Abstract: A decision engine includes: a genetic algorithm framework including a knowledge base of standard configurations, a candidate selector generator and a selector to select a candidate configuration from a plurality of preferred standard configurations in response to the candidate selector generator; a parallelized reasoning framework including an attack surface reasoning algorithm module to compute the security and cost tradeoffs of an attack surface associated with each candidate configuration; and a user interface framework including a web service engine where users can interact and provide feedback on direction of an evolution used in a genetic algorithm search for evolving defenses.

Abstract: A decision engine includes: a genetic algorithm framework including a knowledge base of standard configurations, a candidate selector generator and a selector to select a candidate configuration from a plurality of preferred standard configurations in response to the candidate selector generator; a parallelized reasoning framework including an attack surface reasoning algorithm module to compute the security and cost tradeoffs of an attack surface associated with each candidate configuration; and a user interface framework including a web service engine where users can interact and provide feedback on direction of an evolution used in a genetic algorithm search for evolving defenses.

Abstract: A decision engine includes: a genetic algorithm framework including a knowledge base of standard configurations, a candidate selector generator and a selector to select a candidate configuration from a plurality of preferred standard configurations in response to the candidate selector generator; a parallelized reasoning framework including an attack surface reasoning algorithm module to compute the security and cost tradeoffs of an attack surface associated with each candidate configuration; and a user interface framework including a web service engine where users can interact and provide feedback on direction of an evolution used in a genetic algorithm search for evolving defenses.

Abstract: A decision engine includes: a genetic algorithm framework including a knowledge base of standard configurations, a candidate selector generator and a selector to select a candidate configuration from a plurality of preferred standard configurations in response to the candidate selector generator; a parallelized reasoning framework including an attack surface reasoning algorithm module to compute the security and cost tradeoffs of an attack surface associated with each candidate configuration; and a user interface framework including a web service engine where users can interact and provide feedback on direction of an evolution used in a genetic algorithm search for evolving defenses.

Abstract: Methods and systems for performing security functions in a service-oriented computer system are provided. The method includes acts of receiving, from one or more entities, a service request for a service provided by one or more server computers adapted to process the service request; providing a copy of the service request to a processor adapted to analyze the copy of the service request; storing the service request in a memory; determining, by the processor, if the service request should be processed by performing one or more analyzes of the copy of the service request to determine if the service request would be harmful to the one or more server computers; and if it is determined that the service request should be processed by the one or more server computers, forwarding the service request to the one or more server computers.

Abstract: A decision engine includes: a genetic algorithm framework including a knowledge base of standard configurations, a candidate selector generator and a selector to select a candidate configuration from a plurality of preferred standard configurations in response to the candidate selector generator; a parallelized reasoning framework including an attack surface reasoning algorithm module to compute the security and cost tradeoffs of an attack surface associated with each candidate configuration; and a user interface framework including a web service engine where users can interact and provide feedback on direction of an evolution used in a genetic algorithm search for evolving defenses.

Abstract: A decision engine includes: a genetic algorithm framework including a knowledge base of standard configurations, a candidate selector generator and a selector to select a candidate configuration from a plurality of preferred standard configurations in response to the candidate selector generator; a parallelized reasoning framework including an attack surface reasoning algorithm module to compute the security and cost tradeoffs of an attack surface associated with each candidate configuration; and a user interface framework including a web service engine where users can interact and provide feedback on direction of an evolution used in a genetic algorithm search for evolving defenses.

Abstract: Methods and systems for performing security functions in a service-oriented computer system are provided. The method includes acts of receiving, from one or more entities, a service request for a service provided by one or more server computers adapted to process the service request; providing a copy of the service request to a processor adapted to analyze the copy of the service request; storing the service request in a memory; determining, by the processor, if the service request should be processed by performing one or more analyses of the copy of the service request to determine if the service request would be harmful to the one or more server computers; and if it is determined that the service request should be processed by the one or more server computers, forwarding the service request to the one or more server computers.

Abstract: An architecture is provided for protecting service-level entities. Such an architecture may escrow service requests prior to forwarding the requests to the service, and checking may be performed prior to releasing the request to the service. A crumple zone (CZ) architecture may be provided that buffers incoming service requests and may intercept attacks and/or sustain damage in lieu of the services being protected. The CZ may include an outward interface that is accessed by other entities, and the underlying service is not accessed directly. Elements of the CZ receive service requests, analyze them, and determine whether they can be safely executed by the underlying service.

Abstract: An architecture is provided for protecting service-level entities. Such an architecture may escrow service requests prior to forwarding the requests to the service, and checking may be performed prior to releasing the request to the service. A crumple zone (CZ) architecture may be provided that buffers incoming service requests and may intercept attacks and/or sustain damage in lieu of the services being protected. The CZ may include an outward interface that is accessed by other entities, and the underlying service is not accessed directly. Elements of the CZ receive service requests, analyze them, and determine whether they can be safely executed by the underlying service.