TRAIL OF BITS INC — Department of Defense STTR Phase I: N18A-T018
TRAIL OF BITS INC — STTR Phase I award from Department of Defense.
Phase I STTR feasibility signal
- Phase I awards fund proof-of-concept work. For capture teams, they mark early interest from Department of Defense in a technical approach.
- Watch for Phase II follow-ons from the same firm/topic family — that conversion path is where budgets and transition pressure rise.
- Obligated amount $124,739. Cross-check similar awards in the same agency and technology tags for going-rate context.
- Topic code N18A-T018 links this award to a solicitation family — search the same topic stem for incumbents and recompete timing.
- Amount
- $124,739
- Agency
- Department of Defense · Navy
- Program / Phase
- STTR · Phase I
- Topic
- N18A-T018
- Solicitation
- 2018.0
- NAICS
- —
- Place of performance
- NY
- Period
- 2018-06-04 → 2018-12-04
Description
Standard protocols such as SSL, SSH, etc. are implemented as one-size-fits-all libraries. To maximize compatibility, these libraries implement rarely used features that increase attack surface. Examples include the SSL Heart Beat feature (HeartBleed) and weak SSH ciphers (LOGJAM).<br><br>The Navy would like to reduce software attack surface by removing unused protocol features. Our proposal, LeastProtocol, aims to develop a means to identify and eliminate features from existing software binaries. We will base our feature removal and identification research on two techniques: monitored execution and differential slicing. Multiple research papers have demonstrated that monitored execution combined with statistical techniques can map coarse protocol features to implementation code. Differential slicing compares two program executions and identifies locations where execution differs, enabling precise feature identification.<br><br>For Phase 1, we will implement a proof of concept that works on a single protocol and implementation. The protocol and implementation will be of a real, deployed protocol but limited to open source software that runs on x86 Linux. We envision LeastProtocol will accept a protocol specification, a list of features, and a program binary. The tool will output a new binary that speaks the same protocol sans unwanted features.