Action Languages and the Mitigation of Malware

Automating malware mitigation requires taking into account potentially intricate dependencies among the system’s components, understanding potential side-effects of the possible actions, and ensuring that required system functionalities are preserved. Answers still need to be found for fundamental questions: What does it mean to mitigate malware? When can one claim that malware has been mitigated? What are the side-effects of a mitigation strategy? This paper aims to demonstrate that techniques from reasoning about actions and change can provide the means to create a precise characterization of the notion of mitigation and by defining corresponding algorithms. The key observation underlying our work is that a computer system can be viewed as a dynamic system, i.e., a system whose state changes over time. Taking this perspective makes it possible to leverage the techniques for reasoning about actions and change to model, and reason about, system components and malware. Furthermore, efficient computation can be achieved by relying on encodings based on Answer Set Programming.