Attack-Detection Application Memory Monitor (ADAMM)

The current state of the art in cybersecurity technologies is insufficient to address the Navys strategic need to monitor the memory spaces of applications running with real-time performance constraints against corruption or sabotage by cyber-attacks. ATC-NY will fill this need by developing the Attack-Detection Application Memory Monitor (ADAMM), a kernel-based memory monitor that utilizes pre-execution code analysis alongside several passive and active memory protection techniques to verify the integrity of a running applications memory space on real-time UNIX systems with high availability requirements without harming its performance. Rather than naively treating the memory space of an application as being monolithic and entirely uniform, ADAMM performs static code analysis on the applications executable binary right before it begins running. This lets ADAMM significantly reduce the impact of its monitoring on run-time performance by applying particular and specialized monitoring strategies for each different section of the applications memory space.