BRAVADO: Binary Rapid Automatic Vulnerability Attack and Defense Operations

Warfighter systems increasingly depend on complex software deployed in operational environments, making software vulnerabilities a critical point of failure. To address this, SIFT proposes BRAVADO (Binary Rapid Automatic Vulnerability Attack and Defense Operations), a system for automated binary-level vulnerability discovery, patching, and exploit construction. Unlike approaches that require source code, BRAVADO operates directly on binaries, making it applicable to a broad range of legacy and fielded systems. BRAVADO builds on prior SIFT research, including technologies developed for the DARPA Cyber Grand Challenge and the ongoing AIxCC competition. These efforts include LACROSSE, which integrates static and dynamic code analysis with large language models (LLMs) for automated vulnerability detection and patching in source code. BRAVADO will extend this capability to binaries and incorporate SIFTís Cyber Reasoning System (CRS), a distributed agent-based architecture that coordinates analysis, patching, testing, and exploit generation. The system supports both defensive and offensive use cases. For defense, it identifies and patches flaws leading to memory safety violations while verifying that patched binaries retain original functionality. For offense, it constructs executable exploit chains. Key innovations include LLM-guided binary patching, automated functionality testing, and an extensible agent architecture. BRAVADO aims to provide a generalizable and scalable solution for binary software assurance in resource-constrained and mission-critical environments.