Causal Modeling of Observational Cost Data: A Ground-Breaking use of Directed Acyclic Graphs

Size: px
Start display at page:

Download "Causal Modeling of Observational Cost Data: A Ground-Breaking use of Directed Acyclic Graphs"

Transcription

1 use Causal Modeling of Observational Cost Data: A Ground-Breaking use of Directed Acyclic Graphs Bob Stoddard Mike Konrad SEMA SEMA November 17, 2015 Public Release; Distribution is Copyright 2015 Carnegie Mellon University This material is based upon work funded and supported by the Department of Defense under Contract No. FA C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the United States Department of Defense. References herein to any specific commercial product, process, or service by trade name, trade mark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by Carnegie Mellon University or its Software Engineering Institute. NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN AS-IS BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. [Distribution Statement A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-us Government use and distribution. This material may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other use. Requests for permission should be directed to the Software Engineering Institute at permission@sei.cmu.edu. Carnegie Mellon is registered in the U.S. Patent and Trademark Office by Carnegie Mellon University. DM Public Release; Distribution is 1

2 use Agenda Problem of Developing CERs 1 Why Causation instead of Correlation Causal Modeling using DAGs 2 Examples Call for Action and Collaboration 1 Cost Estimating Relationships 2 Directed Acyclic Graphs 3 Problem of Developing CERs Many CERs are built using traditional correlation and statistical regression modeling However, serious concerns exist in using these methods for the development of CERs, namely: What if other factors not represented in the model are responsible for the cost effects? What if there are convoluted factors impacting cost? What if cost analysts decide to interpret the regression coefficients as the degree of influence on cost? How do cost analysts confidently know that the CER parameters influence cost as compared to other factors that are correlated with these parameters? 4 Public Release; Distribution is 2

3 use Agenda Problem of Developing CERs Why Causation instead of Correlation Causal Modeling using DAGs Examples Call for Action and Collaboration 5 Why Traditional Correlation Falls Short Los Angeles Times May 12, Public Release; Distribution is 3

4 use Why Causal Modeling is a Game Changer 7 Causal Modeling Dr. Judea Pearl 8 Public Release; Distribution is 4

5 use Quotes by Judea Pearl I see no greater impediment to scientific progress than the prevailing practice of focusing all of our mathematical resources on probabilistic and statistical inferences while leaving causal considerations to the mercy of intuition and good judgment. Pearl, J. (2009). Causality. Cambridge university press. (Preface to 1 st Edition) The development of Bayesian Networks, so people tell me, marked a turning point in the way uncertainty is handled in computer systems. For me, this development was a stepping stone towards a more profound transition, from reasoning about beliefs to reasoning about causal and counterfactual relationships. Judea Pearl: From Bayesian Networks to Causal and Counterfactual Reasoning Keynote Lecture at the 2014 BayesiaLab User Conference Recorded on September 24, 2014, in Los Angeles. 9 Causal Modeling Dr. Stephen Morgan 10 Public Release; Distribution is 5

6 use CMU Causal Modeling Researchers CMU Causal Modeling Researchers Public Release; Distribution is 6

7 use Causal Inference with Directed Graphs Training 2-Day Seminar offered by Dr. Felix Elwert, Univ of Wisconsin Available through two channels: Statistical Horizons BayesiaLab 13 Agenda Problem of Developing CERs Why Causation instead of Correlation Causal Modeling using DAGs Examples Call for Action and Collaboration 14 Public Release; Distribution is 7

8 use Landscape of Causal Modeling Identity of true causal parameters of cost Raw Observational Data Statistical Discovery of Causal Relationships To create the DAG (CMU Faculty) Quantifying Causal Relations using DAG graph surgery and Instrumental Variables (Pearl & Elwert) 15 Use of Directed, Acyclic Graphs 1. Derive testable implications of a causal model to evaluate if the model is correct 2. Understand causal identification requirements to confirm whether causality may be extracted from the data Separating causal from spurious associations in the data 3. Inform use of traditional statistical techniques such as regression Deciding which control variables to include versus not to include in the analysis to achieve identification of causality 16 Public Release; Distribution is 8

9 use Basic Concepts of DAGs 1. DAGs consist of: a) nodes (variables), b) directed arrows (possible causal relationships ordered by time), and c) missing arrows (confident assumptions about absence of causal effects 2. DAGs are nonparametric a) No distributional assumptions b) Linear and/or nonlinear 3. DAGs have both causal paths and non-causal (spurious) paths 17 Three Structures Studied in a DAG 1. Indirect Connection 2. Common Cause 3. Common Effect (Collider) 18 Public Release; Distribution is 9

10 use Deriving Testable Implications of a DAG 1. Uses a technique called d-separation a) Algorithm to help determine which paths are causal versus noncausal b) Uses concept of blocking a path to stop transmission of noncausal association 2. Additional techniques employed include a) Graphical identification b) Adjustment Criterion c) Backdoor Criterion d) Frontdoor Criterion e) Pearl s do-calculus 19 Blocking or Adjusting Paths 1. Controlling a variable 2. Stratifying a variable 3. Setting evidence on a variable 4. Observing a variable 5. Matching a variable (eg making distributions of sub-populations as similar as possible for comparison) 20 Public Release; Distribution is 10

11 use Agenda Problem of Developing CERs Why Causation instead of Correlation Causal Modeling using DAGs Examples Call for Action and Collaboration 21 Example: Causality Modeling with BayesiaLab Excerpts taken from: 22 Public Release; Distribution is 11

12 use Public Release; Distribution is 12

13 use Public Release; Distribution is 13

14 use Public Release; Distribution is 14

15 use Public Release; Distribution is 15

16 use Public Release; Distribution is 16

17 use 33 Cost Estimation Example Use the CMU tool, Tetrad, to discover causal parameters in a data set containing a wide variety of factors deemed relevant to cost, or Hypothesize a set of factors related to cost, along with their hypothesized interrelationships, followed by causal modeling using Pearl graph surgery or instrumental variable analysis using Stata Factors may relate to existing cost parameters as well as factors related to new or emergent cost influences, such as Agile and DevOps 34 Public Release; Distribution is 17

18 use Agenda Problem of Developing CERs Why Causation instead of Correlation Causal Modeling using DAGs Examples Call for Action and Collaboration 35 Call for Action and Collaboration Causal modeling with observational data is practical Causal modeling informs which variables to include in experimental research You should consider building causal methodology into your CER development Practical methods and tooling now exist to discover (Tetrad) and model (Tetrad, Stata) causal relationships in data We (SEI) seek to partner with you in developing CERs by applying causal methods to your data 36 Public Release; Distribution is 18

19 use Contact Information Points of Contact SEMA Cost Estimation Research Group Robert Stoddard Mike Konrad U.S. Mail Software Engineering Institute Customer Relations 4500 Fifth Avenue Pittsburgh, PA , USA Web Customer Relations Telephone: SEI Phone: SEI Fax: Public Release; Distribution is 19

ARINC653 AADL Annex Update

ARINC653 AADL Annex Update ARINC653 AADL Annex Update Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Julien Delange AADL Meeting February 15 Report Documentation Page Form Approved OMB No. 0704-0188

More information

Software, Security, and Resiliency. Paul Nielsen SEI Director and CEO

Software, Security, and Resiliency. Paul Nielsen SEI Director and CEO Software, Security, and Resiliency Paul Nielsen SEI Director and CEO Dr. Paul D. Nielsen is the Director and CEO of Carnegie Mellon University's Software Engineering Institute. Under Dr. Nielsen s leadership,

More information

Advancing Cyber Intelligence Practices Through the SEI s Consortium

Advancing Cyber Intelligence Practices Through the SEI s Consortium Advancing Cyber Intelligence Practices Through the SEI s Consortium SEI Emerging Technology Center Jay McAllister Melissa Kasan Ludwick Copyright 2015 Carnegie Mellon University This material is based

More information

Prioritizing Alerts from Static Analysis with Classification Models

Prioritizing Alerts from Static Analysis with Classification Models Prioritizing Alerts from Static Analysis with Classification Models PI: Lori Flynn, PhD Team: Will Snavely, David Svoboda, Dr. David Zubrow, Bob Stoddard, Dr. Nathan VanHoudnos, Dr. Elli Kanal, Richard

More information

ARINC653 AADL Annex. Software Engineering Institute Carnegie Mellon University Pittsburgh, PA Julien Delange 07/08/2013

ARINC653 AADL Annex. Software Engineering Institute Carnegie Mellon University Pittsburgh, PA Julien Delange 07/08/2013 ARINC653 AADL Annex Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Julien Delange 07/08/2013 Context, Rationale ARINC653 Avionics standard Standardized API (called APEX

More information

Roles and Responsibilities on DevOps Adoption

Roles and Responsibilities on DevOps Adoption Roles and Responsibilities on DevOps Adoption Hasan Yasar Technical Manager, Adjunct Faculty Member Secure Lifecycle Solutions CERT SEI CMU Software Engineering Institute Carnegie Mellon University Pittsburgh,

More information

SEI/CMU Efforts on Assured Systems

SEI/CMU Efforts on Assured Systems Unclassified//For Official Use Only SEI/CMU Efforts on Assured Systems 15 November 2018 *** Greg Shannon CERT Division Chief Scientist Software Engineering Institute Carnegie Mellon University Pittsburgh,

More information

Software Assurance Education Overview

Software Assurance Education Overview Software Assurance Education Overview Nancy Mead June 2011 ABSTRACT: Complex software systems affect nearly every aspect of our lives, in areas such as defense, government, energy, communication, transportation,

More information

Fall 2014 SEI Research Review Verifying Evolving Software

Fall 2014 SEI Research Review Verifying Evolving Software Fall 2014 SEI Research Review Verifying Evolving Software Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Arie Gurfinkel October 28, 2014 Report Documentation Page Form Approved

More information

Passive Detection of Misbehaving Name Servers

Passive Detection of Misbehaving Name Servers Passive Detection of Misbehaving Name Servers Based on CMU/SEI-2013-TR-010 Jonathan Spring, Leigh Metcalf netsa-contact (AT) cert.org Flocon 2014, Charleston SC 2014 Carnegie Mellon University Copyright

More information

Model-Driven Verifying Compilation of Synchronous Distributed Applications

Model-Driven Verifying Compilation of Synchronous Distributed Applications Model-Driven Verifying Compilation of Synchronous Distributed Applications Sagar Chaki, James Edmondson October 1, 2014 MODELS 14, Valencia, Spain Copyright 2014 Carnegie Mellon University This material

More information

Julia Allen Principal Researcher, CERT Division

Julia Allen Principal Researcher, CERT Division Improving the Security and Resilience of U.S. Postal Service Mail Products and Services Using CERT -RMM (Case Study) Julia Allen Principal Researcher, CERT Division Julia Allen is a principal researcher

More information

Panel: Future of Cloud Computing

Panel: Future of Cloud Computing Panel: Future of Cloud Computing Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Grace Lewis Advanced Mobile Systems (AMS) Initiative July 9, 2014 Mobile Device Trends Smartphones

More information

Verifying Periodic Programs with Priority Inheritance Locks

Verifying Periodic Programs with Priority Inheritance Locks Verifying Periodic Programs with Priority Inheritance Locks Sagar Chaki, Arie Gurfinkel, Ofer Strichman FMCAD, October, 03 Software Engineering Institute, CMU Technion, Israel Institute of Technology Copyright

More information

Be Like Water: Applying Analytical Adaptability to Cyber Intelligence

Be Like Water: Applying Analytical Adaptability to Cyber Intelligence SESSION ID: HUM-W01 Be Like Water: Applying Analytical Adaptability to Cyber Intelligence Jay McAllister Senior Analyst Software Engineering Institute Carnegie Mellon University @sei_etc Scuttlebutt Communications

More information

Defining Computer Security Incident Response Teams

Defining Computer Security Incident Response Teams Defining Computer Security Incident Response Teams Robin Ruefle January 2007 ABSTRACT: A computer security incident response team (CSIRT) is a concrete organizational entity (i.e., one or more staff) that

More information

Analyzing 24 Years of CVD

Analyzing 24 Years of CVD public release and unlimited distribution. Allen Householder adh@cert.org Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Copyright. All Rights Reserved. This material is

More information

Investigating APT1. Software Engineering Institute Carnegie Mellon University Pittsburgh, PA Deana Shick and Angela Horneman

Investigating APT1. Software Engineering Institute Carnegie Mellon University Pittsburgh, PA Deana Shick and Angela Horneman Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Deana Shick and Angela Horneman Copyright 2013 Carnegie Mellon University This material is based upon work funded and supported

More information

Automated Provisioning of Cloud and Cloudlet Applications

Automated Provisioning of Cloud and Cloudlet Applications Automated Provisioning of Cloud and Cloudlet Applications Secure and Assured Mobile Computing Components Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Jeff Boleng, PhD

More information

Inference of Memory Bounds

Inference of Memory Bounds Research Review 2017 Will Klieber, software security researcher Joint work with Will Snavely public release and unlimited distribution. 1 Copyright 2017 Carnegie Mellon University. All Rights Reserved.

More information

The CERT Top 10 List for Winning the Battle Against Insider Threats

The CERT Top 10 List for Winning the Battle Against Insider Threats The CERT Top 10 List for Winning the Battle Against Insider Threats Dawn Cappelli CERT Insider Threat Center Software Engineering Institute Carnegie Mellon University Session ID: STAR-203 Session Classification:

More information

Modeling the Implementation of Stated-Based System Architectures

Modeling the Implementation of Stated-Based System Architectures Modeling the Implementation of Stated-Based System Architectures Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Peter H Feiler June 2009 Are Everywhere What is a state-based

More information

Design Pattern Recovery from Malware Binaries

Design Pattern Recovery from Malware Binaries Design Pattern Recovery from Malware Binaries Cory F. Cohen Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Copyright 2015 Carnegie Mellon University This material is based

More information

OSATE Analysis Support

OSATE Analysis Support OSATE Analysis Support Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Julien Delange/Peter Feiler 07/08/2013 Overview of OSATE2 Eclipse-based AADL editor Support for AADLv2.1,

More information

Providing Information Superiority to Small Tactical Units

Providing Information Superiority to Small Tactical Units Providing Information Superiority to Small Tactical Units Jeff Boleng, PhD Principal Member of the Technical Staff Software Solutions Conference 2015 November 16 18, 2015 Copyright 2015 Carnegie Mellon

More information

Engineering Improvement in Software Assurance: A Landscape Framework

Engineering Improvement in Software Assurance: A Landscape Framework Engineering Improvement in Software Assurance: A Landscape Framework Lisa Brownsword (presenter) Carol C. Woody, PhD Christopher J. Alberts Andrew P. Moore Agenda Terminology and Problem Scope Modeling

More information

Denial of Service Attacks

Denial of Service Attacks Denial of Service Attacks CERT Division http://www.sei.cmu.edu REV-03.18.2016.0 Copyright 2017 Carnegie Mellon University. All Rights Reserved. This material is based upon work funded and supported by

More information

Researching New Ways to Build a Cybersecurity Workforce

Researching New Ways to Build a Cybersecurity Workforce THE CISO ACADEMY Researching New Ways to Build a Cybersecurity Workforce Pamela D. Curtis, Summer Craze Fowler, David Tobar, and David Ulicne December 2016 Organizations across the world face the increasing

More information

Encounter Complexes For Clustering Network Flow

Encounter Complexes For Clustering Network Flow Encounter Complexes For Clustering Network Flow. Leigh Metcalf, lbmetcalf@cert.org Flocon 2015 Date 2015 Carnegie Mellon University Copyright 2014 Carnegie Mellon University This material is based upon

More information

Flow Analysis for Network Situational Awareness. Tim Shimeall January Carnegie Mellon University

Flow Analysis for Network Situational Awareness. Tim Shimeall January Carnegie Mellon University Flow Analysis for Network Situational Awareness Tim Shimeall January 2010 NO WARRANTY THIS MATERIAL OF CARNEGIE MELLON UNIVERSITY AND ITS SOFTWARE ENGINEERING INSTITUTE IS FURNISHED ON AN AS-IS" BASIS.

More information

Cyber Hygiene: A Baseline Set of Practices

Cyber Hygiene: A Baseline Set of Practices [DISTRIBUTION STATEMENT A] Approved for public Cyber Hygiene: A Baseline Set of Practices Matt Trevors Charles M. Wallen Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Copyright

More information

Cyber Threat Prioritization

Cyber Threat Prioritization Cyber Threat Prioritization FSSCC Threat and Vulnerability Assessment Committee Jay McAllister Report Documentation Page Form Approved OMB No. 0704-0188 Public reporting burden for the collection of information

More information

Smart Grid Maturity Model

Smart Grid Maturity Model Smart Grid Maturity Model Austin Montgomery Software Engineering Institute Carnegie Mellon University Software Engineering Institute Carnegie Mellon University 2 SEI is a federally-funded research and

More information

Evaluating and Improving Cybersecurity Capabilities of the Electricity Critical Infrastructure

Evaluating and Improving Cybersecurity Capabilities of the Electricity Critical Infrastructure Evaluating and Improving Cybersecurity Capabilities of the Electricity Critical Infrastructure March 2015 Pamela Curtis Dr. Nader Mehravari Katie Stewart Cyber Risk and Resilience Management Team CERT

More information

Foundations for Summarizing and Learning Latent Structure in Video

Foundations for Summarizing and Learning Latent Structure in Video Foundations for Summarizing and Learning Latent Structure in Video Presenter: Kevin Pitstick, MTS Engineer PI: Ed Morris, MTS Senior Engineer Copyright 2017 Carnegie Mellon University. All Rights Reserved.

More information

Information Security Is a Business

Information Security Is a Business Information Security Is a Business Continuity Issue: Are You Ready? Dr. Nader Mehravari Cyber Risk and Resilience Management Team CERT Division Software Engineering Institute Carnegie Mellon University

More information

Using DidFail to Analyze Flow of Sensitive Information in Sets of Android Apps

Using DidFail to Analyze Flow of Sensitive Information in Sets of Android Apps Using DidFail to Analyze Flow of Sensitive Information in Sets of Android Apps Will Klieber*, Lori Flynn*, Amar Bhosale, Limin Jia, and Lujo Bauer *presenting June 2015 Copyright 2015 Carnegie Mellon University

More information

Situational Awareness Metrics from Flow and Other Data Sources

Situational Awareness Metrics from Flow and Other Data Sources Situational Awareness Metrics from Flow and Other Data Sources SEI CERT NetSA 2011 Carnegie Mellon University NO WARRANTY THIS MATERIAL OF CARNEGIE MELLON UNIVERSITY AND ITS SOFTWARE ENGINEERING INSTITUTE

More information

Static Analysis Alert Audits Lexicon And Rules David Svoboda, CERT Lori Flynn, CERT Presenter: Will Snavely, CERT

Static Analysis Alert Audits Lexicon And Rules David Svoboda, CERT Lori Flynn, CERT Presenter: Will Snavely, CERT Static Analysis Alert Audits Lexicon And Rules David Svoboda, CERT Lori Flynn, CERT Presenter: Will Snavely, CERT Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 2016 Carnegie

More information

Model-Driven Verifying Compilation of Synchronous Distributed Applications

Model-Driven Verifying Compilation of Synchronous Distributed Applications Model-Driven Verifying Compilation of Synchronous Distributed Applications Sagar Chaki, James Edmondson October 1, 2014 MODELS 14, Valencia, Spain Report Documentation Page Form Approved OMB No. 0704-0188

More information

2013 US State of Cybercrime Survey

2013 US State of Cybercrime Survey 2013 US State of Cybercrime Survey Unknown How 24 % Bad is the Insider Threat? Insiders 51% 2007-2013 Carnegie Mellon University Report Documentation Page Form Approved OMB No. 0704-0188 Public reporting

More information

10 Years of FloCon. Prepared for FloCon George Warnagiris - CERT/CC #GeoWarnagiris Carnegie Mellon University

10 Years of FloCon. Prepared for FloCon George Warnagiris - CERT/CC #GeoWarnagiris Carnegie Mellon University 10 Years of FloCon Prepared for FloCon 2014 George Warnagiris - CERT/CC gwarnagi@cert.org #GeoWarnagiris 2014 Carnegie Mellon University Disclaimer NO WARRANTY THIS MATERIAL OF CARNEGIE MELLON UNIVERSITY

More information

Cloud Computing. Grace A. Lewis Research, Technology and Systems Solutions (RTSS) Program System of Systems Practice (SoSP) Initiative

Cloud Computing. Grace A. Lewis Research, Technology and Systems Solutions (RTSS) Program System of Systems Practice (SoSP) Initiative Grace A. Lewis Research, Technology and Systems Solutions (RTSS) Program System of Systems Practice (SoSP) Initiative SEI Webinar November 12, 2009 Polling Question 1 How did you hear about this webinar?

More information

Collaborative Autonomy with Group Autonomy for Mobile Systems (GAMS)

Collaborative Autonomy with Group Autonomy for Mobile Systems (GAMS) Collaborative Autonomy with Group Autonomy for Mobile Systems (GAMS) Presenter: (jredmondson@sei.cmu.edu) Date: August 19, 2014 Copyright 2014 Carnegie Mellon University This material is based upon work

More information

Goal-Based Assessment for the Cybersecurity of Critical Infrastructure

Goal-Based Assessment for the Cybersecurity of Critical Infrastructure Goal-Based Assessment for the Cybersecurity of Critical Infrastructure IEEE HST 2010 November 10, 2010 NO WARRANTY THIS MATERIAL OF CARNEGIE MELLON UNIVERSITY AND ITS SOFTWARE ENGINEERING INSTITUTE IS

More information

Report Writer and Security Requirements Finder: User and Admin Manuals

Report Writer and Security Requirements Finder: User and Admin Manuals Report Writer and Security Requirements Finder: User and Admin Manuals Nancy R. Mead CMU MSE Studio Team Sankalp Anand Anurag Gupta Swati Priyam Yaobin Wen Walid El Baroni June 2016 SPECIAL REPORT CMU/SEI-2016-SR-002

More information

Components and Considerations in Building an Insider Threat Program

Components and Considerations in Building an Insider Threat Program Components and Considerations in Building an Insider Threat Program Carly Huth Insider Threat Researcher, CEWM Carly L. Huth is an insider threat researcher in the Cyber Enterprise and Workforce Management

More information

Open Systems: What s Old Is New Again

Open Systems: What s Old Is New Again Open Systems: What s Old Is New Again Tricia Oberndorf & Dr. Carol Sledge NO WARRANTY THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN AS-IS" BASIS. CARNEGIE

More information

Semantic Importance Sampling for Statistical Model Checking

Semantic Importance Sampling for Statistical Model Checking Semantic Importance Sampling for Statistical Model Checking Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Jeffery Hansen, Lutz Wrage, Sagar Chaki, Dionisio de Niz, Mark

More information

Measuring the Software Security Requirements Engineering Process

Measuring the Software Security Requirements Engineering Process Measuring the Software Security Requirements Engineering Process Nancy Mead July 2012 ABSTRACT: Although there has been much research work in security requirements engineering, we do not have adequate

More information

Effecting Large-Scale Adaptive Swarms Through Intelligent Collaboration (ELASTIC)

Effecting Large-Scale Adaptive Swarms Through Intelligent Collaboration (ELASTIC) Effecting Large-Scale Adaptive Swarms Through Intelligent Collaboration (ELASTIC) James Edmondson Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Copyright 2015 Carnegie

More information

Using CERT-RMM in a Software and System Assurance Context

Using CERT-RMM in a Software and System Assurance Context Using CERT-RMM in a Software and System Assurance Context Julia Allen SEPG NA 2011 24 March 2011 Agenda What is the CERT Resilience Management Model (CERT-RMM)? Model Building Blocks CERT-RMM for Assurance

More information

The Need for Operational and Cyber Resilience in Transportation Systems

The Need for Operational and Cyber Resilience in Transportation Systems The Need for Operational and Cyber Resilience in Transportation Systems January 14, 2016 Dr. Nader Mehravari, MBCP, MBCI Cyber Risk and Resilience Management Software Engineering Institute Software Carnegie

More information

Current Threat Environment

Current Threat Environment Current Threat Environment Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213, PhD Technical Director, CERT mssherman@sei.cmu.edu 29-Aug-2014 Report Documentation Page Form

More information

Improving Software Assurance 1

Improving Software Assurance 1 Improving Software Assurance 1 Carol Woody Robert J. Ellison April 2010 ABSTRACT: Software assurance objectives include reducing the likelihood of vulnerabilities such as those on a Top 25 Common Weakness

More information

Introduction to DAGs Directed Acyclic Graphs

Introduction to DAGs Directed Acyclic Graphs Introduction to DAGs Directed Acyclic Graphs Metalund and SIMSAM EarlyLife Seminar, 22 March 2013 Jonas Björk (Fleischer & Diez Roux 2008) E-mail: Jonas.Bjork@skane.se Introduction to DAGs Basic terminology

More information

Fall 2014 SEI Research Review FY14-03 Software Assurance Engineering

Fall 2014 SEI Research Review FY14-03 Software Assurance Engineering Fall 2014 SEI Research Review FY14-03 Software Assurance Engineering Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Carol Woody, Ph.D. October 28, 2014 Report Documentation

More information

NO WARRANTY. Use of any trademarks in this presentation is not intended in any way to infringe on the rights of the trademark holder.

NO WARRANTY. Use of any trademarks in this presentation is not intended in any way to infringe on the rights of the trademark holder. NO WARRANTY THIS MATERIAL OF CARNEGIE MELLON UNIVERSITY AND ITS SOFTWARE ENGINEERING INSTITUTE IS FURNISHED ON AN AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED

More information

COTS Multicore Processors in Avionics Systems: Challenges and Solutions

COTS Multicore Processors in Avionics Systems: Challenges and Solutions COTS Multicore Processors in Avionics Systems: Challenges and Solutions Dionisio de Niz Bjorn Andersson and Lutz Wrage dionisio@sei.cmu.edu, baandersson@sei.cmu.edu, lwrage@sei.cmu.edu Report Documentation

More information

Dr. Kenneth E. Nidiffer Director of Strategic Plans for Government Programs

Dr. Kenneth E. Nidiffer Director of Strategic Plans for Government Programs War Fighting Technologies: Enhance Advance - Modernize: -Technological/Acquisition Advances Enabling a More Responsive 24th Anniversary - Systems & Software Technology Conference April 23-26, 2012 Salt

More information

Architectural Implications of Cloud Computing

Architectural Implications of Cloud Computing Architectural Implications of Cloud Computing Grace Lewis Research, Technology and Systems Solutions (RTSS) Program Lewis is a senior member of the technical staff at the SEI in the Research, Technology,

More information

Pharos Static Analysis Framework

Pharos Static Analysis Framework Pharos Static Analysis Framework Cory F. Cohen Senior Malware Analysis Researcher cfc@cert.org [DISTRIBUTION 2017 Carnegie Mellon STATEMENT University A] This 1 [DISTRIBUTION release and unlimited STATEMENT

More information

TUNISIA CSIRT CASE STUDY

TUNISIA CSIRT CASE STUDY TUNISIA CSIRT CASE STUDY The CSIRT Development and Training team has published this case study part of a series of case studies to assist CSIRTs in getting started and improving their performance. Introduction

More information

Biological Material Transfer Agreement. between (PROVIDER) and. Date: A. Specific Terms of Agreement (Implementing Section)

Biological Material Transfer Agreement. between (PROVIDER) and. Date: A. Specific Terms of Agreement (Implementing Section) Biological Material Transfer Agreement between (PROVIDER) and (RECIPIENT) regarding (ORIGINAL MATERIAL). A. Specific Terms of Agreement (Implementing Section) I. ORIGINAL MATERIAL: II. PROVIDER of the

More information

Cloud Computing. Grace A. Lewis Research, Technology and Systems Solutions (RTSS) Program System of Systems Practice (SoSP) Initiative

Cloud Computing. Grace A. Lewis Research, Technology and Systems Solutions (RTSS) Program System of Systems Practice (SoSP) Initiative Grace A. Lewis Research, Technology and Systems Solutions (RTSS) Program System of Systems Practice (SoSP) Initiative SEI Webinar November 12, 2009 Report Documentation Page Form Approved OMB No. 0704-0188

More information

The Insider Threat Center: Thwarting the Evil Insider

The Insider Threat Center: Thwarting the Evil Insider The Insider Threat Center: Thwarting the Evil Insider The CERT Top 10 List for Winning the Battle Against Insider Threats Randy Trzeciak 14 June 2012 2007-2012 Carnegie Mellon University Notices 2011 Carnegie

More information

Secure Coding Initiative

Secure Coding Initiative Secure Coding Initiative Robert C. Seacord 2010 Carnegie Mellon University NO WARRANTY THIS MATERIAL OF CARNEGIE MELLON UNIVERSITY AND ITS SOFTWARE ENGINEERING INSTITUTE IS FURNISHED ON AN AS-IS" BASIS.

More information

Engineering High- Assurance Software for Distributed Adaptive Real- Time Systems

Engineering High- Assurance Software for Distributed Adaptive Real- Time Systems Engineering High- Assurance Software for Distributed Adaptive Real- Time Systems Sagar Chaki, Dionisio de Niz, Mark Klein Software Solutions Conference 2015 November 16 18, 2015 Copyright 2015 Carnegie

More information

Integrating the Risk Management Framework (RMF) with DevOps

Integrating the Risk Management Framework (RMF) with DevOps Integrating the Risk Management Framework (RMF) with DevOps March 2018 Timothy A. Chick Security Automation Systems Technical Manager Software Engineering Institute Carnegie Mellon University Pittsburgh,

More information

SEI Research Program. Dr. Kevin Fall Deputy Director, Research, and CTO SSC Carnegie Mellon University

SEI Research Program. Dr. Kevin Fall Deputy Director, Research, and CTO SSC Carnegie Mellon University Deputy Director, Research, and CTO kfall@sei.cmu.edu A DoD federally funded research and development center (FFRDC) at Carnegie Mellon University founded in 1984 Only DoD R&D center focused on software

More information

Modeling, Verifying, and Generating Software for Distributed Cyber- Physical Systems using DMPL and AADL

Modeling, Verifying, and Generating Software for Distributed Cyber- Physical Systems using DMPL and AADL Modeling, Verifying, and Generating Software for Distributed Cyber- Physical Systems using DMPL and AADL Sagar Chaki, Dionisio de Niz, Joseph Seibel Software Engineering Institute Carnegie Mellon University

More information

DOS AND DON'TS OF DEVSECOPS

DOS AND DON'TS OF DEVSECOPS SESSION ID: DEV-F01 DOS AND DON'TS OF DEVSECOPS Hasan Yasar Technical Manager, Adjunct Faculty Member CERT Software Engineering Institute Carnegie Mellon University @SecureLifeCycle Notices Copyright 2018

More information

GraphBLAS: A Programming Specification for Graph Analysis

GraphBLAS: A Programming Specification for Graph Analysis GraphBLAS: A Programming Specification for Graph Analysis Scott McMillan, PhD GraphBLAS: A Programming A Specification for Graph Analysis 2016 October Carnegie 26, Mellon 2016University 1 Copyright 2016

More information

An Incident Management Ontology

An Incident Management Ontology An Incident Management Ontology Presenter - Samuel Perl Co-Authors - David Mundie, Robin Ruefle, Audrey Dorofee, Matthew Collins, John McCloud 2014 Carnegie Mellon University Copyright 2014 Carnegie Mellon

More information

Causal Models for Scientific Discovery

Causal Models for Scientific Discovery Causal Models for Scientific Discovery Research Challenges and Opportunities David Jensen College of Information and Computer Sciences Computational Social Science Institute Center for Data Science University

More information

Elements of a Usability Reasoning Framework

Elements of a Usability Reasoning Framework Elements of a Usability Reasoning Framework Jinhee Lee Len Bass September 2005 Software Architecture Technology Initiative Unlimited distribution subject to the copyright. Technical Note CMU/SEI-2005-TN-030

More information

Five Keys to Agile Test Automation for Government Programs

Five Keys to Agile Test Automation for Government Programs Five Keys to Agile Test Automation for Government Programs Robert Binder and Suzanne Miller Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 approved for public [DISTRIBUTION

More information

Carnegie Mellon University Notice

Carnegie Mellon University Notice Carnegie Mellon University Notice This video and all related information and materials ( materials ) are owned by Carnegie Mellon University. These materials are provided on an as-is as available basis

More information

The Priority Ceiling Protocol: A Method for Minimizing the Blocking of High-Priority Ada Tasks

The Priority Ceiling Protocol: A Method for Minimizing the Blocking of High-Priority Ada Tasks Special Report CMU/SEI-88-SR-4 The Priority Ceiling Protocol: A Method for Minimizing the Blocking of High-Priority Ada Tasks John B. Goodenough Lui Sha March 1988 Special Report CMU/SEI-88-SR-4 March

More information

Hands-On Graphical Causal Modeling Using R

Hands-On Graphical Causal Modeling Using R Hands-On Graphical Causal Modeling Using R Johannes Textor March 11, 2016 Graphs and paths Model testing Model equivalence Causality theory A causality theory provides a language to encode causal relationships.

More information

NISPOM Change 2: Considerations for Building an Effective Insider Threat Program

NISPOM Change 2: Considerations for Building an Effective Insider Threat Program NISPOM Change 2: Considerations for Building an Effective Insider Threat Program Randall Trzeciak (rft@cert.org) July 7, 2016 Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213

More information

Netflow in Daily Information Security Operations

Netflow in Daily Information Security Operations Netflow in Daily Information Security Operations Mike Pochan Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Copyright 2016 Carnegie Mellon University This material is based

More information

SEI Webinar Series. Software Engineering Institute Carnegie Mellon University Pittsburgh, PA January 27, Carnegie Mellon University

SEI Webinar Series. Software Engineering Institute Carnegie Mellon University Pittsburgh, PA January 27, Carnegie Mellon University Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Report Documentation Page Form Approved OMB No. 0704-0188 Public reporting burden for the collection of information is estimated

More information

Automated Code Generation for High-Performance, Future-Compatible Graph Libraries

Automated Code Generation for High-Performance, Future-Compatible Graph Libraries Research Review 2017 Automated Code Generation for High-Performance, Future-Compatible Graph Libraries Dr. Scott McMillan, Senior Research Scientist CMU PI: Prof. Franz Franchetti, ECE 2017 Carnegie Mellon

More information

INCLUDING MEDICAL ADVICE DISCLAIMER

INCLUDING MEDICAL ADVICE DISCLAIMER Jordan s Guardian Angels Terms and Conditions of Use INCLUDING MEDICAL ADVICE DISCLAIMER Your use of this website and its content constitutes your agreement to be bound by these terms and conditions of

More information

The Confluence of Physical and Cyber Security Management

The Confluence of Physical and Cyber Security Management The Confluence of Physical and Cyber Security Management GOVSEC 2009 Samuel A Merrell, CISSP James F. Stevens, CISSP 2009 Carnegie Mellon University Today s Agenda: Introduction Risk Management Concepts

More information

Time-Bounded Analysis of Real- Time Systems

Time-Bounded Analysis of Real- Time Systems Time-Bounded Analysis of Real- Time Systems Sagar Chaki 1, Arie Gurfinkel 1, Ofer Strichman 2, Soonho Kong 1 1 Software Engineering Institute, CMU 2 Technion, Israel Institute of Technology NO WARRANTY

More information

TSP Secure. Software Engineering Institute Carnegie Mellon University Pittsburgh, PA September 2009

TSP Secure. Software Engineering Institute Carnegie Mellon University Pittsburgh, PA September 2009 TSP Secure Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Noopur Davis, Philip L. Miller, William R. Nichols, and Robert C. Seacord 23 September 2009 2008 Carnegie Mellon

More information

Bridging The Gap Between Industry And Academia

Bridging The Gap Between Industry And Academia Bridging The Gap Between Industry And Academia 14 th Annual Security & Compliance Summit Anaheim, CA Dilhan N Rodrigo Managing Director-Smart Grid Information Trust Institute/CREDC University of Illinois

More information

EXPLORING CAUSAL RELATIONS IN DATA MINING BY USING DIRECTED ACYCLIC GRAPHS (DAG)

EXPLORING CAUSAL RELATIONS IN DATA MINING BY USING DIRECTED ACYCLIC GRAPHS (DAG) EXPLORING CAUSAL RELATIONS IN DATA MINING BY USING DIRECTED ACYCLIC GRAPHS (DAG) KRISHNA MURTHY INUMULA Associate Professor, Symbiosis Institute of International Business [SIIB], Symbiosis International

More information

Strip Plots: A Simple Automated Time-Series Visualization

Strip Plots: A Simple Automated Time-Series Visualization Strip Plots: A Simple Automated Time-Series Visualization Sid Faber sfaber@cert.org Overview Motivation & Goals Sample Output The Basics Special Features 2 NO WARRANTY THIS MATERIAL OF CARNEGIE MELLON

More information

SAME Standard Package Installation Guide

SAME Standard Package Installation Guide Special Report CMU/SEI-89-SR-5 May 1989 SAME Standard Package Installation Guide Marc H. Graham May 1989 Special Report CMU/SEI-89-SR-5 May 1989 SAME Standard Package Installation Guide Marc H. Graham

More information

Well There s Your Problem: Isolating the Crash-Inducing Bits in a Fuzzed File

Well There s Your Problem: Isolating the Crash-Inducing Bits in a Fuzzed File Well There s Your Problem: Isolating the Crash-Inducing Bits in a Fuzzed File Allen D. Householder October 2012 TECHNICAL NOTE CMU/SEI-2012-TN-012 CERT Program http://www.sei.cmu.edu Copyright 2012 Carnegie

More information

ALAMO: Automatic Learning of Algebraic Models for Optimization

ALAMO: Automatic Learning of Algebraic Models for Optimization ALAMO: Automatic Learning of Algebraic Models for Optimization Alison Cozad 1,2, Nick Sahinidis 1,2, David Miller 2 1 National Energy Technology Laboratory, Pittsburgh, PA,USA 2 Department of Chemical

More information

Strengthening Ties Between Process and Security

Strengthening Ties Between Process and Security Strengthening Ties Between Process and Security Carol Woody August 2008 ABSTRACT: A growing recognition of the importance of security throughout the life cycle has led to new initiatives strengthening

More information

Node Aggregation for Distributed Inference in Bayesian Networks

Node Aggregation for Distributed Inference in Bayesian Networks Node Aggregation for Distributed Inference in Bayesian Networks Kuo-Chu Chang and Robert Fung Advanced Decision Systmes 1500 Plymouth Street Mountain View, California 94043-1230 Abstract This study describes

More information

Graphical Models and Markov Blankets

Graphical Models and Markov Blankets Stephan Stahlschmidt Ladislaus von Bortkiewicz Chair of Statistics C.A.S.E. Center for Applied Statistics and Economics Humboldt-Universität zu Berlin Motivation 1-1 Why Graphical Models? Illustration

More information

FUZZY LOGIC WITH ENGINEERING APPLICATIONS

FUZZY LOGIC WITH ENGINEERING APPLICATIONS FUZZY LOGIC WITH ENGINEERING APPLICATIONS Third Edition Timothy J. Ross University of New Mexico, USA A John Wiley and Sons, Ltd., Publication FUZZY LOGIC WITH ENGINEERING APPLICATIONS Third Edition FUZZY

More information

Site Impact Policies for Website Use

Site Impact Policies for Website Use Site Impact Policies for Website Use Thank you for visiting the Site Impact website (the Website ). We have set up some ground rules to ensure protection of our rights and yours. Site Impact reserves the

More information

Ordering attributes for missing values prediction and data classification

Ordering attributes for missing values prediction and data classification Ordering attributes for missing values prediction and data classification E. R. Hruschka Jr., N. F. F. Ebecken COPPE /Federal University of Rio de Janeiro, Brazil. Abstract This work shows the application

More information