Detection of Malicious Code
Abstract
Problem: DoD uses much software produced by various supply chains. These supply chains can be compromised by an adversary: Network intrusion; Insider threat. Failing to detect malicious code can be very costly. Detection is currently impractical. Specifically, we aim to detect two types of malicious code: Exfiltration of potentially sensitive information (e.g., keyloggers); Timebombs / logic bombs, Remote-Access Trojans, etc: Calling a potentially sensitive system API call (e.g., writing to a file, starting a new process, etc.) in response to a potentially questionable trigger (e.g., on a specific date, in response to incoming network packets, etc.).
Document Details
- Document Type
- Technical Report
- Publication Date
- Apr 01, 2023
- Accession Number
- AD1201268
Entities
People
- William Klieber
Organizations
- Carnegie Mellon University