U.S. flag

An official website of the United States government, Department of Justice.

Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Trait Analytic Program Search (TAPS)

Award Information

Awardee
WetStone Technologies, Inc.
Award #
2007-DN-BX-K187
Funding Category
Competitive
Location

Ithaca, NY

Congressional District
23
Status
Closed
Funding First Awarded
2007
Total funding (to date)
$167,991
Original Solicitation
NIJ FY 07 Electronic Crime and Digital Evidence Recovery: Invited Full Proposals

Description of original award (Fiscal Year 2007, $68,000)

This project will aid computer forensic investigators and examiners by developing a tool or set of tools to detect malicious software that is used to perform Steganography or data hiding functions without the use of hash-based searches for specific files. Examining programs in their disk-resident, static form, the Trait Analytic Program Search (TAPS) compares files to known models of steganographic programs and attempts to determine if a given executable file is malicious.

ca/ncf

This Phase II proposal expands upon the identification of steganography programs accomplished in Phase I and broadens the research to examine new methods of detecting polymorphic and metamorphic forms of malicious code. The goal of this effort is to develop a software-based forensic tool that will identify running software (through the analysis of memory snapshots) that contains contents or exhibits behavior consistent with polymorphic and/or metamorphic code. The rationale for the examination of memory snapshots is that both polymorphic and metamorphic forms of malware are most vulnerable when executing in memory.

This project contributes to the reduction of crime laboratory backlogs for computer evidence by increasing the speed and accuracy with which malware can be identified.

nca/ncf

Date Created: September 11, 2007