CHARLES RIVER ANALYTICS, INC. — Department of Defense SBIR Phase I: N171-056

Description

Detecting cyber attacks before they have the chance to damage or compromise high-value or mission-critical systems is of critical importance to the US Navy. While there are many defenses available against cyber attacks, many are narrowly focused or usable only at certain levels of the software stack. In particular, application-level software is frequently the target of attacks, and can be extremely difficult to protect for a variety of reasons we will discuss. More specifically, attacks that operate on the memory space of applications are common, effective, and hard to detect using current approaches. Our system for Detecting Anomalies in Application Memory Space (DAAMS) will provide attack-detection capabilities for applications memory space that extend state-of-the-art anomaly detection techniques. We complement these anomaly detectors with an intelligent scenario generator that will generate a representative range of scenarios and inputs for the application to create offline learning data that will be used to learn how to detect normal and abnormal memory behavior during operations. This approach lets DAAMS detect memory-space anomalies without affecting the applications mission-time performance.