A Tool for Detecting the Existence of Unknown Corruptions in Real-Time

This research will investigate a practical technique for detecting the existence of computer viruses and other software corruptions in real-time. As one goal of the SBIR-subtopic is audit-analysis tools that are amenable to real-time systems, our innovation will allow DARPA to detect worrisome behavior and apply appropriate roll-back mechanisms before problems propagate to an unacceptable level. Our approach tries to differentiate between odeling intent. One way to do this is by creating a set of expectations about the behavior of programs and detecting deviations from those expectations. We will begin this effort by providing a mathematical model of program execution and describing the difference between legitimate and illegitimate program behavior based on expectations. Next we will investigate the difficulties in applying this model to practical situations by showing the computational complexity associated with simplistic application of the model. We will go on to discuss the application of AI techniques (such as connectionist modeling) to the problem of anomaly detection. We will then discuss some of the risks associated with these less accurate implementations that eliminate complexity in exchange for accuracy. Finally, we plan to develop tool-design requirements leading to the prototyping of such an innovation.