USA flag logo/image

An Official Website of the United States Government

Binary-Level Malicious Code Pattern Detection Technology

Award Information

Agency:
Department of Defense
Branch:
Missile Defense Agency
Award ID:
69674
Program Year/Program:
2005 / SBIR
Agency Tracking Number:
B041-056-0051
Solicitation Year:
N/A
Solicitation Topic Code:
N/A
Solicitation Number:
N/A
Small Business Information
2LRESEARCH
190 Green Valley Road Owens Crossroads, AL 35763 9726
View profile »
Woman-Owned: No
Minority-Owned: Yes
HUBZone-Owned: No
 
Phase 2
Fiscal Year: 2005
Title: Binary-Level Malicious Code Pattern Detection Technology
Agency / Branch: DOD / MDA
Contract: W9113M-05-C-0170
Award Amount: $749,999.00
 

Abstract:

This effort is based on the outcome of a successful Phase I project that demonstrated the feasibility of generating logic pattern-based, OS-platform-independent, signatures for malicious program logic and detecting its presence within much larger binary modules. The detection (and localization) of a logic-based signature within a binary executable represents a significant advancement in automated code analysis. It also offers a new capability to test the hardness or vulnerability of protected software modules (e.g. test logic obfuscation hardness, vulnerability to exploitation, etc.). The approach taken involves the development of canonical signatures based on essential logic patterns required for a (malicious) function to occur. When logic patterns of certain malicious codes are extracted it is also possible to relate logic signatures to specific exploitive behaviors. This results in an OS/language/hardware independent signature for malicious exploits, strategies and tactics. We can then extract the logic structure from an arbitrary binary and scan it for specific malicious logic. Scanning a binary module requires disassembling and recovering features of the logical implementation (hence, it can potentially violate some software licensing agreements). A Phase II development will support information assurance within MDA's Computer Network Operations and directly support program objectives for the Common Operating Environment (COE)

Principal Investigator:

Luis R. Lopez
CTO
2566569652
luis@hiwaay.net

Business Contact:

Luis R. Lopez
President
2566569652
luis@hiwaay.net
Small Business Information at Submission:

2LRESEARCH
190 Green Valley Road Owens Crossroads, AL 35763

EIN/Tax ID: 550815464
DUNS: N/A
Number of Employees:
Woman-Owned: No
Minority-Owned: No
HUBZone-Owned: No