The book therefore focuses on the design and operation of anti-fragile systems running on cloud computing platforms. The book studies select philosophical and practical aspects of antifragile ICT systems to provide a first insight.
Complex Adaptive Systems
Ideally, complex adaptive ICT systems should prevent positive feedback loops from ever propagating local errors into extreme global behaviors and causing systemic failures. The emergent global behaviors of complex adaptive ICT systems are often modeled as stochastic events with a given probability distribution.
Fragile, Robust, and Anti-fragile Systems
Overview of Book
Since we need to detect errors to achieve protection against fragility, IV. part discusses how to detect anomalies in system behavior. Content I. and II. works should be easy for most readers to understand, while some extra effort may be required to understand the more complex content of III. and IV.
Creating and Maintaining Anti-fragility
Anti-fragility to Downtime
Anti-fragility to Malware Spreading
The system is anti-fragile against spreading malware if it first learns to reduce the fraction of infected devices, for example to less than 1 % and then manages to keep the fraction of infected devices low even if the spreading mechanism of the malware changes . Chapter 10 combines cloud computing, time-varying software diversity, immunization, and imperfect malware detection/removal to model and analyze networks that gain antifragility against malware propagation by learning to stop and remove malware with unknown and time- varying distribution mechanisms.
Anomaly Detection
Calculations and simulations with slightly modified network science epidemiological models [23] determine the time-averaged fraction of infected devices. While reinfections generally help malware stay alive for a long time, the stopping technique described prevents malware outbreaks from spreading very far before they die out.
Ongoing Explanatory Work
The images or other third-party material in this chapter are included in the work's Creative Commons license, unless otherwise indicated in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulations, users will need to obtain permission from the licensee to duplicate, adapt or reproduce the material. Given a set of stakeholders, a complex adaptive ICT system is fragile to a particular type of negative impact, for example downtime, if a possible large impact is unacceptable to some stakeholders in the set and robust if all possible impacts are acceptable to all interested parties.
Black and Gray Swans
A black swan is a metaphor for rare global behavior of a complex adaptive system whose enormous negative impact comes as a total surprise to all stakeholders in the set. Because a gray swan is not a complete surprise to all stakeholders, it tends to have less impact than a black swan.
Examples of Swans
First, the black swan cannot be described by any of the stakeholders because the event is completely unknown to everyone. Second, while a black swan is a complete surprise to all stakeholders, there may be other individuals outside the stakeholder group for whom the event is not much of a surprise.
Limiting the Impact of Failures
This gray swan occurred because administrators did not pay enough attention to the established security procedures and thus created a single point of failure in the system. When a single point of failure is a design requirement, we need to deploy defenses in depth, which is not a research grade problem.
Learning from Small Failures
Bar-Yam, “The Precautionary Principle (Applicable to the Genetic Modification of Organisms),” 2014, arxiv.org/abs/1410.5787. Epstein, “The Fragility of Organizational Trust: Lessons from the Rise and Fall of Enron,” Organizational Dynamics, vol.
An Alternative Justi fi cation
Risk Analyses Ignore Swans
The reader may wonder how classic methods of risk analysis of ICT systems assess the impact of swans. Analysts often use the values low, medium, and high to approximate the probability and impact, resulting in the five-level risk matrix in Fig.2.3.
Understanding and Reducing Risk
Since it is difficult to determine all dependencies of complex systems, the probability of swans in complex ICT systems is underestimated, causing unacceptable impacts because most stakeholders are not prepared for swans. To address this development and reduce risks for stakeholders, it is necessary to create ICT systems with only tolerable errors.
Taleb ’ s Four Quadrants
Fourth quadrant systems must be avoided because they are vulnerable to gray and black swans with an intolerable impact. As explained in sections 2.3 and 2.6, classical risk analysis cannot handle one-off swans in the fourth quadrant.
Discussion and Summary
As long as the percentage is below the point of transition to mass distrust (see Figure 3.2), the distrust will disappear rather quickly, and the population will return to a high level of trust. Crutchfield, “The Hidden Fragility of Complex Systems – Consequences of Change, Changing Consequences,” in Cultures of Change: Social Atoms and Electronic Lives, edited by G.
De fi ning Trust
Explanatory Trust Model
An individual's state of trust is represented by the color of the patch: Trust is green ( ), mistrust is yellow ( ), and mistrust is red ( ), as seen in Fig.3.1. At each time step, the state of an individual is updated based on the states of its neighbors.
Model Limitations
Trust Is Fragile
Figure 3.2 shows the final distrust fraction as a function of the initial distrust fraction. As long as the initial distrust density is less than 15%, the resulting fraction of distrust is on average less than 1%.
Distrust Is Robust
Maintaining Trust
Prepare Alternative Services
National institutions that no longer accept paper-based communication exclude a small but significant percentage of the population. Although it makes sense to eliminate a redundant system in the short term, it can turn out to be a very bad decision in the long term.
Make Digital Services Voluntary
Furthermore, states that rely solely on electronic voting cannot fall back on traditional paper voting if the electronic voting solutions fail due to technical issues or targeted attacks. Much of the cost that companies and governments save by eliminating redundant systems can be lost when swan events destroy their remaining unique systems.
Build a Good Track Record
Finally, citizens and first responders in countries that dismantle their landline telephone systems cannot communicate when cellular telephone systems are in operation.
Discussion and Summary
Since removing single points of failure is a well-understood problem [47], this chapter first introduces four design principles that together isolate local failures before they propagate and cause systemic failures. The principles are rooted in the analysis in Chapter 2, which shows the need to isolate local disturbances and use natural and induced disturbances to learn about vulnerabilities.
Modularity
Although it is impossible to predict all possible swan events that can seriously affect complex information and communication technology (ICT) systems, we know the general reasons for extreme global behavior: single points of failure such as shared resources, local failures that trigger system failures due to chain reactions, scaling effects and cascading failures between system layers and different systems [35, ch. The first step to avoid the spread of local failures in networked computer systems is the modularization of systems at the hardware and software level [1, 3, 4].
Weak Links
Redundancy
Second, a critical system must have at least one backup secondary system operating in parallel with the primary system to ensure safe recovery. Leading to the next principle, we note that the secondary system must differ from the primary system to avoid both failing for the same reasons.
Diversity
Fail Fast
Systemic Failure Without Failed Modules
To better understand how a systemic failure can occur without any module failure, we consider a module as a black box with multiple input connections and a single output connection (see Fig.4.4). Therefore, an unusual combination of inputs to a module can cause more and more modules to generate extreme results, leading to a systemic failure.
The Need for Models
Even if each of the lower-level modules generates normal output, the combination of values received as input to the upper-level module can cause that module to generate an extreme output. Due to the great complexity of the behavior, no attempt was made to accurately model all aspects of the trust relationship between users and system operators.
Discussion
Worse, there may be black swans that are completely unpredictable to all stakeholders in the group. A vulnerability can be a design flaw, an implementation flaw, or a flaw in system operation or management.
Anti-fragility to Downtime
Choice of System Realization
Figure 5.1a sketches the architecture of a web-based solution running in a private data center without cloud technologies. The availability of a web solution is measured by the percentage of time it is accessible to users.
Modularity via Microservices
Weak Links via Circuit Breakers
In the normally closed state, the circuit breaker is closed and a calling service is allowed to connect to the called service. If this trial call succeeds, the circuit breaker will return to its normally closed condition.
Redundancy Provided by the Cloud
Note that the circuit breaker prevents any positive feedback loop from escalating a local failure into a systemic failure. However, should the test fail, the circuit breaker returns to the open state until another time period expires.
Diversity Enabled by the Cloud
It is possible to extend a simple canary push to many instances of an updated service. Instances of the old service are also running to ensure that the system handles peak load if there is a problem with the new code.
Fail Fast Using Software Tools
Top – Down Design and Bottom – Up Tinkering
Discussion and Summary
Open Access This chapter is distributed under the terms of the Creative Commons Attribution-Ncommercial 2.5 License (http://creativecommons.org/licenses/by-nc/2.5/), which permits any noncommercial use, distribution, and reproduction in any medium, provided that , that the original author(s) and source are cited. Finally, we discuss whether a country should have a single e-government system that performs many services, or several independent and diverse systems that each perform a few services.
The Norwegian e-Government System
Here we first study the Norwegian electronic government (e-government) system Altinn as it appeared in 2012 to better understand why it is beneficial to base the design of anti-fragile web-scale systems on fine-grained service-oriented architectures (SOAs) in public clouds with scalable and distributed data storage. This study is partly based on two analyzes of Altinn commissioned by the Norwegian Ministry of Trade and Industry [57, 58].
Redesign Needed
Better Testing
Availability Requirements
Fine-Grained SOA in a Public Cloud
To learn from mistakes and mitigate the vulnerability of downtime, the teams must also realize the fail-fast operating principle introduced in Chapter 4. To mitigate the vulnerability of downtime, governments should base eGovernment platforms and services on a fine-grained SOA in public clouds with highly redundant and scalable data storage.
User-Focused and Iterative Development
Worse, flaws in the platform's underlying architecture go undetected, making it harder and more expensive to meet design requirements as the number of users and services grow.
Single Versus Multiple Systems
- Systems with Strongly Connected Modules
- Cloud-Based Systems of Weakly Connected
The Danish Veterinary and Food Administration's experience shows the advantage of an alternative solution when a system goes down. Therefore, there is much less need to deploy multiple independent and different versions of an application when it is possible to create a cloud-native application.
Discussion and Summary
At the moment, we conclude that cloud-based solutions with SOA and microservices can achieve anti-fragility up to downtime. Next, we use the concepts to describe examples of the past vulnerability of Norwegian telecom systems to outages.
Anti-principles Causing Fragility to Downtime
Because there are no commercial cloud-based telecom solutions, the current chapter is more speculative than Chapter 5 which analyzes the Netflix media streaming solution.
Past Fragility to Downtime
The fact that both leading politicians and the NPTA were surprised indicates that the consequences of the heavy dependence of telecommunications systems on the power grid were not fully understood. The incidents discussed show that Norwegian telecommunications systems were vulnerable to outages in 2011 due to the anti-principles of uniqueness, connectivity and, most likely, closure.
Indicators of Fragility to Future Downtime
A unique technical and administrative information system at the core of the network shows vulnerability to future disruptions. From Section 2.7, a systemX depends on a systemY if a failure adversely affects the functionality of X. The details of the dependencies between different telecom infrastructures are generally unknown to analysts without close ties to operators, but the main dependencies between access operators and transport are usually known.
Robust Access Networks
If low-latency links are available, then lower-layer functions, for example, parts of the physical and middle access control layers, can also be moved to the cloud [63, 64]. Instead, the provider can allocate processing resources to the parts of the access networks where they are most needed at any given time.
Robust Network Core
Reduced Dependency on the Power Grid
Reduced Dependency on One Infrastructure
Anti-fragility to Downtime
Because the complexity of a system, first of all, derives from the many interactions between its parts, a global view of the system's behavior is necessary. A risk analysis [74] of Norwegian telecom networks using Internet protocol version 4 (IPv4) suggests that it is sometimes better to improve operations, maintenance and the ability to react quickly to problems than to make individual parts more robust of the current network infrastructure. in downtime.
Discussion and Summary
The case studies provide strong evidence that careful application of the five design and operating principles introduced in ch.4 can provide anti-fragility to downtime, that is, the principles lead to systems with less downtime than today's highly connected, highly optimized systems with little ability to handle unforeseen events. The limited functionality of each service facilitates the development of automatic fallback responses in case of local failures.
Anti-fragility to Malware
Introduction
A team of software developers has "skin" in the game when it is responsible for both development and operations (DevOps) of its software [37, 38]. Furthermore, since most dependency paths in the figure terminate in the transport network of the largest operator.
Explanatory Epidemiological Model
- Epidemiological Model
- Non-predictive Model
We create an explanatory epidemiological model of variable diversity, determine a general lower bound for the necessary diversity, evaluate the performance of the stopping technique for worst-case propagation in sparse and dense homogeneous networks, consider the ability of diversity to slow down persistent threats, and discuss independent research on software diversity. The infection probability determines the rate at which a diseased node infects a susceptible neighbor of the same type during a time step.
Malware-Halting Technique
84 8 Robustness against malware Spread that the model's stopping of malware translates into stopping malware in real systems.
Halting Technique Analysis
When this seed infects the hub, the hub will re-infect roughly D/L of its neighbors of the same type. Because each subset has N/L nodes, all subsets have the same fraction of infected nodes when averaged over many model runs.
Halting Technique Performance
- Sparse and Homogeneous Networks
- Dense and Homogeneous Networks
Each fraction of infected nodes is averaged over 500 networks with uniform random distribution of node types and seeds. The additional decrease in the fraction of infected nodes is relatively small for diversity above the lower bound in inequality (8.1).
Persistent Targeted Attacks
Finally, the attacker violates the confidentiality, integrity, or availability of the system to achieve his or her goals. Since it is necessary to create security patches adapted to the different binary versions of the same program [24, 83], it becomes impossible for an attacker to reverse-engineer software patches by comparing a specific patch with the corresponding code on a user's computer because the patch and code are both unknown to the attacker.
Related Work
Because the hash is unique for each input file, the server can determine whether binaries with the same name are identical or not. Kravvaritis [84] and colleagues defined three metrics to measure the diversity of binaries with the same name.
Summary
In chapter 8, we analyzed a deterministic epidemiological model, where an infected node immediately contaminated all its neighbors of the same type. The stochastic epidemiological model is first used to determine how to immunize unknown hubs on different inhomogeneous diffusion networks.
Malware Attack on a Norwegian Bank
This cascading failure occurred because anti-malware software running on bank computers failed to stop the infections, even though the anti-malware software was updated with the appropriate signature for the worm. Since the worm disabled the machines' automatic software update mechanism, the worm had to be manually removed from each machine.
Stochastic Epidemiological Model
The vendor's initial upgrade to the anti-malware software was flawed, allowing infected machines to reinfect cleaned machines over internal networks. The overall distribution model is deterministic in this case, as malware infects all reachable nodes with 100% probability.
How to Immunize Unknown Hubs
Figure 9.1 shows only the immunized pink nodules and the remaining multi-colored sensitive centers after known immunization. When recognition immunization is performed in advance, the fraction of infected nodes goes to zero after only a few hundred time steps.
Lower Bound on Required Diversity
Any malware outbreak in a network with L > 1 types of nodes operates on a subgraph with N/L nodes of the same type. However, the inequality is primarily important because it suggests that multiple concurrent outbreaks of malware with the ability to re-infect nodes will die out before they can spread far when the diversity of the software is large enough, given that the nodes are immunized.
Discussion and Summary
A system is vulnerable to malware when small outbreaks of different types of malware spread over a large area. If the types of malware spread to only a small fraction of devices, then the system is robust.
System Model
- Model Description
- Model Limitations
We combine compiler-generated diversity, software downloads from application stores, hub immunization, and imperfect malware detection/removal to achieve anti-fragility to the spread of malware. Infected nodes change type with probability r at each time to model the varying degree of imperfect malware detection followed by immediate malware removal and installation of new diverse code.
Anti-fragility on Static Graphs
- Simulations of Anti-fragility on Static Networks
- Anti-fragility on Large Static Networks
The good agreement between the simulated and calculated values indicates that the expression can provide good estimates of the average proportion of infected nodes. If we add malware detection to our example, the average proportion of infected devices decreases.
Anti-fragility on Time-Varying Graphs
- Simulations of Anti-fragility
The sharp increase in the proportion of infected nodes illustrates that malware stop is fragile to changes in the spread pattern when the diversity is too small. As shown in Fig. 10.2, the proportion of infected nodes is reduced to approx. 1% as the monoculture turns into a polyculture.
Discussion
However, it is possible to detect a change in the distribution of random data, called a distributional anomaly. Bar-Yam, “The Frontiers of Phenomenology: From Behaviorism to Drug Testing and Engineering Design,” New England Complex Systems Institute (NECSI) Report arxiv.org/abs/1308.3094.
Anomaly Detection
The Problem with Classical AI Research
The programs lacked the ability to generalize or show flexibility in the face of changing circumstances. The limited success of classical AI and neural network research has led many scientists to suspect that the brain does not drive a large collection of specialized learning algorithms.
An Alternative Approach to Learning
While a traditional specialized AI learning algorithm needs to be programmed in great detail, HTM is self-teaching. HTM is based on the assumption that the world has structure and is therefore predictable.
The Brain ’ s Neocortex
- Communication
- Memory
- Predictions
According to Hawkins [27], prediction is the primary function of the cortex and the basis for intelligence. The reader should know that a lot of information also flows down the hierarchies of the cortex.
Overview of HTM
- Sparse Distributed Representation
- Proximal Dendrite Segments
- Distal Dendrite Segments
If there is no previous state, all or none of the cells in the column are active. The active state with binary values is the feedback output of the cell and is also propagated to other cells via the side connections shown in the top left.
The Three Steps of HTM
- Make an SDR of the Input
- Represent the Input in Context of Previous Inputs
- Make Prediction from Current and Previous Inputs
If a cell is active due to forward input, it is in the active state. If no cell in the column is in the intended state, all cells become active.
Discussion and Summary
In this chapter, we discuss what an anomaly means and how the Hierarchical Temporal Learning (HTM) algorithm detects anomalies in data streams. Grok is an application that Numenta built on top of the HTM (http://numenta.org/nupic.html) implementation of the Numenta Platform for Intelligence Intelligence (NuPIC) to detect anomalies in metric data provided by Amazon Web Services ( AWS) clouds.
Anomalies
There is evidence that it is possible to detect the onset of major failures in different types of complex adaptive systems before the impact becomes unbearable [111, 112]. If the patterns in a stream are highly random, then it is difficult or even impossible to detect spatial and temporal anomalies.
HTM Anomaly Score
Note that it is the time sequence that is striking, not the individual patterns themselves. If it occurs many times, then it is the "new normal" and ceases to be an anomaly.
HTM Anomaly Probabilities
Grok the Cloud
The example in Fig. 12.2 illustrates that Grok can detect anomalies that are difficult for a human to see in a raw metric stream. The flowchart in Fig.12.4 illustrates how Grok can be integrated into a process to detect and mitigate the impact of induced (and natural) failures on applications running in the AWS cloud.
![Fig. 12.2 While the blue curve showing CPU utilization looks normal to humans, Grok detected an anomaly (picture from [109])](https://thumb-ap.123doks.com/thumbv2/1libvncom/9202441.0/138.659.255.578.89.332/curve-showing-utilization-normal-humans-detected-anomaly-picture.webp)
Rogue Behavior
In the future, it may be possible to automate at least part of the step. The senior analyst being monitored, Diana Lucero, is part of an experiment to test the app.
Detecting the Beginning of Swans
At the time of writing, the detection of catastrophic events in real time is an active area of research [111, 112]. Because global or emerging failures very often begin as local failures in complex ICT systems, it is possible to detect the onset of a swan in real time, even though we may not immediately understand the underlying reasons for their occurrence.
Discussion and Summary
We have come to the end of the book, which has explored different aspects of anti-fragile information and communication technology (ICT) systems. Penrose, Shadows of the Mind: A Search for the Missing Science of Consciousness, Oxford University Press, 1994.
Future Anti-fragile Systems
Achieving Anti-fragility
Analyzes of telecom infrastructures and e-governance systems confirm that the cloud facilitates anti-fragility up to downtime. Therefore, we must be able to monitor the behavior of a system to ensure robustness to a particular type of impact.
Future Anti-fragile ICT Systems
In a world where people are becoming more and more dependent on ICT, we need to build anti-fragility systems to avoid rare but extremely negative events that affect the entire population. Future HTM theory is likely to provide important insights into the development of antifragile machine learning systems.
Future Bio-inspired System Designs
The Need for Anti-fragile Processes
Weak links, redundancy and diversity should then be used to limit the impact of local failures. To improve the security of complex adaptive ICT systems, it is necessary to develop anti-fragile processes to maintain a high level of confidentiality, integrity and availability.
Challenge to Readers
Spinellis, "Cyberdiversity: Measures and Initial Results,"Proceedings of the 14th Panhellenic Conference on Informatics, Tripoli, Griekeland, 10-12 September 2010, pp. White, "Directed-Graph Epidemiological Models of Computer Viruses,"Proceedings of the 1991 IEEE Computer Society Simposium on Research in Security and Privacy, Oakland, CA, Mei, 1991, pp.
