SBIR Phase I: Immunizing Software Against Exploits and Malware

The broader impact/commercial potential of this Small Business Innovation Research (SBIR) Phase I project will result from a reduced incidence of cyber-enabled crime and cyber-related industrial espionage. The company plans to accomplish this by transforming a unique, academically peer-reviewed idea into a production-grade software defense product. If successful, this project will produce robust and practical methods to automatically mitigate a broad class of software vulnerabilities that currently put millions of users and critical national infrastructure at risk. To accomplish these goals, the company will develop its capability to build state-of-the-art software diversity solutions that are not only secure, but also practical and efficient. Specifically, the project will study and address challenges related to distribution and patching of diversified software as well as the need to hide the effects of diversity during automatic reporting of residual defects found in software after it has been released into production. The availability of practical software diversity techniques will open the door to industry adoption and offer software developers a cost-effective mechanism to improve product security. This Small Business Innovation Research (SBIR) Phase I project will be the first to blend compile-time and safe, scalable post-compilation code randomization techniques so that hardened applications align with current industry practice. Because randomization can prevent exploitation of undiscovered memory corruption vulnerabilities in computer software, the technology will be able to provide protection in the critical and often lengthy window of exposure between the discovery of a vulnerability and its removal. The company expects to demonstrate that its techniques can scale up to complex, modern software such as web browsers and down to mobile, energy-constrained devices.