Malicious Binary Code Automated Response, Forensics and Immunity - Tools and Methods

This effort will develop a capability for automated modification of binary code based on canonical algorithm patterns of control flows. Since these methods are based on control flow, they are OS and language independent. The methods offer a path towards building operating systems that are self-repairing and can immunized against malicious behavior. This effort will develop methods to automate insertion of safeguarding breakpoints at potentially malicious code points. When a breakpoint is hit, several options will be automatically made available to computer security network analysts. Algorithm information will be extracted form the breakpoint area of the code and displayed in a syntax-neutral flow graph. The flow graph will offer a real-time visual debugger that can be stepped and interpreted in a `safe' mode to determine methods of attack used by malicious code, contain the code, log its behavior, etc. This will enable both real-time and offline responses to be developed as well as advanced forensics and behavior analysis of malicious binary code. It will develop a technology that can modify and contain bad code in COTS products prior to running within a trusted and secure system.