EvoSec 2025W Lecture 20

Readings

• Somayaji, "Principles of a Computer Immune System." (NSPW 1997)
• Somayaji, "Panel: The Future of Biologically-Inspired Security: Is There Anything Left to Learn?" (NSPW 2008)

Discussion Questions

• How does evolution relate to biologically-inspired security?
• How does trust relate to biologically-inspired security?
• What do you think of the panel question "Is there anything left to learn?" Is it the right question to ask about biologically-inspired security?

Notes

Lecture 20
----------

G1
 - biology has created working security systems, so reasonable to try replicating
 - trust is the basis of everything, including bio-inspired security
 - question is a bit stubborn
   - hasn't been good for past scientists who have said this
 - was more "what's next to learn"
 - how can you replicate vaccines in computers?
   - computer vaccines would also have to change over time in response
     to attacker innovation
   - "inactivated malware"?
 - barely scratched the surface of how the brain works, so still lots to learn

G2
 - evolution is a testbed for security mechanisms in biology
 - biological entities don't protect secrets
 - we keep learning more about biology
 - what is the purpose of learning from biology?
 - we've pulled in the big concepts, so we may be on the downward slope
   - focus on more niche features of biology
   - we've used the big ones

G3
 - bio-inspired security is based on a system that evolved, so is related to evolution
 - trust arises in how malicious activities can be detected and stopped while normal system functioning is allowed to proceed
 - question is what is left to learn
 - gap between fields seems to be growing, not much communication
 - lots of crossover between other fields, why isn't it there in security?



Project presentations
 - 5-10 minute presentations
 - just present your project
   - basic idea
   - what you've done
   - what you're going to do
 - make sure to spend 1-2 slides explaining the research problem/area
   - why are you doing this work?
 - for the literature review part, give a high-level overview
   of past work
 - for proposals, do a brief lit review (1-2 slides) then describe
   your proposed research
 - have between 5-10 slides
   - 5 is probably enough


 - "Principles" was my first first-author publication
   - the principles part holds up today in terms of "what is cool" about
     immunology from a computer security perspective
 - Panel came out of a rejected paper
   - bit of a consolation prize


No "subsystem" in biology does exactly what you think it does
 - the systems evolved, they weren't designed
 - so no clear separation of concerns
 - immune system is for maintaining homeostasis, not "security"
   - co-existence is always an option
 - immune system is also a "distributed nervous system"
   - neurotransmitters are similar or are the same as the chemicals that
     immune cells use to communicate

When we talk about "bio inspired security" or any cross-disciplinary work,
we are comparing models to models
 - mapping models onto models is a subtle business
 - can often lead to more confusion than clarity

living systems evolved, so they survived in the face of evolving threats
 - neat trick to learn for computer security!
 - but...do we understand how they evolved?

Rather than metaphors, I want to get at underlying principles
 - solid foundations rather than shaky mappings

That foundation is clearly evolution, at least in part
 - but I think we got evolution wrong

evolution (to me) is an interplay between cooperation and conflict
 - cooperation is a key survival strategy
 - but cooperation is only safe if it is with those you trust
   - those who won't betray you for personal or short-term gain
 
The central problem of computer security is making sure systems cooperate
only with those who are trustworthy
 - more than "authorized" as credentials can be compromised

so from this perspective, computer security IS the problem of how to evolve computers in a world where trust isn't assumed

(note we mostly assume code, systems, services are trustworthy and thus can be trusted, and when they aren't our systems just break horribly)

bio-inspired security is the process of learning from systems that don't assume trust - how can they be built, how can they work?
 - but living systems are interesting just to the extent they are examples of such systems