Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Carnegie Mellon’s Mayhem AI Wins DARPA’s Cyber Grand Challenge

techcrunch.com

Post reply on HN
Print view View original

21–30 of 30 posts

Re: Carnegie Mellon’s Mayhem AI Wins DARPA’s Cyber Grand Challenge

#21

Post by bradneuberg »

jmgrosen wrote: post #14

Hey guys, member of the (currently unverified) third place team, Shellphish. If anyone has any questions, I (or another member of my team) would be glad to answer them. We'll also be giving a talk at DEF CON on Sunday after the CTF ends, where we'll be open sourcing our CRS!

Is this both automated defense and offense via machine learning, or just automated defensive systems? If it includes automated offensive systems, what's to keep these kinds of systems from jumping outside of their sandboxes and compromising the outside world?

Re: Carnegie Mellon’s Mayhem AI Wins DARPA’s Cyber Grand Challenge

#22

Post by bradneuberg »

jmgrosen wrote: post #14

Hey guys, member of the (currently unverified) third place team, Shellphish. If anyone has any questions, I (or another member of my team) would be glad to answer them. We'll also be giving a talk at DEF CON on Sunday after the CTF ends, where we'll be open sourcing our CRS!

I'd love to learn more about the techniques actually being used in thse systems. Any good pointers to some scientific papers or review articles on the subject? I have a background in machine learning so am comfortable with technical papers.

Re: Carnegie Mellon’s Mayhem AI Wins DARPA’s Cyber Grand Challenge

#23

Post by [deleted] »

crypto5 wrote: post #16
jmgrosen wrote: post #14

Hey guys, member of the (currently unverified) third place team, Shellphish. If anyone has any questions, I (or another member of my team) would be glad to answer them. We'll also be giving a talk at DEF CON on Sunday after the CTF ends, where we'll be open sourcing our CRS!

What kind of AI was involved in your and competitors systems?

[deleted]

Re: Carnegie Mellon’s Mayhem AI Wins DARPA’s Cyber Grand Challenge

#24

Post by riffraff »

yeukhon wrote: post #20
jmgrosen wrote: post #14

Hey guys, member of the (currently unverified) third place team, Shellphish. If anyone has any questions, I (or another member of my team) would be glad to answer them. We'll also be giving a talk at DEF CON on Sunday after the CTF ends, where we'll be open sourcing our CRS!

Can you explain how this particular CTF work and how the system in general work against adversary? The article said insecure code and code filled with bugs are constantly being fed to the system. I don't really get it.

I hope someone more knowledgeable can chime in, but AFAIU, each player acts as the manager of a certain set of services, and as an attacker against all the others.

Such services contain bugs, so what each player must do is identify the bugs, fix them or mitigate them, and at the same time exploit them to gain access to the boxes of the other players.

So basically the programs in the competition do

* vulnerability identification

* vulnerability mitigation

* identification of the best target to attack (presumably based on the first thing, not sure if other things factor in)

Re: Carnegie Mellon’s Mayhem AI Wins DARPA’s Cyber Grand Challenge

#25

Post by jmgrosen »

crypto5 wrote: post #16
jmgrosen wrote: post #14

Hey guys, member of the (currently unverified) third place team, Shellphish. If anyone has any questions, I (or another member of my team) would be glad to answer them. We'll also be giving a talk at DEF CON on Sunday after the CTF ends, where we'll be open sourcing our CRS!

What kind of AI was involved in your and competitors systems?

If you mean AI in the sense of neural networks, Bayesian inference, etc., absolutely none in our CRS :) In retrospect, we could have made some better decisions about when to patch by using some of the simpler "AI" methods, but in terms of the actual core exploiting and defending, there's not much research into using AI in security.

Re: Carnegie Mellon’s Mayhem AI Wins DARPA’s Cyber Grand Challenge

#26

Post by harsh1618 »

jmgrosen wrote: post #14

Hey guys, member of the (currently unverified) third place team, Shellphish. If anyone has any questions, I (or another member of my team) would be glad to answer them. We'll also be giving a talk at DEF CON on Sunday after the CTF ends, where we'll be open sourcing our CRS!

First of all, congratulations for the awesome work. Do any of the components of your CRS make use of machine learning techniques? I read somewhere that mayhem uses deep learning but I'm not sure how exactly that would work in a program analysis scenario. I am assuming you used some form of symbolic execution (Edit: just realized it's angr, which is often useful in CTFs). How different was it from other general purpose SE systems (Klee etc)? Did you use any formal methods too?

Re: Carnegie Mellon’s Mayhem AI Wins DARPA’s Cyber Grand Challenge

#27

Post by sanxiyn »

bradneuberg wrote: post #21
jmgrosen wrote: post #14

Hey guys, member of the (currently unverified) third place team, Shellphish. If anyone has any questions, I (or another member of my team) would be glad to answer them. We'll also be giving a talk at DEF CON on Sunday after the CTF ends, where we'll be open sourcing our CRS!

Is this both automated defense and offense via machine learning, or just automated defensive systems? If it includes automated offensive systems, what's to keep these kinds of systems from jumping outside of their sandboxes and compromising the outside world?

For a flavor of automated offensive system, see this Automatic Exploit Generation paper: http://security.ece.cmu.edu/aeg/

David Brumley, PI of the research, went on to found ForAllSecure which is the company covered in the article.

Re: Carnegie Mellon’s Mayhem AI Wins DARPA’s Cyber Grand Challenge

#28

Post by sanxiyn »

bradneuberg wrote: post #22
jmgrosen wrote: post #14

Hey guys, member of the (currently unverified) third place team, Shellphish. If anyone has any questions, I (or another member of my team) would be glad to answer them. We'll also be giving a talk at DEF CON on Sunday after the CTF ends, where we'll be open sourcing our CRS!

I'd love to learn more about the techniques actually being used in thse systems. Any good pointers to some scientific papers or review articles on the subject? I have a background in machine learning so am comfortable with technical papers.

Here is 2015 competition postmortem from Trail of Bits: https://blog.trailofbits.com/2015/07/15/how-we-fared-in-the-...

Re: Carnegie Mellon’s Mayhem AI Wins DARPA’s Cyber Grand Challenge

#30

Post by BobombXing »

yayitscaroline wrote: post #6

It's funny that Brumley's first-place-winning robot CTF team is going to be competing against his first-place-winning human CTF team at DEFCON. The DARPA team is headed up by professor David Brumley. He also leads the Carnegie Mellon CTF hacker group PPP (Plaid Parliament of Pwning) that often wins at DEFCON's CTFs. This article mentioned that the Mayhem robot is going to be battling the human CTF players at DEFCON.…

Brumley likes to imply that his company's team is the "CMU team." Either way he'll see it as a CMU win.
Post reply on HN