Penetration Analysis Tools

Penetration of trusted software represents a set of illicit means of exploiting design and implementation flaws and/or operational errors to cause system security, integrity, and denial-of-service breaches. Penetration of trusted software presents a serious risk to both distributed systems and networks, both in the commercial and defense sectors. The overall objective of this project is to implement an extensible, automated tool for penetration analysis of trusted software written in C, and to perform experiments with the tool on selected trusted systems to establish the usefulness of tool-based penetration analysis. The tool will enable the identification of flaws in trusted code that could lead to system penetration, and will generate sufficient information to help produce real penetration scenarios and countermeasures. The penetration analysis tool, when fully implemented, will provide a significant measure of confidence in the integrity and security of computer system and network software. It is envisioned that the method and tool developed in this project will be used for analyzing the source code of distributed systems platforms, network protocols, and high-assurance systems under B2-A1, or equivalent, evaluations. In general, the penetration analysis method and tool developed in this project could be used by both software producers and commercial security certification services.