Automated Malicious Code Detection

We will develop a working prototype of the CyberSafe host-based cyber defense system. CyberSafe will operate in the Windows NT environment and will employ a set of behavior-modifying wrappers to provide broad protection against malicious code contained ine-mail attachments, downloaded by a web browser, or distributed in software releases. The system will detect both simple and complex attacks before they succeed and autonomically respond in a way that minimizes disruption of ongoing processing whilecontinuing to protect the user's and the system's resources. It's chief strategy for doing so will be to employ a set of responses that gradually transform the execution of the malicious code from operating on the actual resources to operating in asynthetic space that hides the actual resources and substitutes virtualized ones while additional information is gathered to determine whether or not the process is malicious and the nature of the attack being perpetrated. We refer to this technique ascontained execution. The prototype will establish the validity of our approach to complex event recognition and management by means of contained execution.