1. Self-Defensive Systems
1.1. Counter-Measures
1.1.1. Signature Scambling
1.1.1.1. Binary Scambling
1.1.1.2. Network Transmission Signature
1.1.2. Reorganisation
1.1.3. Encryption Key Change Algorithm
1.2. Redundancy
2. Fault Tolerant Systems
3. Resilient Systems
4. Self-Healing Cycle
4.1. Detection
4.1.1. Multi-stage Monitoring
4.1.1.1. Low Intensity
4.1.1.2. High Intensity
4.1.2. Indicators of Infection
4.1.3. Context-Aware Systems
4.2. Diagnosis
4.2.1. Artificial Intelligence / Data Mining / Decision Making
4.2.1.1. Dimensionality Reduction (offline processing)
4.2.1.2. Clustering
4.2.1.2.1. Anomaly Detection (in dynamic systems) (in real-time)
4.2.1.3. Classification
4.3. Response
4.3.1. Self-Defensive System
4.3.2. Crash Hardening by "STING" (Brumley et al 2006-7) (Process core memory dump analysis after a crash, disallow inputs that cause the crash)
4.3.3. Process Management
4.3.3.1. Kill
4.3.3.2. Run
4.3.3.2.1. File Version Checker (sfc /now)
4.3.3.2.2. Registry Validator
4.3.4. Critical / Fatal Repsonse
4.3.4.1. Reboot
4.3.4.2. Reboot & Reinstall X (X = identified failing component)
4.3.4.3. Shutdown (Send warning to IT Admin)
4.3.4.4. Reboot & System Restore
4.3.5. Monitoring State
4.3.5.1. Set Low Intensity Logging (decaying duration)
4.3.5.2. Set High Intensity Logging (decaying duration)
4.3.5.2.1. Increase logging intensity (e.g. to provide more data for decision making)
4.3.6. Diagnosis / Decision Making Sensitivity
4.3.6.1. Increase sensitivity
4.3.6.2. Decrease sensitivity
4.3.7. "Auto[..] Patch Errors in Deployed Software" "ClearView" (Perkins et al 2009)