Automatic Repair Validation

There is an active movement in the security research community focusing on automated intrusion prevention and self-healing software. However, a major hurdle prevents the widespread deployment of these types of systems: system administrators lack confidence in the quality of the generated fixes. Thus, a key requirement for these systems is that the efficacy of each fix must be tested and validated after it has been automatically developed, but before it is deployed. Under the response rates required by these systems, we believe such verification must proceed automatically. We call this process Automatic Repair Validation (ARV). To illustrate the difficulties faced by ARV, we propose Bloodhound, a system that tracks and stores malicious network flows for later replay during validation for self-healing software. Our goal is to motivate additional research in this direction by describing the problem and the challenges in addressing it, and to explore part of the solution space.