Detection of Malicious Code

Problem: DoD uses much software produced by various supply chains. These supply chains can be compromised by an adversary: Network intrusion; Insider threat. Failing to detect malicious code can be very costly. Detection is currently impractical. Specifically, we aim to detect two types of malicious code: Exfiltration of potentially sensitive information (e.g., keyloggers); Timebombs / logic bombs, Remote-Access Trojans, etc: Calling a potentially sensitive system API call (e.g., writing to a file, starting a new process, etc.) in response to a potentially questionable trigger (e.g., on a specific date, in response to incoming network packets, etc.).