5. Tool Releases
The Atlas platform enables the creation of much more powerful analysis tools than would be possible starting from scratch and represents years of research and development in practical, highly scalable techniques for software analysis.
The Security Toolbox and the Flow Analysis Toolbox are furnished to the Government with unlimited rights. At the end of the project ENSOFT will furnish the Government with a perpetual organization-wide license of the version of Atlas necessary to run the final Security Toolbox and Flow Analysis Toolbox for the sole purpose of using the Security Toolbox and the Flow Analysis Toolbox at no additional cost. In addition, at the end of the project, ENSOFT will furnish the Government one year of complimentary maintenance, which includes ENSOFT's world-class support and all updates to Atlas during the maintenance period.
Any and all modifications to the Atlas platform remain the sole property of ENSOFT. All licenses of Atlas that will be furnished are for binaries of Atlas. ENSOFT will provide binaries to non-Government parties including ISU and performers in other technical areas as required. ENSOFT will provide source and binaries to the Government. This source code is licensed to the government for the sole purpose of building Atlas for use with the Security Toolbox and the Flow Analysis Toolbox. This source code may not be disclosed to non-Government parties and remains the sole property of ENSOFT.
Information about the commercial off the shelf (COTS) version of Atlas is available on the ENSOFT webpage [5]. Information about the XCSG schema and tutorials for learning Atlas are available online [6]. Several components of the Security Toolbox have been extracted into smaller general-purpose toolbox plugins and released under the MIT License [7].
6. Concluding Remarks
The DARPA APAC program gave us an opportunity to make three important technological advances:
- A graph database program analysis platform and a graph schema for representing program semantics that together facilitate both automation and human comprehension.
- Malware analysis techniques and their incorporation in a security toolbox to provide man-machine analysis system to detect novel, sophisticated Android malware.
- An innovative technique to summarize large software libraries and its incorporation in the FlowMiner tool that mines expressive, compact information flow summaries from a library for accurate and scalable partial program analysis.
These technological advances have enabled us to perform well in challenge engagements. In almost every engagement our team’s analysis times were lower than those of all other performers. We attribute the speed and accuracy of our analysis to the maturity of our tools and their capabilities to quickly traverse and answer complex queries about very large code. We believe that this is a highly relevant capability of any malware detection tool. We were continually complemented on the maturity and usability of our tool by the Red teams. We believe our tool capabilities matured significantly as a result of the engagements, but since we cannot quantitatively define the difficulty of malware it is difficult to prove.
The APAC Board Area Announcement (BAA) listed developing practical program analysis tools to keep malware out of Department of Defense (DoD) app stores as a primary goal for the program. To determine tool relevance the challenge app reports requested written explanations of how the tooling was relevant to solve the challenge, but in many cases a tool’s relevancy would be better demonstrated through a video or live demo at program meetings. Our team made strong efforts to provide demonstrations of our tool at PI meetings and to interested parties, but several teams did not.
The Red team was able to craft very domain specific malicious vulnerabilities, such as a custom protocol that when combined with another instance of itself causes a broadcast storm of messages (SMSBot from engagement 2B). The crucial difficulty lies in generating a good malware hypothesis. Coming up with the right theorem is itself the difficult part!
In the beginning our team was the only team that proposed a human-in-the-loop process, but it seems the teams that proposed fully automated processes all underestimated the importance of the human role and adopted similar strategies to our team’s proposal as the program progressed. In our opinion, significant new research is warranted to enable the human analyst generate domain-specific malware hypotheses.