
One of the major problems with current cybersecurity measures is that while systems can detect the erratic behavior that heralds an incoming attack, there often isn't a whole lot those systems can do once the attack is underway short of pulling the servers offline, resulting in lost revenues and credibility for Web sites and a loss of key services for users. A new MIT system aims to change that by keeping servers and applications running even as it contains an incoming cyberattack.
The system works by observing programs as they normally run and memorizing those ranges of behavior. During an attack, the system simply locks the programs within those behavioral ranges; that is, if a program usually stores data at either location X or location Y, those are the only two places it will be allowed to store data once the security system detects that an attack is underway. Read more »








