Discovering Correctness Constraints for SelfManagement of System Configuration

1
Discovering Correctness Constraints for
Self-Management of System Configuration

• Review

2
Overview

• An approach to study Correctness Constraints for
  Self-Managing Configuration Systems
• Prophylactic (protective/preventive) monitoring
  system configurations for possible problems
• Glean
• Analyze configurations and perform clustering
• Develop correctness constraints
• Proactively detect problems

3
Windows Registry

• Contains both application and OS config info
• Failures
• Incorrect installation
• Malicious programs
• Untested interactions
• Challenges in monitoring
• Positive identification
• Negative identification
• Develop Correct Constraints
• Use training sets of good values

4
GLEAN

• Objective?
• Mode of operation
• Analyze and create Configuration Classes
• Generate Hypotheses
• Validate and create constraints
• Continuously monitor and alert

5
Configuration Classes

• Extra structure to identify common structure
  across the registry
• Allows to create Constraints
• Class discovery
• Bottom-up approach
• Data clustering and naming

6
Generating Hypotheses

• Constraints
• Internal
• External
• Size Constraint
• Internal
• Fixes size of value of subkey
• Value Constraint
• Internal
• Limits value of subkey to preset choices
• iltlg(n) ino of choices nsamples considered

7
Generating Hypotheses

• Reference Constraint
• External
• Key must reference an external instance
• Generate Hashtables and compares
• Equality Constraint
• External
• Equates all keys with same values
• Generates Hashtables

8
Results

• Configuration Classes
• Discovers configurations of most standard file
  types
• Discovers configurations for trust settings,
  security settings, etc
• Detecting errors
• 33 errors detected
• Undetected errors
• Keys added/removed to registry
• Changed values of keys with unknown configs

9
Discussions

• Pitfalls
• Generalize default values as Equality Constraints
• Bad registry can lead to wrong constraints
• Not generate constraints for new applications
• Generate external constraints from single
  registry
• Very bulky
• Improvements
• Incorporate standard value types like strings,
  int, float, www addr, etc
• Need to constantly update Constraints for new
  softwares
• Correctness of correctness constraints?
• Continuous monitoring of windows registry for
  changes?
• Feasibility of large scale deployment.