Communications of the ACM
DARPA Announces Cyber Grand Challenge
Credit: DARPA
What if computers had a "check engine" light that could indicate new, novel security problems? What if computers could go one step further and heal security problems before they happen?
To find out, the Defense Advanced Research Projects Agency (DARPA) intends to hold the Cyber Grand Challenge — the first-ever tournament for fully automatic network defense systems. DARPA envisions teams creating automated systems that would compete against each other to evaluate software, test for vulnerabilities, generate security patches, and apply them to protected computers on a network. To succeed, competitors must bridge the expert gap between security software and cutting-edge program analysis research. The winning team would receive a cash prize of $2 million.
"DARPA's series of vehicle Grand Challenges were the dawn of the self-driving car revolution," says Michael Walker, DARPA program manager. "With the Cyber Grand Challenge, we intend a similar revolution for information security. Today, our time to patch a newly discovered security flaw is measured in days. Through automatic recognition and remediation of software flaws, the term for a new cyber attack may change from zero-day to zero-second."
Highly trained experts capable of reasoning about software vulnerabilities, threats, and malware power modern network defense. These experts compete regularly on a global "Capture the Flag" tournament circuit, improving their skills and measuring excellence through head-to-head competition. Drawing on the best traditions of expert computer security competitions, DARPA aims to challenge unmanned systems to compete against each other in a real-time tournament for the first time.
"The growth trends we've seen in cyber attacks and malware point to a future where automation must be developed to assist IT security analysts," says Dan Kaufman, director of DARPA's Information Innovation Office, which oversees the Challenge.
The competition is expected to draw teams of top experts from across a wide range of computer security disciplines including reverse engineering, formal methods, program analysis, and computer security competition. To encourage widespread participation and teaming, DARPA plans to host teaming forums on the Cyber Grand Challenge website.
For the first time, a cyber competition would take place on a network framework purpose-built to interface with automatic systems. Competitors would navigate a series of challenges, starting with a qualifying event in which a collection of software must be automatically analyzed. Competitors would qualify by automatically identifying, analyzing, and repairing software flaws.
DARPA intends to invite a select group of top competitors from the qualifying event to the Cyber Grand Challenge final event, slated for early to mid-2016. In that competition, each team's system would automatically identify software flaws, scanning the network to identify affected hosts. Teams would score based on how capably their systems could protect hosts, scan the network for vulnerabilities, and maintain the correct function of software. The winning team from the Cyber Grand Challenge finals would receive a cash prize of $2 million, with second place earning $1 million and third place taking home $750,000.
A Broad Agency Announcement (BAA) with specific information for potential competitors is available online. Competitors can choose one of two routes: an unfunded track in which anyone capable of fielding a capable system can participate; and a funded track in which DARPA awards contracts to organizations presenting the most compelling proposals.
DARPA also plans in the near future to issue a second BAA for proposals to develop technologies to support the competition. Support technologies will include accessible visualization of a real-time cyber competition event, as well as custom problem sets. That BAA will be available on the Federal Business Opportunities website.
The program anticipates hosting two Challengers' Days — one at DARPA's offices in Arlington, Va., and the other on the West Coast — where interested competitors can learn more about the event. More information, including up-to-date rules and prize amounts, is available at Cyber Grand Challenge website.
No entries found