Adaptive Vulverability Analysis for JAVA as a Defensive Information Warfare Technology

We propose to investigate the use of Adaptive Vulnerability Analysis (being developed under DARPA contract number F30602-95-C-0282) for analysis of Java applets and applications. Java - a platform-independent, Internet-savvy programming language - has found widespread acceptance and has been adopted for use in critical defense information systems such as the GCCS. It is essential to develop and extend security assessment techniques, including AVA, to counter information warfare threats. AVA has been successfully implemented in the Fault Injection Security Tool (FIST) prototype for C and C++ source code. FIST employs software fault injection to force anomalous program states during the execution of software and to observe their corresponding effects on system security. If insecure behavior is detected, the perturbed location that resulted in a violation is isolated for further analysis and possible retrofitting with fault-tolerant mechanisms. Extending AVA to handle Java code will require significant research investigating the effects that differences between C/C++ and Java have on fault injection analysis. One such difference is Java's memory management system which uses garbage collection and array bounds checking. Another is Java's use of exceptions. Phase I of the project we propose includes developing a Java JDK 1.2 parsing capability for FIST and undertaking a feasibility study for a complete Java-capable version.