Protecting software from such attacks continues to be a challenge for critical systems. Since misbehaving software isn’t characterized by some universal pattern, it’s difficult to actively monitor systems to detect breaches and respond to them. In this project, GrammaTech researchers will use a combination of automatic program analysis and manual tuning techniques to develop a tool for creating a model of a system’s intended behavior, capturing its most important properties and determining what low level events must be tracked in order to observe the system’s critical behavior.
“An important aspect of this tool is that it will be easy for developers to use,” stated Tim Teitelbaum, GrammaTech’s CEO. “As the developer codes, the tool will capture his or her notion of what behavior is expected by creating a model that specifies a boundary the application shouldn’t cross. Our runtime monitors will then look for any unexpected behavior and take corrective action, even if the application has been compromised.”
The development of this tool will provide security-critical systems with an extra layer of protection against attacks, including attacks that don’t involve unusual system call activity. The technology will be immediately useful to branches of the government, financial institutions, and any companies whose systems require strenuous security protection.
About GrammaTech and CodeSonar:
GrammaTech’s static analysis tools are used worldwide by Fortune 500 companies, educational institutions, startups and government agencies. The staff includes 15 PhD experts in static analysis and a superb engineering team, all focused on creating the most innovative and in-depth analysis algorithms. The company’s flagship product, CodeSonar, is a sophisticated static analysis tool that performs a whole-program, interprocedural analysis on C/C++, Java and binary code, identifying complex programming bugs that can result in serious reliability or security problems. Learn more about CodeSonar.
