Binary-Level Malicious Code Pattern Detection Technology

This effort develops automatic detection of malicious binary code based on syntax-independent logical control flow patterns. Control flow patterns yield specific detectable signatures that can be extracted from binary code. Because they are based on functional control flow, these signatures also discriminate the kinds of behavior a binary can perform; furthermore, these signatures are independent of where the binary originated. They are OS and language independent. This effort develops viable methods for analysis and classification of potential behaviors - malicious and otherwise - based on logical patterns found in binary code and related requirements meta-models. This effort will associate the presence of potential algorithm patterns with specific types of expected functionality. Inappropriate or unexpected functionality will be detectible and may indicate latent malicious code.