Automated Malicious Code Detection

We will develop a system that employs a wide set of behavior-monitoring wrappers to provide broad protection against malicious code contained in email attachments, downloaded by a web browser, or distributed in software releases. These wrappers will sharea tailorable set of safety rules that prescribe the rights of each process.If any of these safety rules are violated, the wrapper will determine the severity of the violation and autonomically choose an appropriate response to minimize disruption of the ongoing processing while preserving protection. Those autonomic responseswill include hiding the existence of protected resources, stealthily redirecting the offending operation to an isolated and non-critical resource, dynamically disabling active content in the offending document or web page, returning an error codeindicating that the protected resource is not accessible, and aborting the process.It will verify the identity and integrity of executable being loaded to ensure they haven't been corrupted or switched, and repair any that have. It will download updated software, monitor its installation, and autonomically register it so that itsidentity and integrity can be subsequently verified. This will enable system administrators to remotely, and securely, administer the installation of all software across a set of machines.This system will provide broad protection against malicious code, including novel attacks, without the need for updates. It will employ a graduated set of responses that allow the execution of potentially malicious code to safely continue, thus eliminatingthe need to prematurely determine whether suspicious behavior is actually malicious.The potential commercial market for such protection against malicious code is immense, surpassing the install base for virus-scanning products.