Automated Program Analysis for Cybersecurity (APAC) | Apply Online

Automated Program Analysis for Cybersecurity (APAC) (DARPA BAA 11-63) - FAQs

1) What is the APAC opportunity (DARPA BAA 11-63)?

APAC (Automated Program Analysis for Cybersecurity) is a DARPA research solicitation issued by the Defense Advanced Research Projects Agency (DARPA), specifically under the Information Innovation Office. It seeks research that pushes the boundaries of automated software security analysis.

2) What is the main goal of APAC?

The central goal is to fund fundamentally new ways to analyze programs automatically, at a strength level capable of proving that software satisfies security properties that matter to the Department of Defense (DoD). The emphasis is on high-assurance, automated analysis rather than basic bug-finding alone.

3) What kind of advances is DARPA looking for?

DARPA is looking for "revolutionary advances" in the underlying science and resulting capabilities of automated program analysis. The solicitation is explicitly not focused on incremental or evolutionary improvements to existing static analysis or testing tools.

4) Is this program about finding vulnerabilities and bugs?

The solicitation is not framed as traditional bug hunting. It focuses on automated analyses that can establish or certify security-relevant properties with a high degree of assurance, and then demonstrate those analyses in a real operationally relevant context.

5) What does DARPA mean by proving security properties?

Based on the synopsis, DARPA wants approaches strong enough to demonstrate that software satisfies specific security properties important to DoD. The opportunity emphasizes analysis techniques that can support proofs or verification-style assurance, not just heuristics or best-effort detection.

6) What is the required demonstration target for the research?

DARPA states a demonstration target of tools designed to keep malicious code out of DoD Android-based mobile application marketplaces. In other words, proposed techniques should be shown working as tools that can help screen Android applications and prevent harmful or stealthy apps from entering a defense-related app ecosystem.

7) Does DARPA require working tools, or is theory enough?

The synopsis indicates techniques are expected to be demonstrated in real tooling, not only as theory or non-deployable prototypes. The program ties research to a concrete operational screening scenario involving Android apps.

8) What types of proposals are specifically discouraged or excluded?

The announcement makes a point of excluding proposals that mainly produce evolutionary improvements to the existing state of practice. Proposals that only marginally improve existing analyzers, or that primarily scale known techniques without a major conceptual leap, are not aligned with the stated intent of APAC.

9) What kinds of approaches does APAC encourage?

APAC encourages new analysis paradigms, new proof or verification strategies, or novel combinations of formal methods and automation that change what is realistically provable about software security at scale (as described in the synopsis).

10) Which DARPA office is associated with this solicitation?

The opportunity is associated with DARPA's Information Innovation Office (as stated in the synopsis).

11) What is the CFDA number for this opportunity?

The opportunity is identified under CFDA 12.910, labeled as Research and Technology Development.

12) What funding instruments may be used for awards?

The synopsis lists potential funding instruments as cooperative agreements, other transactions, and procurement contracts. This reflects DARPA's flexibility in structuring research awards.

13) Is cost sharing or matching required?

No. The synopsis states that cost sharing or matching is not required.

14) Who is eligible to apply?

The listing states the opportunity is open to unrestricted applicants, meaning any type of entity may apply, subject to any clarifications contained in the full BAA text.

15) When was APAC posted?

The posted date shown in the synopsis is July 22, 2011.

16) Was the solicitation amended?

Yes. Amendment 1 was created on September 9, 2011, and it primarily updated the schedule.

17) What deadline change was made in Amendment 1?

Amendment 1 changed the proposal deadline from September 6, 2011 to September 14, 2011.

18) What time were proposals due on the closing date?

Submissions were due by 12:00 PM Eastern Time on the closing date.

19) What was the original closing date and time listed?

The synopsis notes the original closing date as September 6, 2011 at 12:00 PM Eastern Time.

20) What was the updated (current) closing date and time after the amendment?

The synopsis lists the current closing date as September 14, 2011 at 12:00 PM Eastern Time.

21) What does it mean that the opportunity moved to archive status?

The synopsis indicates the opportunity later moved to archive status, with an archive date of March 6, 2012. This generally signals the solicitation is no longer active for new submissions under that posting.

22) Are award amounts (floor/ceiling) specified in the synopsis?

The listing shows an award ceiling of 0 and an award floor of 0. This typically indicates that the public synopsis does not specify dollar bounds and that applicants should consult the full BAA document for funding expectations and related details.

23) Where should applicants look for full requirements and submission instructions?

The synopsis directs applicants to the attached DARPA BAA 11-63 document for full details, including scope and submission instructions.

24) Who is the point of contact for access issues?

The synopsis provides a point of contact for access issues: Timothy Fraser, BAA Coordinator.

25) Is APAC focused specifically on Android?

The synopsis includes a stated demonstration target related to Android: tools designed to keep malicious code out of DoD Android-based mobile application marketplaces. That makes Android application screening a concrete focus for demonstrating the proposed research.

26) What practical problem is the program trying to address through its demo target?

In practical terms, the demo target ties the research to preventing harmful or stealthy applications from entering an app ecosystem used in a defense context, by improving automated analysis strong enough to support high-assurance screening decisions.