17Q0065_Atch_SOW_FBO.pdf

RFQ No. FA5209-17-Q-0065 Attachment

STATEMENT OF WORK

FOR

DEPARTMENT OF THE ARMY

RESEARCH, DEVELOPMENT AND ENGINEERING COMMAND

INTERNATIONAL TECHNOLOGY CENTER-PACIFIC

(ITC-PAC)

Title: Scalable Malware and Vulnerability Analysis Using Program Metrics

(Document No. W90GQZ-71660038)

1. DESCRIPTION OF SERVICE.

This project aims to design and combine complexity metrics and vulnerability/malware metrics, and develop a program metrics-based security audit framework for real-world programs to identify the potentially malware/vulnerable functions that require further in-depth analysis. The metrics can also be used to suggest the appropriate program analysis technique to further analyze or conform those potential vulnerabilities/malwares.

The following sub-objectives will be addressed:

Basic Period

1. Collect a set of useful complexity metrics from the literature.

2. Design a set of vulnerability and malware metrics based on the understanding of the semantics of vulnerability and malware and the related program analysis methods.

3. Train an effective model using the complexity and vulnerability and malware metrics.

4. Apply the approach in open-source projects for vulnerability analysis, such as OpenSSL, libXML2, and Linux kernel.

5. Apply the malware analysis to the Android Malware Apps that Nanyang Technical

University (NTU) has collected so far.

Option 1 Period:

1. Milestone 1: Further design of vulnerability and malware metrics

2. Milestone 2: Continue developing effective risk model

3. Milestone 3: Refine open source projects and use cases

4. Milestone 4: Final demonstration of malware and vulnerability analysis

Duration of this Research and Development is 12 months with an option for an additional 12 months.

1.1. TASKS

These tasks will commence during the start of the period of performance and extend from the base through the option year as necessary.

1.1.1. Develop Metric-Based Security Framework

Complexity Metrics

Functions

Loops

Predicates

Vulnerability /Malware Metrics

Operations

Variables

Pointers

Metrics Combination

Manual Analysis

Machine Learning

Large‐Scale Experiments

Critical Libraries

Version‐Control Projects

GitHub Projects

This task will develop a program metrics-based security audit framework to identify the potentially vulnerable/malware functions and suggest appropriate program analysis methods to perform a thorough examination and in-depth analysis in the identified vulnerable/malware functions. The framework consists of three main parts: design complexity and vulnerability/malware metrics to characterize the target program, develop metrics combination methods to derive high-level metrics and to train an effective model, and conduct large-scale experiments to demonstrate the effectiveness of the proposed framework.

1.1.2. Design and Develop Complexity Metrics

This task will design the metrics based on the program structure (e.g., control-flow graph, call graph and loops) of the functions and the challenges in different program analysis techniques (e.g., interval analysis, value-set analysis, and constraint solving). Specifically, it will design function metrics (e.g., cyclomatic complexity, fan-in and fan-out) that can capture the coupling relationship with other functions, loop metrics (e.g., the number of single and nested loops in a function) that characterize the metrics of the key challenging structure in program analysis, and predicate metrics (e.g., the number of independent, control-dependent and data-dependent predicates in a function) that can characterize the difficulty of reaching the deeper part of a function.

1.1.3. Design and Develop Vulnerability/Malware Metrics

Thus task will first summarize the vulnerability types and malware families and the corresponding vulnerability and malware specification proposed in the literature. Then, we will study the vulnerability and malware specification for each type of vulnerability (e.g., buffer over/under flow, integer over/under flow, dangling pointers, and format string) and malware, and understand their underlying semantics. Finally, we will extract relevant rich vulnerability/malware metrics based on the semantics of the vulnerability/malware. Specifically, we will design vulnerability/malware metrics based on the fine-grained information that is closely related to vulnerabilities/malwares, i.e., operations (e.g., the number of >>/<< operations in a function), variables (e.g., the number of variables involved in <</>> expressions) and pointers (e.g., the number of pointer arithmetic).

1.1.4. Metrics Combination

Based on these complexity and vulnerability/malware metrics, this task will combine them in two ways. First, it will conduct manual analysis to link relevant metrics into a formula such that high-level metrics can be derived to characterize the target program. For example, you can derive how difficult to reach a vulnerable/malware function. Second, this will treat each metric as a feature, establish the data by compute the metrics for each known vulnerable/malware and invulnerable/benign function in target programs, and apply machine learning techniques to train an effective model. Based on such a model, we can apply classification on open-source projects such as OpenSSL, libXML2 and Linux kernel to explore potential vulnerabilities/malwares.

1.1.5. Conduct Large-Scale Experiments

To demonstrate the effectiveness of the proposed framework, this task will conduct large-scale experiments in three dimensions. First, it will apply the trained model to critical libraries (e.g., OpenSSL, libXML2 and Linux kernel) to identify the potentially vulnerable/malware functions and apply in-depth analysis to these identified vulnerable/malware functions for confirming vulnerabilities/malwares. Second, it will apply the trained model to different versions of a target project to perform trend analysis on vulnerability/malware. Finally, it will apply the trained model to various wild projects on GitHub for vulnerability analysis, and mobile apps NTU collected so far for the malware analysis.

1.2. DELIVERABLES.

1.2.1. First Deliverable (Basic Year) - Project Proposal.

Prior to commencement of work, the contractor shall submit ITC-PAC a Project Proposal which is to measure the progress of the Project, for ITC-PAC’s acceptance.

Project Proposal shall include, at a minimum, the following information:

Project title Investigators

- Name

- Position title

- Organization name

- Address

- Telephone number

- Fax number

- Email address

Concise summary Abstract Objectives Relevance to DoD Background Summary of project plan, expected project result and expected project benefit Project duration

Budget details (materials and supply, travel, etc.)

References

1.2.2. Second Deliverable (Basic Year) - Interim Report.

The contractor shall submit an interim report detailing the progress of the completed segments of the project to ITC-PAC at the end of the 6-month stage after commencement of work.

Interim Report shall include, at a minimum, the following information:

Status of project plan.

Progress project results for each task.

1.2.3. Third Deliverable (Basic Year) – (1) Publication Data, (2) Final Report of Basic Year, (3) Financial Report:

The contractor shall submit the Third Deliverable to ITC-PAC within 180 days after the Basic performance period ends.

(1) The contractor shall provide data and relevant supporting documentation.

(2) The contractor shall submit the Final Report of Basic Year with all the results, problems and/or discoveries encountered during the project.

The Final Report of Basic Year shall include, at a minimum, the following information:

- Name

- Position title

- Organization name

- Address

- Telephone number

- Fax number

(3) The contractor shall submit the Financial Report of this project.

The Financial Report of Basic Year shall include the cost spent for the Project in the following categories:

Labor Cost Travel Cost

1.2.4. Fourth Deliverable (Option 1 Period) – Project Proposal

Prior to commencement of this option period, the contractor shall submit ITC-PAC a Project Proposal which is to measure the progress of the Project, for ITC-PAC’s acceptance.

Project Proposal shall include, at a minimum, the following information:

- Name

- Position title

- Organization name

- Address

- Telephone number

- Fax number

- Email address

Concise summary Abstract Objectives Relevance to DoD Background Summary of project plan, expected project result and expected project benefit Project duration Budget details (materials and supply, travel, etc.)

References

1.2.5. Fifth Deliverable (Option 1 Period) - (1) Publication Data, (2) Final Report of Option Year, (3) Financial Report:

The contractor shall submit the Fifth Deliverable to ITC-PAC within 180 days after the Option performance period ends.

(1) The contractor shall provide data and relevant supporting documentation.

(2) The contractor shall submit the Final Report of Option 1 Period to ITC-PAC with all the results, problems and/or discoveries encountered during the project.

The Final Report of Option 1 Period shall include, at a minimum, the following information:

- Name

- Position title

- Organization name

- Address

- Telephone number

- Fax number

The research deliverables at the end of the option year are listed as follows:

1. A collection of selected complexity metrics from literature

2. The category of vulnerabilities/malware and the related metrics

3. The machine learning techniques used for prediction and model construction

4. A prototype system with user manual

5. A fully completed experimental study on the effectiveness and scalability, especially for real-world projects, of the proposed prototype system.

6. Published papers and technical reports

(3) The contractor shall submit the Financial Report of this project.

The Financial Report of Option 1 Period shall include the cost spent for the Project in the following categories:

Labor Cost Travel Cost

1.3. PAYMENTS.

1.3.1. First Payment – Basic Period.

After ITC-PAC’s acceptance of the First Deliverable (Project Proposal for Basic Period) mentioned above, the contractor shall submit the first invoice to ITC-PAC. The first payment will be made upon ITC-PAC’s certification of the invoice.

1.3.2. Second Payment – Basic Period.

After ITC-PAC’s acceptance of the Third Deliverable ((1) Publication Data, (2) Final Report of Basic Year, (3) Financial Report), the contractor shall submit the second invoice to ITC-PAC.

The second payment will be made upon ITC-PAC’s certification of the invoice. This shall constitute the final payment unless the Option is exercised.

1.3.3. Third Payment – Option 1 Period.

After ITC-PAC’s acceptance of the Fourth Deliverable (Project Plan for Option 1 Period) mentioned above, the contractor shall submit the third invoice to ITC-PAC. The third payment will be made upon ITC-PAC’s certification of the invoice.

1.3.4. Final Payment – Option 1 Period.

After ITC-PAC’s acceptance of the Fifth Deliverable ((1) Publication Data, (2) Final Report of Option 1 Period, (3) Financial Report), mentioned above, the contractor shall submit the final invoice to ITC-PAC. The final payment will be made upon ITC-PAC’s certification of the invoice.

2. GOVERNMENT FURNISHED PROPERTY. No government furnished property shall be provided nor used in this project.

3. GENERAL INFORMATION.

3.1. Contractor Employees. Personnel shall meet or exceed the following requirement:

3.1.1. Contractor shall not hire employees of the United States Government and/or employees otherwise under contract for service to the United States Government if employing such persons would create a conflict of interest, or appearance of a conflict of interest as determined by the contractor. Contractor shall not employ any person who is an employee of DoD, unless such person seeks and receives approval according to DODR 5500.7, Standards of Conduct.

4. GOVERNMENT POCS.

ITC-PAC: Dr. Neil Vallestero, Director, Cyber, Information and Network Sciences, Phone +65 6476- 9247, VallesteroNJ@state.gov

5. GENERAL INFORMATION.

5.1. Contractor Employees. Personnel shall meet or exceed the following requirement:

5.1.1. The Contractor shall not hire employees of the United States Government and/or employees otherwise under contract for service to the United States Government if employing such persons would create a conflict of interest, or appearance of a conflict of interest as determined by the Contractor. The Contractor shall not employ any person who is an employee of DoD, unless such person seeks and receives approval according to DODR 5500.7, Standards of Conduct.