance by allowing the user to make decisions based on software instrument reading. In this sense, a conceptual approach was performed which takes the wireless sensor network into account as well as the trend of standardization for these networks and the software instrumentation itself. In order to confirm the benefits on adopting the usage of software instrumentation concept on these networks, a wireless sensor network was developed using these concepts. In this sense, it was possible to evaluate the timing aspects profile and the link quality maintenance. The results show that is possible to know about the behavior of the network in details. By doing this, the quality of the users decision-making regarding their use in applications with time constraints, in which response time involved should respect the maximum allowable limits, has been improved.

Este trabalho apresenta um estudo da instrumentalização de software em Redes de Sensores Sem Fio, complementado pela aplicação, em um estudo de caso, de uma instrumentalização. A proposta da instrumentalização visa ampliar o conhecimento sobre essas redes em termos de desempenho, permitindo ao usuário tomar decisões suportadas pelo instrumento. Nesse sentido, foi realizada a abordagem conceitual em termos de Redes de Sensores Sem Fio, da tendência de padronização para essas redes e de instrumentalização por meio de software. Para a comprovação dos benefícios da adoção da utilização do conceito de instrumentalização de software nessas redes, foi desenvolvida uma rede de sensores utilizando esses conceitos, na qual foi possível avaliar o perfil dos aspectos temporais e da manutenção da qualidade da conexão. Os resultados obtidos evidenciam que é possível conhecer, com maiores detalhes, o comportamento da rede, o que melhora a qualidade da tomada de decisão do usuário em relação à sua utilização em aplicações com restrições temporais, nas quais os tempos de resposta envolvidos devem respeitar os limites máximos permitidos. / This thesis aims at the study of software instrumentation handling in terms of wireless sensor networks which is supplemented with the its application in a case study. The instrumentation purposes go towards the networks knowledge extension concerning its performance by allowing the user to make decisions based on software instrument reading. In this sense, a conceptual approach was performed which takes the wireless sensor network into account as well as the trend of standardization for these networks and the software instrumentation itself. In order to confirm the benefits on adopting the usage of software instrumentation concept on these networks, a wireless sensor network was developed using these concepts. In this sense, it was possible to evaluate the timing aspects profile and the link quality maintenance. The results show that is possible to know about the behavior of the network in details. By doing this, the quality of the users decision-making regarding their use in applications with time constraints, in which response time involved should respect the maximum allowable limits, has been improved.

<p>Program anomaly detection — modeling normal program executions to detect deviations at runtime as cues for possible exploits — has become a popular approach for software security. To leverage high performance modeling and complete tracing, existing techniques however focus on subsets of applications, e.g., on system calls or calls to predefined libraries. Due to limited scope, it is insufficient to detect subtle control-oriented and data-oriented attacks that introduces new illegal call relationships at the application level. Also such techniques are hard to apply on devices that lack a clear separation between OS and the application layer. This dissertation advances the design and implementation of program anomaly detection techniques by providing application context for library and system calls making it powerful for detecting advanced attacks targeted at manipulating intra- and inter-procedural control-flow and decision variables. </p> <p><br></p> <p>This dissertation has two main parts. The first part describes a statically initialized generic calling context program anomaly detection technique LANCET based on Hidden Markov Modeling to provide security against control-oriented attacks at program runtime. It also establishes an efficient execution tracing mechanism facilitated through source code instrumentation of applications. The second part describes a program anomaly detection framework EDISON to provide security against data-oriented attacks using graph representation learning and language models for intra and inter-procedural behavioral modeling respectively.</p> <p><br> This dissertation makes three high-level contributions. First, the concise descriptions demonstrates the design, implementation and extensive evaluation of an aggregation-based anomaly detection technique using fine-grained generic calling context-sensitive modeling that allows for scaling the detection over entire applications. Second, the precise descriptions show the design, implementation, and extensive evaluation of a detection technique that maps runtime traces to the program’s control-flow graph and leverages graphical feature representation to learn dynamic program behavior. Finally, this dissertation provides details and experience for designing program anomaly detection frameworks from high-level concepts, design, to low-level implementation techniques.</p>