Trait Analytic Program Search (TAPS)

This Phase II proposal expands upon the identification of steganography programs accomplished in Phase I and broadens the research to examine new methods of detecting polymorphic and metamorphic forms of malicious code. The goal of this effort is to develop a software-based forensic tool that will identify running software (through the analysis of memory snapshots) that contains contents or exhibits behavior consistent with polymorphic and/or metamorphic code. The rationale for the examination of memory snapshots is that both polymorphic and metamorphic forms of malware are most vulnerable when executing in memory.

This project contributes to the reduction of crime laboratory backlogs for computer evidence by increasing the speed and accuracy with which malware can be identified.

nca/ncf