SBIR Phase II: Analysis and Rewriting of Binary Code for Performance and Security

The broader impact/commercial potential of this Small Business Innovation Research (SBIR) Phase II project will result from it enabling (i) faster and more productive computer software and (ii) a significant improvement in the ability to counter cyber threats. Many enterprises, such as financial firms and online retailers, operate software platforms that are central to their business. Even a few minutes of reduced platform performance can lead to financial losses in the millions of dollars. The first project outcome will enable enterprises to automatically detect and rapidly resolve such performance problems, leading to more efficient information systems, more satisfied consumers and more profitable companies. The second outcome will boost the defenses of our nation's computers against cyber-attacks. President Obama recently cited cyber threats as one of our most serious economic and national security challenges. Losses from theft of intellectual property are estimated to cost American companies around $250 Billion annually. The company's malware analysis technology will detect some of the most advanced attacks that defeat today's defenses, leading to safer consumer and enterprise data, and reducing financial losses. Overall the company's technology enhances the technical understanding of binary code, an important class of software employed in a range of enterprise software and most modern cyber-attacks. This Small Business Innovation Research Phase II project will develop a software tool called a binary rewriter that can understand and modify binary code. Although software applications are developed in human-readable programming languages, a large fraction is translated to binary code to be executed on hardware. Binary code is difficult to understand and modify. In addition, modern sophisticated techniques such as packing - employed by malware writers - further complicate this task. The intellectual merit of the project is based around the development of a novel binary rewriting mechanism that fulfills critical requirements that cannot be simultaneously achieved by any existing rewriting tool. The new rewriting mechanism will be able to reliably rewrite every binary program, including programs containing sophisticated techniques such as packing, without compromising the critical requirement for low run-time and memory overhead. It will also provide a novel mechanism for (i) monitoring the performance of enterprise applications as part of an advanced performance monitoring framework; and (ii) detecting, and therefore providing a means to stop, infection from evasive malware, a sophisticated class of malware that deliberately hides its malicious behavior.