U.S. flag

An official website of the United States government, Department of Justice.

Dot gov

The .gov means it’s official.
Federal government websites always use a .gov or .mil domain. Before sharing sensitive information online, make sure you’re on a .gov or .mil site by inspecting your browser’s address (or “location”) bar.


The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Trait Analytic Program Search (TAPS)

Award Information

Award #
Congressional District
Funding First Awarded
Total funding (to date)

Description of original award (Fiscal Year 2007, $68,000)

This project will aid computer forensic investigators and examiners by developing a tool or set of tools to detect malicious software that is used to perform Steganography or data hiding functions without the use of hash-based searches for specific files. Examining programs in their disk-resident, static form, the Trait Analytic Program Search (TAPS) compares files to known models of steganographic programs and attempts to determine if a given executable file is malicious.


This Phase II proposal expands upon the identification of steganography programs accomplished in Phase I and broadens the research to examine new methods of detecting polymorphic and metamorphic forms of malicious code. The goal of this effort is to develop a software-based forensic tool that will identify running software (through the analysis of memory snapshots) that contains contents or exhibits behavior consistent with polymorphic and/or metamorphic code. The rationale for the examination of memory snapshots is that both polymorphic and metamorphic forms of malware are most vulnerable when executing in memory.

This project contributes to the reduction of crime laboratory backlogs for computer evidence by increasing the speed and accuracy with which malware can be identified.


Date Created: September 11, 2007