Binary-Level Malicious Code Pattern Detection Technology

This effort is based on the outcome of a successful Phase I project that demonstrated the feasibility of generating logic pattern-based, OS-platform-independent, signatures for malicious program logic and detecting its presence within much larger binary modules. The detection (and localization) of a logic-based signature within a binary executable represents a significant advancement in automated code analysis. It also offers a new capability to test the hardness or vulnerability of protected software modules (e.g. test logic obfuscation hardness, vulnerability to exploitation, etc.). The approach taken involves the development of canonical signatures based on essential logic patterns required for a (malicious) function to occur. When logic patterns of certain malicious codes are extracted it is also possible to relate logic signatures to specific exploitive behaviors. This results in an OS/language/hardware independent signature for malicious exploits, strategies and tactics. We can then extract the logic structure from an arbitrary binary and scan it for specific malicious logic. Scanning a binary module requires disassembling and recovering features of the logical implementation (hence, it can potentially violate some software licensing agreements). A Phase II development will support information assurance within MDA’s Computer Network Operations and directly support program objectives for the Common Operating Environment (COE)