RAM LABORATORIES — Department of Defense SBIR Phase II: The defense of MDA computer networks has largely been left to security systems that operat

Description

The defense of MDA computer networks has largely been left to security systems that operate independently of the software on its nodes. These systems reside at points of interest on the network, monitor for anomalies, or simply restrict types of activities through intrusion detection systems or firewalls. Concerns with these defenses is that they fail to address the problems associated with attacks that originate from inside the network by a trusted user, and they don"t account for relationship between attack methods and the vulnerabilities of the underlying software that is targeted by the attack. This effort will develop a Real-time Application Software Analyzer (RASAr), with our team member at Auburn University"s Information Assurance Laboratory that fills the gap in network defenses by utilizing the intimate knowledge of the software on a particular node to guide the defense strategy. RASAr will provide analysis, verification, and monitoring capabilities for developed and deployed software. RASAr first analyzes the program to gain an understanding of the potential attack vectors used to exploit specific known vulnerabilities for source code and binaries. RASAr uses these analysis results to monitor for attacks that target specific vulnerabilities by identifying attacks targeted towards low-level procedure vulnerabilities in the software.