This awardee has received supplemental funding. This award detail page includes information about both the original award and supplemental awards.
Description of original award (Fiscal Year 2007, $68,000)
This project will aid computer forensic investigators and examiners by developing a tool or set of tools to detect malicious software that is used to perform Steganography or data hiding functions without the use of hash-based searches for specific files. Examining programs in their disk-resident, static form, the Trait Analytic Program Search (TAPS) compares files to known models of steganographic programs and attempts to determine if a given executable file is malicious.
This Phase II proposal expands upon the identification of steganography programs accomplished in Phase I and broadens the research to examine new methods of detecting polymorphic and metamorphic forms of malicious code. The goal of this effort is to develop a software-based forensic tool that will identify running software (through the analysis of memory snapshots) that contains contents or exhibits behavior consistent with polymorphic and/or metamorphic code. The rationale for the examination of memory snapshots is that both polymorphic and metamorphic forms of malware are most vulnerable when executing in memory.
This project contributes to the reduction of crime laboratory backlogs for computer evidence by increasing the speed and accuracy with which malware can be identified.