You are here

Binary-Level Malicious Code Pattern Detection Technology

Award Information
Agency: Department of Defense
Branch: Missile Defense Agency
Contract: W9113M-05-C-0170
Agency Tracking Number: B041-056-0051
Amount: $749,999.00
Phase: Phase II
Program: SBIR
Solicitation Topic Code: MDA04-056
Solicitation Number: 2004.1
Solicitation Year: 2004
Award Year: 2005
Award Start Date (Proposal Award Date): 2005-06-13
Award End Date (Contract End Date): 2006-12-14
Small Business Information
190 Green Valley Road
Owens Crossroads, AL 35763
United States
DUNS: 142295422
HUBZone Owned: No
Woman Owned: No
Socially and Economically Disadvantaged: Yes
Principal Investigator
 Luis Lopez
 (256) 656-9652
Business Contact
 Luis Lopez
Title: President
Phone: (256) 656-9652
Research Institution

This effort is based on the outcome of a successful Phase I project that demonstrated the feasibility of generating logic pattern-based, OS-platform-independent, signatures for malicious program logic and detecting its presence within much larger binary modules. The detection (and localization) of a logic-based signature within a binary executable represents a significant advancement in automated code analysis. It also offers a new capability to test the hardness or vulnerability of protected software modules (e.g. test logic obfuscation hardness, vulnerability to exploitation, etc.). The approach taken involves the development of canonical signatures based on essential logic patterns required for a (malicious) function to occur. When logic patterns of certain malicious codes are extracted it is also possible to relate logic signatures to specific exploitive behaviors. This results in an OS/language/hardware independent signature for malicious exploits, strategies and tactics. We can then extract the logic structure from an arbitrary binary and scan it for specific malicious logic. Scanning a binary module requires disassembling and recovering features of the logical implementation (hence, it can potentially violate some software licensing agreements). A Phase II development will support information assurance within MDA’s Computer Network Operations and directly support program objectives for the Common Operating Environment (COE)

* Information listed above is at the time of submission. *

US Flag An Official Website of the United States Government