Dissertation Proposal: Evolving Robust Software

The ability of living systems to maintain functionality across a wide range of environments and to adapt to new environments is unmatched by man-made systems. A great deal is known about the relationship between robustness and evolvability in living systems. This section reviews the basics of this field of study highlighting particularly relevant elements of this large body of work.

Living systems include both a genotype and a phenotype. The genotype is the genetic information which specifies a living organism. The resulting organism and its interaction with the world is the organism's phenotype.

Both the genetic and phenomenal realms have associated types of robustness. Genetic robustness, or mutational robustness, is the ability of a genotype to consistently produce the same phenotype in the face of perturbations to its genetic material. This robustness can be achieved in different ways and on different levels. At the lowest level, important amino acids are over represented in the space of possible encodings and similar codings give rise to similar amino acids knight1999selection. At higher levels, vital functions are often degenerate (i.e., supported by diverse partially redundant systems) edelman2001degeneracy e.g., in the nervous system no two neurons are equivalent but no single neuron is necessary. Finally, many mechanisms have evolved that buffer changes, e.g., metabolic pathways whose outputs are stable over wide ranges of inputs wagner2005robustness.

Many of the biological mechanisms responsible for mutational robustness also contribute to environmental robustness lenski2006balancing, or the ability of a phenotype to maintain its behavior in the face of environmental perturbations. There is a strong correlation between genetic and environmental robustness, likely because both types of robustness are effects of the robustness inherent in underlying biological mechanisms kitano2004biological.

Mutational robustness appears to be an evolved feature ciliberti2007robustness, wilke01, that is, evolution tends to increase the mutational robustness of important biological components. Although it is unlikely that mutational robustness is explicitly selected for as a protection against mutation (due to the low mutation rates in most populations), it seems likely that it arises as a side-effect of evolution for environmental robustness van1999neutral..

The interplay between mutational robustness and evolution has many facets. On its face, mutational robustness inhibits evolution by making it less likely that any given genetic modification will have phenotypic effects. While true in the extreme, moderate levels of mutational robustness increase the genetic diversity of populations enabling evolution wagner2008robustness.

A mutationally robust organism has many genotypes that map to the same phenotype. Consider the space of genotypes to be a high-dimensional discrete space in which each point is a genotype, and the immediate neighbors of each point are the genotypes that are reachable through a single mutation. Regions of this space constituting genotypes with the same fitness are called neutral spaces. Populations tend to spread out in large neutral spaces via drift, accruing variety and novel genetic material. This accrued genetic material is hypothesized to play an important role in evolutionary innovation ciliberti2007innovation, wagner2008neutralism, meyers2005potential, ofria2008gradual, and provides the genetic fodder for large evolutionary changes.

Some of the properties of evolution mentioned above (e.g., ofria2008gradual) are not based on direct observation of biological systems, but rather on computational models of biological systems#holland1962outline. The evolutionary time frames and the degree of environmental controls required for such experiments are simply not experimentally achievable with biological systems. In digital evolution computational models of evolving populations represent genotypes using specialized assembly languages in environments in which their execution (phenotype) determines their reproduction or extinction ofria2004avida.

In addition to illuminating evolution in biological systems, this work has generated insight into those properties of programming languages that might be amenable to evolution ofria2002design. Although the languages (or "chemistries") studied in these computational environments are far from traditional programming languages, some insights do transfer, such as the brittleness of absolute versus symbolic addressing. Work in the virus community vb-darwin-in-machine has produced similar claims about the evolvability of traditional X86 assembly code. One of the contributions of this proposed research will be to confirm some of these claims and intuitions and to disprove others.

The evolution of computer programs in a process mimicking natural selection is known as Genetic Programming (GP) holland1992adaptation, koza1992genetic, and has been applied to a number of real world problems \cite[Chapter 12]{poli2008field}. GP languages are often much simpler than those used by human programmers and rarely resemble regular programming languages, although in some cases machine code has been evolved directly kuhling2002brute.

Recently, GP techniques have been applied to the repair of extant real world programs weimer2009automatically. This proposed research extends this work, incorporating new program representations and applications of evolution to program modification and synthesis within traditional software development environments and programming languages.

This proposed research can be seen as part of a larger trend in Software Engineering to emphasize acceptable performance over formal correctness. I review recent work in this area, and highlight the tools and metrics most applicable to our proposed work.

In failure oblivious computing rinard2004enhancing common memory errors such as out-of-bounds reads and writes are ignored, or handled in unsound ways which are often sufficient to continue operating. Examples of such techniques include wrapping out-of-bounds memory references modulo the available memory address range, treating memory as a hash table in which addresses are merely keys, creating new entries when needed, and returning random values from reads from uninitialized memory. By preventing common errors such as buffer overruns these techniques have been shown to increase the security and reliability of some software systems. In many cases security and reliability may be more important than correctness.

Beal and Sussman take a similar approach proposing a system for increasing the robustness of software by pre-processing program inputs bealengineered. Under the assumption that most software operates on only a sparse subset of the possible inputs, they propose a system for replacing aberrant or unexpected inputs with fabricated inputs remembered from previous normal operation. This system of input "hallucination", is shown to improve the robustness of a simple character recognition system.

While the previous systems learn and enforce invariants on program input, the clearview system perkins2009automatically learns invariants on trace data extracted from a running binary using Daikon ernst2007daikon. When these invariants are violated by an attack, bug or an exploit, the system automatically applies an invariant-preserving patch to the running binary which ensures continued execution. This technique was evaluated against a hostile red-team and was able to successfully repair seven out of ten of the red team's attacks perkins2009automatically.

All of the approaches mentioned above are applied to executing software systems or software phenotypes. There are also techniques which apply to the pre-compiled software source-code, or genotype. One such technique is loop-perforation misailovic2011probabilistically and dynamic knobs hoffmann2010power. In loop-perforation software is compiled to a simple intermediate representation (IR), looping constructs are found in this IR and modified execute the loop fewer times by e.g., skipping every nth loop execution. This technique can be used to reduce energy and runtime costs of software while maintaining probabilistic bounds of expected correctness. This work is notable for introducing program transformations that are not formally correct but are rather predictably probabilistically accurate.

Another important class of program transformation techniques, and the topic of much of this proposed work, includes methods of evolutionary program repair and optimization weimer2009automatically, genprog-tse-journal, white2011evolutionary. These approaches apply Evolutionary Computation (EC) techniques to the source code of existing software projects. Test suite based fitness functions are used to evaluate the effects of program transformations, allowing a much larger range of program modification than traditional formally provably semantic-preserving transformations.

For decades the mutation testing community has used extant program test suites to evaluate program mutants. Although their techniques closely resemble those discussed herein, their motivations and interpretation are very different. Under the mutation testing paradigm, test suites are evaluated by their ability to detect automatically generated program mutants jia2010analysis. This presumes that all program mutants are either buggy or equivalent to the original program — the detection of equivalent programs is a significant open problem for the mutation testing community budd1982two. By contrast my proposed work will seek to exploit neutral and beneficial variation in program mutants for use in software development and maintenance.

Let "syntax space" be a space of the text of program source code, and let "semantic space" be a space of the functionality of program behavior. Compilation (with a set compiler and flags) will then be a function from syntax space to semantic space. Given a program we apply syntactic mutations and observe the semantics of the resulting mutations.

Figure semantic-space shows the semantic space surrounding a program. The lavender "Specification" region contains those programs with acceptable semantics, whether defined through a formal specification or loosely by the developers or users of the program. The red region holds those programs with acceptable behavior as defined by the test suite. Ideally the original program lies within the intersection of these two regions, and their exclusive disjunction is small

The mutation testing community uses mutation operators specifically designed to produce faulty program mutants. Mutation testing assumes that all mutants are either faulty or equivalent, i.e., the lavender Specification region in Figure semantic-space does not extend beyond the point of the original program. A "mutation adequacy score" jia2010analysis accesses the quality of the test suite as the percentage of non-equivalent mutants which fail some test. Through seeking to optimize this score mutation testing drives the Test Suite region to similarly approach the single point of the original program in semantic space.

By not allowing for the possibility of non-faulty non-equivalent mutants (i.e., by not acknowledging mutants 2 or 4 in Figure semantic-space), the mutation testing approach ignores the functional (or neutral) variants which much of this work will seek to exploit¹.

We define software mutational robustness as the percentage of random mutations to a given software instance that leave the observable functionality unchanged. We assume that mutants which satisfy the test suite will also satisfy the specification, and thus determine mutant fitness using the software's existing test suite. Only those variants that successfully compile and pass all tests in the test suite are considered neutral. Mutation operations are restricted to those portions of the program exercised by the test suite to ensure that all mutations will have some affect on software runtime behavior as exercised by the test suite.

Mutation operators: Insert, Delete and Swap applied to both abstract syntax trees whose nodes are C statements parsed from source code and to linear arrays of assembly instructions parsed from compiled assembly code.

Insert AST	Delete AST	Swap AST
Insert ASM	Delete ASM	Swap ASM

In preliminary work we tested mutational robustness at two levels of software representation; abstract syntax trees parsed from source code and linear sequences of compiled assembly code instructions. The three mutation operations are shown applied to both of these representations in Figure mut-ops.

There are a number of properties of biological systems thought to cause high levels of mutational robustness. Two such factors which I will discuss below are: the mechanisms of DNA expression and the history of development through evolution.

The mapping from DNA to amino acids has evolved in such a way that similar DNA sequences give rise to similar proteins knight1999selection. Similarly, the mappings from RNA sequences to the functional shapes they produce have properties such as local continuity (promoting incremental change) and global reachability (promoting novel functionality) which are themselves thought to be amenable to evolution. schuster1994sequences, huynen1996smoothness.

If one were to design the ultimate evolvable molecule that carries information and is engaged in functional interactions, it would ideally require two features: (i) capability of drifting across sequence space without the necessity of changing shape; and (ii) proximity to any common shape everywhere. These are precisely the features that statistically characterize the mapping from RNA sequences to secondary structure. schuster1994sequences

To the degree that such properties are the consequences of the evolutionary origin of DNA and RNA, analogs should be found in other systems shaped by natural selection. The remainder of this section will investigate the hypothesis that as a product of natural selection, the mechanisms of expression of software systems should increase robustness and evolvability. I will then measure the effects of increased evolutionary development on robustness and evolvability in software developed using GP.

Having investigated the possible causes of mutational robustness in software I will look to possible effects or correlates of mutational robustness in software. Specifically I propose to study the relation between mutational robustness and evolvability of software, and the relation between mutational and environmental robustness.

Software diversity may be a useful goal in and of itself. It has, for example, been leveraged to improve software reliability through N-version systems chen1978n. I hypothesize that the neutral spaces of software systems could be exploited to generate diverse software variants; a process which when performed by hand can be difficult and often leads to surprisingly similar variants knight1986experimental.

In previous work in this area Zachary Fry used diverse program populations to preemptively repair withheld bugs schulte2012smutationalrobustness. The diverse populations were generated through automated exploration of the neutral space of the original program.

In contrast to the direct benefits of diverse software populations demonstrated by Fry et al., the remainder of this section will explore two methods of leveraging diversity to enhance evolutionary techniques of program development and maintenance. Each technique leverages a different cornerstone of the traditional software development environment — compilers and linkers, and version control systems.

During compilation and linking, non-functional properties of software such as running time and executable size may be optimized. Techniques for such optimizations have been extensively researched and implementations can be found in many of the cornerstones of modern software development environments such as GCC stallman2003using.

Current techniques rely almost exclusively on operations that can be formally proven to preserve program semantics. Using the much looser test-suite based definition of program behavior described above I hope to evolve neutral program variants not reachable through semantic-preserving operations alone. Some of these semantically neutral variants may have desirable characteristics such as faster running times or lower energy consumption. Multi-objective EC may be used to evolve software variants which are semantically neutral yet optimize such non-functional properties.

Such an evolutionary multi-objective optimization technique has been demonstrated in work by Sitthi-Amorn et al. sitthi2011genetic in which simplified variants of pixel shaders were evolved from an extant original program. I propose an extension of this work to optimization of diverse properties of programs aside from pixel shaders.

Modern system emulators miller2010graphite allow fine-grained monitoring of many aspects of program execution, which may be difficult to predict a-priori, such as energy consumption and communication overhead. I propose to use such a system to evaluate fitness in a multi-objective EC system for software optimization. I hypothesize a number of benefits to such a system:

• Test-suite defined correctness permits more radical program transformations than available to traditional optimization strategies which are limited to formally semantic-preserving transformations.
• Evaluation using a full system emulator enables optimization of software properties not readily predictable through static analysis, such as aspects of performance based on particulars of the hardware including cache sizes or on chip network speeds.
• The use of a multi-objective fitness function provides a natural method for developers to specify priorities for non-functional optimization.

Specifically this investigation will attempt to optimize the parallel fast Fourier transform (FFT) algorithm. This algorithm is of great importance to scientific computation oppenheim1989discrete and it has received much attention and manual optimization duhamel1990fast, frigo1998fftw. Thus, a competitive evolutionarily optimized FFT implementation would be a significant achievement.

The evolution of diverse populations from single programs raises questions of software identity. Earlier proposed work (Section mut-and-env-rb) described the creation of a benchmark suite composed of multiple distinct programs which all conform to the same test suite. Neutral populations evolved from the members of such a benchmark suite would populate different regions of the same test-suite defined neutral space.

It is possible that individuals from these separate regions may be successfully combined to form new hybrid implementations containing genetic material from both ancestor programs. This amounts to asking if the neutral populations derived from the two original programs are members of the same species — abusing the biological definition of the term.

Recombination of programs with no shared ancestry has been observed in the wild in Microsoft word macro viruses bontchev1998macro. The intentional recombination of ancestrally related programs has been performed at the object level foster2010object. In this work Foster and Somayaji were able to link libraries from two different versions of a program to generate a new version exhibiting features of both ancestor versions.

I propose to use the single-test-suite benchmark suite developed in Section mut-and-env-rb to develop related neutral populations. I will then attempt to combine individuals between these neutral populations using existing crossover operations. If effective, I hypothesize that this technique will have a number of practical applications including:

• the transfer of optimizations between distinct software products
• the transfer of functionality between distinct software products
• an automated method of introducing diversity into program populations

Though outside of the scope of this proposal, such a technique may necessitate new legal tools and definitions related to issues of software identity and copyright, and new limits on the use of compiled program binaries.