Table of Contents Cert Research Vision Executive Summary 2009 Research Report Abstracts Applying Function Extraction (fx) Techniques to Reverse Engineer Virtual Machines Function Extraction for Malicious Code Analysis Metrics for Evaluating Network Sensor Placement Rayon: a Unified Framework for Dat

2009 The primary goals of the CERT ® Program are to ensure that appropriate technology and systems management practices are used to resist attacks on networked systems and to limit damage and ensure continuity of critical services in spite of attacks, accidents, or failures. CERT is part of the Software Engineering Institute (SEI), a federally funded research and development center (FFRDC) sponsored by the U.S. Department of Defense and operated by Carnegie Mellon University. The SEI advances software engineering and related disciplines to ensure systems with predictable and improved quality, cost, and schedule. This report describes how CERT research advanced the field of information and systems security during the 2009 fiscal year. Today we live in a world in which the threat of cyber attacks is ever-growing, and where threats from unknown sources are dynamic and constantly changing. It is seldom that a week goes by when articles on cyber security are not prominent in technical publications and popular media. It is the CERT Program's mission to identify, develop, and mature, and broadly transition new technologies, system development practices, and system management practices that enable informed trust and confidence in using information and communication technology. agencies, state and local governments, and other operators of infrastructures critical to the national defense, cyber security, and the national economy; the providers of information communications technologies (ICT) and services that support these system and network operators; the software development community; and computer security incident response teams with national responsibilities. The overall goal of our program is improved practices and technologies that are widely understood and routinely used to protect, detect, and respond to attacks, accidents, and failures on networked systems. Better informed, trained, and equipped people will produce better systems that will be better managed to reduce operational risk and the impact of cyber attacks. Our research strategy has been to build and maintain a technical center of excellence that uses its operational experience and expertise to look across the entire software life cycle (from requirements through development, deployment, operations, and maintenance) to • identify new technologies, development practices, and management practices that would significantly improve networked systems security and enterprise resiliency • mature these technologies and practices • apply these technologies to meet the needs of the program's stakeholders • transition these technologies into widespread use The transition activity pays special attention to education and training and recognizes the critical need to develop …