Automatic identification of architecture and endianness using binary file contents
This publication is copyrighted. You may download, display and print it for Your own personal use. Commercial use is prohibited.
This thesis explores how architecture and endianness of executable code can be identified using binary file contents, as falsely identifying the architecture caused about 10% of failures of firmware analysis in a recent study by Costin et al. (2014) . A literature review was performed to identify the current state-of-the-art methods and how they could be improved in terms of algorithms, performance, data sets, and support tools. The thorough review identified methods presented by Clemens (2015) and De Nicolao et al. (2018) as the state-of-the-art and found that they had good results. However, these methods were found lacking essential tools to acquire or build the data sets as well as requiring more comprehensive comparison of classifier performance on full binaries. An experimental evaluation was performed to test classifier performance on different situations. For example, when training and testing classifiers with only code sections from executable files, all the classifiers performed equally well achieving over 98% accuracy. On samples with very small code sections 3-nearest neighbors and SVM had the best performance achieving 90% accuracy at 128 bytes. At the same time, random forest classifier performed the best classifying full binaries when trained with code sections at 90% accuracy and 99.2% when trained using full binaries. ...
Dataset related to the publicationhttps://github.com/kairis/isadetect
MetadataShow full item record
- Pro gradu -tutkielmat 
Showing items with similar title or keywords.
Ärje, Johanna; Melvad, Claus; Jeppesen, Mads Rosenhøj; Madsen, Sigurd Agerskov; Raitoharju, Jenni; Rasmussen, Maria Strandgård; Iosifidis, Alexandros; Tirronen, Ville; Gabbouj, Moncef; Meissner, Kristian; Høye, Toke Thomas (Wiley, 2020)Understanding how biological communities respond to environmental changes is a key challenge in ecology and ecosystem management. The apparent decline of insect populations necessitates more biomonitoring but the time-consuming ...
Hakola, Anna-Maria; Pölönen, Ilkka (SPIE, 2020)A hyperspectral (HS) image is typically a stack of frames, where each frame represents the intensity of a diﬀerent wavelength of light. Each spatial pixel has a spectrum. In the classiﬁcation of the HS image, each spectrum ...
Yan, Rui; Li, Fan; Zhou, Dong Dong; Ristaniemi, Tapani; Cong, Fengyu (Elsevier, 2021)Background: Sleep scoring is an essential but time-consuming process, and therefore automatic sleep scoring is crucial and urgent to help address the growing unmet needs for sleep research. This ...
Hämäläinen, Joonas; Kärkkäinen, Tommi (ESANN, 2020)Multi-target regression is a special subset of supervised machine learning problems. Problem transformation methods are used in the field to improve the performance of basic methods. The purpose of this article is to test ...
Vähäkainu, Petri; Lehto, Martti (Academic Conferences International, 2019)Artificial Intelligence (AI) is intelligence exhibited by machines. Any system that perceives its environment and takes actions that maximize its chance of success at some goal may be defined as AI. The family of AI ...