Automated Malware Generation for Avionics Cyber Resiliency

GrammaTech proposes the Malware Evolution ENgine (MEEN), an evolutionary system for generating malware targeting embedded systems, and detectors that can discover it.  MEEN evolves “malware templates” apart from the programs they are injected into, enabling it to evolve new kinds of malware.  Malware templates are then injected into the target system and further evolved to evade detection.  A separate population of malware detectors, based on anomaly detection, evolves against the evolved malware, gradually improving its detection capabilities.  After a run, MEEN produces a set of evolved malware templates which can be applied to similar software, a system infected with evolved malware, and malware detectors that are able to detect malicious behavior against the target system. MEEN builds on existing GrammaTech’s Bug-Injector technology and corpus of general malware templates.  It enhances the technology by making templates evolvable, adds new mutation operators to increase malware’s ability to evade detection and infection capabilities, and adds malware templates specific to systems representative of Air Force systems such as avionics and ISR.