.png){kind=icon}
返回
o-glasses: Visualizing X86 Code From Binary Using a 1D-CNN
.png){kind=icon}
OA
AI
DOI：10.1109/ACCESS.2020.2972358.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Malicious document files used in targeted attacks often contain a small program called shellcode. It is often hard to prepare a runnable environment for dynamic analysis of these document files because they exploit specific vulnerabilities. In these cases, it is necessary to identify the position of the shellcode in each document file to analyze it. If the exploit code uses executable scripts such as JavaScript and Flash, it is not so hard to locate the shellcode. On the other hand, it is sometimes almost impossible to locate the shellcode when it does not contain any JavaScript or Flash but consists of native x86 code only. Binary fragment classification is often applied to visualize the location of regions of interest, and shellcode must contain at least a small fragment of x86 native code even if most of it is obfuscated, such as a decoder for the obfuscated body of the shellcode. In this paper, we propose a novel method, o-glasses, to visualize the shellcode by recognizing the x86 native code using a specially designed one-dimensional convolutional neural network (1d-CNN). The fragment size needs to be as small as the minimum size of the x86 native code in the whole shellcode. Our results show that a 16-instruction-sequence (approximately 48 bytes on average) is sufficient for the code fragment visualization. Our method, o-glasses (1d-CNN), outperforms other methods in that it recognizes x86 native code with a surprisingly high F-measure rate (about 99.95%).
Keyword:
Binary analysis
CNN
machine learning
MLP
shellcode
visualization
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
3.6
论文数:
9.8W
被引数:
29.4W
机构
引用论文
分享收藏分享收藏Probing the Function of Nucleotides in the Catalytic Cores of the 8−17 and 10−23 DNAzymes by Abasic Nucleotide and C3 Spacer Substitutions.png)
Biochemistry
BiochemistryIF0
PREAI
分享收藏Viscosity of (C2–C14) 1-alkyl-3-methylimidazolium bis(trifluoromethylsulfonyl)amide ionic liquids in an extended temperature range(C2-C14) 1-烷基-3-甲基咪唑双 (三氟甲基磺酰基) 酰胺离子液体在扩展温度范围内的粘度
PREAI
分享收藏Swimming in Constricting (Elaphe g. guttata) and Nonconstricting (Nerodia fasciata pictiventris) Colubrid SnakesCopeia
CopeiaIF0
PREAI
分享收藏 没有更多内容
没有更多内容