Schneier on Security
A blog covering security and security technology.
« TSA Lied About Protecting Passenger Data |
| GAO's Report on Secure Flight »
March 28, 2005
Camouflage in Octopodes
Two tiny species of tropical octopus have demonstrated a remarkable disappearing trick. They adopt a two-armed "walk" that frees up their remaining six limbs to camouflage them as they slink away from trouble.
I have a fondness for security countermeasures in the natural world. As people, we try to figure out the most effective countermeasure for a given attack. Evolution works differently. A species tries different countermeasures at random, and stops at the first one that just barely works.
(I found this on BoingBoing.)
Posted on March 28, 2005 at 12:38 AM
• 21 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
That's "octopuses", comedian.
Which strategy do you think yields better results? Intentional or pseudorandom?
what is an octopode?
Actually, there is no such thing as a singular octopode. Last time we checked, “octopodes��? is the plural form of octopus. Yeah, we thought it was octopi, too, but according to our sources, octopus come from the Greek words okto, which means eight and pous which means feet. The Greek plural form of pous is podes, hence octopodes. Apparently, though, nobody ever uses this term, not even the scientists that study the animal.
"stops at the first one that just barely works" is not correct. Nature is better than that. A wide spectrum of variants is tried. If one of them has an advantage in terms of differential reproductive success, it begins to predominate in the population. In this sense, you are driven to at least a local optimum. The problem with evolution as applied to technology is that you're never guaranteed to arrive at an efficient (as in well-engineered) optimum. E.g., nature never evolved the wheel for locomotion.
"A species tries different countermeasures at random, and stops at the first one that just barely works."
This phrase demonstrates exactly what falls through in the Theory of Evolution.
(Bear with me in pretending animals have these sort of thought processes. Also, I really have no Idea if sharks prey on octopodes, it's just an arbitrary predator.)
This is the problem: "Oh no, here comes a shark, I'll have to defend myself."
[Octopus tries to crawl away, and is eaten]
So, now the octupus knows that that medthod of defence won't work, the only catch: he's dead.
See, every time you find out something won't work, you die. Hence, there's no one to learn from the mistakes.
Even more of a problem, there's nothing to reproduce a create more little "guinea pigs" to find a method of survival.
If you subscribe to this view, you're left with probably one or two generations before the entire species is gone.
Always gets me when they say "Over millions of years [any species here] developed this method of protection that allowed it to survive [any trial of life here]" OK, so what happened to all the ones that died in these millions of years while this developed.
For instance: The bombardier beetle, how many of them blew up before one of them got lucky and got all the chemicals mixed corrrectly and everything pointed in the right direction? The mathematical improbability makes the rest of this Theory seem almost feasible by comparison.
It's a circular problem with no easy out, at least to my "feeble mind".
OK, I'll get flamed for this one. I earned it. Heh.
Time decides whether that random octopus's strategy is good or not and eventually the strategies that survive end up being the best stategies. If those two octopuses survived with this technique, then that's good enough. Evolution, like security, is a process :-)
"Which strategy do you think yields better results? Intentional or pseudorandom?"
Intentional, of course. But random can yield surprising results, results you might not thought of thinking of.
TheRambler: In 2^128 bits, what are the odds that you'll find the two messages whose hash results in a collision? Theoretical probability is infinitely small, but in practice we've seen it demonstrated again and again that it's feasible given modern day hash algorithms.
The idea of evolutionary design and natural selection is the event with infinitely small theoretical probability of "discovering a technique or tactic which works" DOES indeed happen, which gives that individual an advantage over its peers, and then gets passed down to its offspring either through genetics or memetics, who in turn have an advantage over their peers, thus, over time, forming a majority.
Bruce, do you think that the area of Genetic Algorithms could eventually result in an interestingly strong cryptographic algorithm, one with properties that traditional intentional cryptographers would never consider or discover -- in the same way that natural evolution "discovers" interesting behaviors?
Or, is GA and AI in general just not interesting to you as a security and cryptanalysist guy?
TheRambler: The example you give doesn't refer to evolution. An equivalent example (exaggerated for clarity) in evolution might be:
Three octopodes/octopi/whatever are each very similar, except for three slight random mutations, that they inherited from neither parent. Because of these mutations, one can crawl, one can swim, one can fly (what the hell - this is all hypothetical).
Shark comes along, and can catch the first two, but the octopus that can fly is able to get away. The first two mutations are now out of the gene pool, but the third is able to reproduce. It's offspring are also able to fly, to varying degrees of ability, depending on how much of the parent's genes they picked up. The ones that are most able to fly are the most likely to survive, and hence the next generation will be better at flying still.
As Dossy said, whilst low probabilities are, by definition, improbable, when you have such a massive universe as ours, improbable things are going to happen, albeit not very often. Imagine I come up to you in the street, and hand you an envelope with a playing card in, ask you to guess what card is in the envelope, and it's right. You'll be amazed - it's too unlikely to be a coincidence. What you don't know about is the 20+ people I tried the trick on before you when it failed - they think I'm just some weirdo and forget about it. The exceptional, such as the bombardier beetle, isn't so unlikely if you take into account all the others that will have tried, and failed, and that we don't know about.
"Shark comes along, and can catch the first two, but the octopus that can fly is able to get away."
That's true only in an ideal universe were all the octopuses face the same environmental conditions.
Guys, TheRambler is probably a creationist troll. Don't encourage him.
Bruce: Sorry dude, but "Stops at the first one that barely works" is just wrong. It's more that any "trick" that works for *some* useful purpose, is likely to be propagated through the population, and then elaborated on by further variation. This is well demonstrated in the answer to "what use is half an eye?" (I don't have an exact URL, but try searching www.pandasthumb.org).
In fact, octopi (by common usage) are pretty darn evolved critters. They have intelligence comparable to mammals of similar size, and strong, dextrous manipulating limbs to boot. They have good vision and smell, jet propulsion and can leave the water for short periods of time. (Some of their relatives *can* fly, a little!) And then there's that color-changing skin (in at least some species), used for both camoflauge and communication. I am unsurprised that they also have behavior patterns to assist in escapes. (Thank goodness they're territorial predators, who can't gang up on us! ;-) ) Note that all of these features can be traced "back" through more primitive features, still to be found in a variety of other creatures, and usually within the molluscs.
The big differences between the results of design and of evolution have to do with what you might call the "style" of the results. Human design is based on simple patterns and structures, and predefined goals and purposes. I.e., "I want a house with 1000 m^3 of floor space, resistant to hurricanes, and airflow arranged to favor hot-weather occupancy".
Evolution, in contrast, represents an accumulation of opportunities, and hard-knocks lessons. Rube-Goldberg like chains of effects are more the rule than the exception. By comparision with machines, simplicity is sacrificed for robust behavior, such as graceful degradation. Instead of simple assemblies, we see scale-free networks and fractalesque forms. Instead of top-down design, there are a horde of local adaptations and optimizations, with prior developments playing a much stronger role. Even the relation to natural law is different; As with machines, there are basic trade-offs, but evolution is better at finding the "sweet spots" in the rules (Q.v. bumblebee wings),. Likewise, evolution constructs complex dynamic systems that static assemblies just can't match. Most impressive of all, There is a constant negotiation with the environment over deep time. (Qv: The Oxygen Crisis. ;-) )
These eight-legged creatures can do a lot of neat things such as open twist top jars to get their food, squeeze through the tiniest of cracks, get out of their man-made tanks to search for food so it is no surprise that they are evolving before our eyes.
Anything that evolves in multitudes can always be creepy especially if they "decide" to evolve their attacks instead of their defenses.
Rereading the above, I realize I neglected to mention some of the drawbacks of evolution: it's slow and inefficient, and the interdependencies in a large system can produce "cascading failures".
The diversity we see in Terran life took a billion years to develop. But when an ecosystem gets damaged, a lot of its complexity can simply collapse, figuratively overnight. Yes, it would *eventually* recover, if left alone -- but generally not in our lifetimes. On the individual level, consider the disastrous effects of vitamin deficiencies in humans. We evolved on a varied diet, and so we're *dependent* on a varied diet, even though many "lesser" species aren't.
In designed systems, this sort of thing can be handled by planning ahead, but that's another thing evolution does *not* do. Evolution responds to current conditions, and almost incidentally accumulates adaptations to past conditions. But instead of planning for the future, it depends on serendipity, to the point of developing meta-adaptations to "breed" and exploit it. (That whole intron/exon thing, alternative splicing, transposons, etc.)
Also, every change by evolution also involves a goodly number of individuals who did *not* survive. To play with that old argument, imagine you find a working watch on the beach... but then you look around, and realize that this beach is made, not of sand, but of broken and half-assembled watches, subassemblies, and loose parts!
I realize this is something of a digression for your log, but the characteristics of evolution turn out to be relevant to some very non-biological issues, such as long-term maintainance of complex systems, robust behavior, and emergent phenomena in general.
As long as we're talking about this amazing propensity for survival, what's the security countermeasure for the commercial fishing industry?
Clearly octopodes "look around" and observe their environment, and use common things to emulate for camouflage. That seems to be one of their fundamental reactions to any kind of attack, so it's no surprise that it goes beyond just changing colors. The sad thing is that these friendly and intelligent creatures have little defense against modern traps and overfishing.
Well, going by historical precedent, the best defense against humans is to get the h*** out of the way, preferably someplace we *can't* get to. The deep sea would seem to qualify, but I gather octopi feed and hang out on continental shelves, where they're competing with us for at least some types of food.
Unfortunately, we humans seem to be especially rough on large predators. We've decimated or wiped out most of the landbound predators large enough to bother us, and we're working on the seaborne ones. I suspect the bigger octopi, at least, are in for trouble. One interesting possibility might be domestication, but given their vastly different developmental course, I don't expect that to happen.
"As people, we try to figure out the most effective countermeasure for a given attack. Evolution works differently. A species tries different countermeasures at random, and stops at the first one that just barely works": brilliant satire! *8)
Trying things at random and stopping as soon as something barely works is of course exactly what we humans do, particularly in large organizations...
Adam Dinwoodie's comment reminded me of a nice idea which you can use to convince some people that you are a true genius who can predict the floatings of the stock market prices.
Suppose L is a list of 1024 people, for example. You perform this algorithm:
1- Send a letter to the first size(L)/2 people saying that Microsoft's stock prices will go up in the next week.
2- Send a letter to the other size(L)/2 people saying the opposite (that the price will go down).
3- Wait a week
4- If the stock prices went down, eliminate the first half of the list. Otherwise, you remove the other half of the list
5- Go to step 1
After lg(1024) = 10 iterations, you will have convinced one person that you're a true genius...
I always thought of evolution as a kind of intelligent fuzzing attack that a species performs on its environment. The variations that break the system in the species' favour to a greater extent are automatically retained.
Of course, those of us who don't accept evolution as a valid working hypothesis tend to choke on the word "intelligent". In this context it just means "cool".
Does this sound like a good way of rationalising things or am I speaking garbage?
"A species tries different countermeasures at random, and stops at the first one that just barely works."
Nitpick: Evolution stops at the first one that at least just barely works. If a randomly attempted countermeasure is spectacularly successful, evolution will stop with it; it won't discard it and continue looking for one that only "just barely works".
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.