Sanitizing Software of Malicious and Unauthorized Code

Development of modern software applications involves the use (or reuse) of a large number of software components from many different developers - some of whom may be unknown, untrustworthy, or even hostile parties. A comprehensive approach is needed for identifying malicious and unauthorized code in large software systems. We propose to do a comprehensive review of techniques for detecting malicious and unauthorized code, and to develop prototypes of the most promising approaches. Our review will focus on static analysis techniques that may prove the absence of some malicious code. Our initial efforts will focus on software model checking, clone detection, and buffer overrun analysis.