Run-Time Process Monitoring

Malicious code causes huge economic damage every year. As critical infrastructure increases its dependence on networked information systems, the potential damage from malicious becomes more acute. Identifying and neutralising such code is especially difficult when executables are defended against reverse engineering for legitimate purposes such as digital rights management and protecting other intellectual property. We will develop a runtime process monitor that enforces custom security policies on executables protected against reverse-engineering. This system will stop malicious code before it can do damage, even when the malicious code is in a form resistant to inspection. The system will be effective against trojan horses and other insider attacks.