Automated Binary Analysis and Vulnerability Discovery Platform for Offensive Cyber Operations

NetRise proposes to adapt and extend its commercial binary analysis platform to support offensive cyber operations within the Department of the Air Force (DAF), with SAF/CDM serving as the primary end user. The goal of this Phase II effort is to deliver an automated capability for analyzing and exploiting binaries without source code, enabling DAF cyber operators to rapidly assess adversary software, uncover hidden vulnerabilities, and support mission planning for cyber operations. This work builds on foundational research and feasibility efforts completed in Phase I, which demonstrated the viability of constructing control flow graphs, detecting memory safety issues, and triaging risk in legacy or proprietary software binaries.The proposed Phase II system will provide capabilities for static and dynamic analysis of unknown binaries, leveraging intermediate representations and AI-enhanced pattern recognition to identify exploitable constructs. It will include features such as taint tracking for high-risk data flows, function-level risk scoring, and the detection of missing binary protections (e.g., absence of ASLR, stack canaries). The platform will be designed for use in air-gapped and sensitive environments, capable of analyzing a wide range of binary formats and instruction set architectures commonly encountered in embedded and adversary-controlled systems.SAF/CDM, whose mission includes identifying and integrating advanced cyberspace capabilities across the DAF and broader Department of Defense, will guide integration and user validation. Additional intended stakeholders include operational cyber units such as the 315th COS, 90th COS, and CNMF-AF, who require scalable tools to support malware triage, target system exploitation (TSE), and tool development workflows.The anticipated outcome of this Phase II is a validated prototype that enables faster, more precise analysis of adversary binaries, improving decision speed and effectiveness for offensive cyber missions. Transition to Phase III will focus on integrating the solution into SAF/CDM operations and scaling access for other Air Force and joint cyber elements. The technology also holds long-term potential for adaptation to high-security commercial applications such as red teaming, advanced threat hunting, and incident response.