Securely Taking On New Executable Stuff of Uncertain Provenance (STONESOUP) Proposers' Day SYNOPSIS The Intelligence Advanced Research Projects Activity (IARPA) will host a Proposers' Day Conference for the STONESOUP Program on July 23, 2009 in anticipation of the release of a new solicitation in support of the program. The Conference will be held at in the Washington, DC metropolitan area. The purpose of the conference will be to provide information on the STONESOUP Program, to address questions from potential proposers and to provide a forum for potential proposers to present their capabilities for teaming opportunities. This announcement serves as a pre-solicitation notice and is issued solely for information and planning purposes. The Proposers' Day Conference does not constitute a formal solicitation for proposals or proposal abstracts. Conference attendance is voluntary and is not required to propose to future solicitations (if any) associated with this program. PROGRAM DESCRIPTION AND GOALS Evaluating software to assure it has desired security properties is today a cumbersome and labor intensive process. Current evaluation techniques in support of software systems certification often require the creation of extensive documentation that may be used only by evaluators. Certification processes may not require examination of source code, where most vulnerabilities are introduced. The machine code that a computer actually executes is rarely subject to rigorous analysis. Further, software producers can issue updates and fixes at a rate faster than present processes can evaluate their effects. Recently, a market has developed in tools that can detect weaknesses in source or binary programs. Current tools generate reports of weaknesses, but these are intended for human review and invariably include substantial numbers of false positives. Even more seriously, these tools allow significant numbers of false negatives. The goal of the STONESOUP program is to develop and demonstrate technology to advance automated techniques for software analysis, to combine them with methods for confining software execution so that known weaknesses cannot be exploited, and to diversify software components so that residual vulnerabilities will be more difficult for attackers to discover or exploit. Tools that can operate on programs written in common, type-safe languages such as Java or C#, in flexible but harder-to-analyze languages such as C or C++, as well as programs only available in binary format are all of interest to the program. Collaborative efforts/teaming among potential performers is encouraged where it enables program success. In particular, groups that can combine strengths in the areas of program analysis, in confining the effects of identified weaknesses, and in methods for diversifying programs may be able to produce more effective and better integrated solutions. IARPA anticipates that based on the compelling strength of self-selected teams, universities and companies from around the world will participate in advancing the state of the art in this area. Researchers will be able to publish their findings in publicly-available, peer reviewed academic journals; however the primary goal of the program is to demonstrate successful prototypes that can satisfy the program objectives. REGISTRATION INFORMATION Attendees must register no later than 5:00pm EST, July 17, 2009 at https://conference.brtrc.com/stonesoup_pd/registration. Directions to the conference facility and other materials are available on the website. Due to space limitations, attendance will be limited to the first 100 registrants and to no more than 2 representatives per organization. All attendees will be required to present a government issued photo identification to enter the conference. ADDITIONAL INFORMATION The day will include Presentation & Poster sessions to provide an opportunity for attendees to present organization capabilities and to explore teaming arrangements. Details on the presentation and poster formats, and the procedure for submitting a request to present, will be provided after approval to register for the conference has been received. Presentations will be limited to 5 minutes with a maximum of 5 slides (MS PowerPoint or PDF format). Opportunities to present will be limited by time and will therefore be limited to the first 18 registered respondents with approved presentations, and the first 40 registered respondents with approved posters. It is the presenter's responsibility to ensure that all materials briefed are appropriately marked and approved for presentation by their organization. The IARPA Program Manager will review and approve all presentations. Presentations to the Government to solicit feedback is not intended, and Government personnel will not be present during these sessions. This Proposers' Day is intended for participants who are eligible to compete on the anticipated BAA. Other Government Agencies, Federally Funded Research and Development Centers (FFRDCs), and University Affiliated Research Centers (UARCs) will not be eligible to submit proposals to the anticipated BAA or participate as team members under proposals submitted by eligible entities. While such entities are not prohibited from attending the Proposers Day, due to space limitations, preference will be given first to those organizations that are eligible to compete. IARPA will not provide reimbursement for costs incurred to participate in this conference. Electronic devices with the ability to record are prohibited at this event. Questions concerning conference & registration can be sent to
[email protected]. Questions regarding the program can be sent to
[email protected].