Software Protection by Polymorphic and Metamorphic Transformations

Integrity and security of application programs critical to National Security are vulnerable to differential analysis, reverse engineering, and exploitation of static buffer overflows. Without incorporating software protection initiatives, these vulnerabilities can be leveraged by an attacker to distribute a program without proper authority, tamper with its intended functionality, expose techniques behind proprietary algorithms, and launch viruses/worms against identical applications on distributed hosts. We propose to demonstrate the importance of diversity in application binaries and the feasibility of utilizing polymorphic (static) and metamorphic (dynamic) transformations as protection mechanisms. As our past research has demonstrated, these are highly efficient methods that can be incorporated into both Government and commercial applications with tremendous success.