table

# A Natural Language Processing Approach for Instruction Set Architecture
Identification

Dinuka Sahabandu1, Sukarno Mertoguno2, and
Radha Poovendran1 1Dinuka Sahabandu and Radha Poovendran are with the Network
Security Lab, Department of Electrical and Computer Engineering, University of
Washington, Seattle, WA 98195-2500<EMAIL_ADDRESS>Mertoguno is
with the Institute for Information Security & Privacy, Georgia Institute of
Technology, North Avenue, Atlanta, GA 30332<EMAIL_ADDRESS>
###### Abstract

Binary analysis of software is a critical step in cyber forensics applications
such as program vulnerability assessment and malware detection. This involves
interpreting instructions executed by software and often necessitates
converting the software’s binary file data to assembly language.  The
conversion process requires information about the binary file’s target
instruction set architecture (ISA). However, ISA information might not be
included in binary files due to compilation errors, partial downloads, or
adversarial corruption of file metadata. Machine learning (ML) is a promising
methodology that can be used to identify the target ISA using binary data in
the object code section of binary files.  In this paper we propose a binary
code feature extraction model to improve the accuracy and scalability of ML-
based ISA identification methods. Our feature extraction model can be used in
the absence of domain knowledge about the ISAs. Specifically, we adapt models
from natural language processing (NLP) to i) identify successive byte patterns
commonly observed in binary codes,  ii) estimate the significance of each byte
pattern to a binary file, and iii) estimate the relevance of each byte pattern
in distinguishing between ISAs. We introduce character-level features of
encoded binaries to identify fine-grained bit patterns inherent to each ISA.
We use a dataset with binaries from 12 different ISAs to evaluate our
approach.  Empirical evaluations show that using our byte-level features in
ML-based ISA identification results in an $8\%$ higher accuracy than the
state-of-the-art features based on byte-histograms and byte pattern
signatures. We observe that character-level features allow reducing the size
of the feature set by up to 16x while maintaining accuracy above $97\%$.

##  I Introduction

Modern technological devices such as computers and mobile phones contain
firmware and software that consist of thousands of lines of source code [1].
Developers deliberately make the source code unavailable to the public for
proprietary and security reasons [2, 3]. Methods to restrict access to the
source code include encryption and obfuscation in order to restrict software
piracy and mitigate malicious code injection [4, 5]. On the other hand, the
source code of malicious software (malware) can also be obfuscated by cyber
adversaries to avoid being analyzed by security experts [6]. Consequently,
cyber forensics applications such as assessing potential program
vulnerabilities [7, 8] and malware detection [9, 10, 11] study the
functionality of software by analyzing their binary files. Binary files store
the compiled source code as a string of “0"s and “1"s (binaries) interpretable
to computer processors. Identifying control paths, data flows, and data types
required for assessing content and structure of undisclosed source code often
requires converting binaries to assembly language [12, 13, 14]. This is called
disassembly process.

The disassembly process requires information about the type of processor
Instruction Set Architecture (ISA) on which the binaries are expected to run,
instruction length, and endianness [12] (Examples in Table 1).

Disassembly Info. | Examples
---|---
| Instruction set
---
architecture
| ARM, MIPS, x86, AVR,
---
PowerPC, SPARC, s390
Instruction length | 16-bit, 32-bit, 64-bit
Endianness | little-endian, big-endian
TABLE 1: Examples for different disassembly information

The disassembly information is extracted from the file header (e.g., ELF
header, PE header) or file name (e.g., .exe for 32-bit x86, 64.exe for 64-bit
x86) of binary files.  However, these meta-data can be incomplete or missing
due to compilation errors or partial downloads. Cyber adversaries have been
observed to tamper with these metadata fields in order to remain hidden after
carrying out an attack [15, 16].

In the absence of information on ISA type, multi-architecture disassemblers
such as Ghidra [17], IDA Pro [18], and Capstone [19], and firmware analysis
tools such as Binwalk [20] have been employed to predict the target ISA. Such
methods are based on brute forced disassembling of binaries and inspecting
assembly codes for known architecture-specific signatures. However, modern
computer systems like severs consist of multiple devices such as CPUs, GPUs,
and network cards, each of which uses different types of virtual and physical
process architectures [21]. The increasing number of different ISA types makes
brute forced disassembling-based ISA identification computationally
infeasible. The lack of information on target ISA can thwart the disassembly
process and affect many cyber forensics applications such as software security
assessments [22, 23] and cyber threat hunting [24, 25, 26]. Consequently,
methods that enable accurate prediction of target ISA solely based on
information extracted from (partial) binaries have gained attention recently.

Machine Learning (ML) has been explored as a methodology to predict ISA using
features extracted from the object code section of binary files (e.g., byte-
histograms and byte signatures) [27, 28, 29, 30, 31, 32]. However, accuracy
and scalability of ML-based techniques are affected by the following
limitations of existing object code features.  (i) Lack of generalizability:
Preselected byte signatures included in feature set for capturing properties
of ISA such as endianness may not necessarily be present in some (partial)
binaries, (ii) Noisy data: The byte patterns that are commonly observed across
the binaries of different ISAs (e.g., 0x00111This paper used the standard
prefix notation 0x to indicate that the subsequent number is in the
hexadecimal format. byte patterns) are assigned high importance, leading to
erroneous predictions of ISAs, and (iii) Low resolution: Byte-level
granularities might not capture fine-grained bit patterns embedded in the
object code of binary files. Enhancing the capabilities of ML-based ISA
identification therefore requires an approach to characterize features that
will highlight ISA-specific bit patterns that are frequently present in
binaries of the corresponding architecture.

We observe that natural language processing (NLP) research provides wide range
of models to extract features from text data for applications such as document
classification and email filters [33]. We then observe that the object code
binaries (i.e., machine language) which defines instructions for machines are
generated according to a set of well-defined rules similar to the natural
language texts that convey messages to human. Based on these two observations,
we propose to use models from natural language processing (NLP) to extract
features from object code binaries. Specifically, we use the N-gram term
frequency-inverse document frequency (TF-IDF), a widely explored technique in
NLP research for extracting a set of informative and discriminating text
patterns [34, 35]. The binary code feature extraction techniques that we
introduce do not require any expert knowledge about the ISAs.  We make the
following contributions.

  * •

We observe that successive bytes in object code binaries have correlated
patterns specific to the ISA. We use byte-level $N$-gram TF features to
extract such patterns.

  * •

We scale byte-level $N$-gram TF features using their respective IDF values to
reduce the effect of noisy data and increase the sensitivity to byte patterns
that characterize the ISA.

  * •

We observe that instruction bytes of binaries have fine grained bit patterns
specific to the ISA and we use character-level $N$-gram TF-IDF features of
encoded binaries to extract such patterns.

  * •

We use a dataset with binaries from 12 ISAs and show that byte-level
$(1,2,3)$-gram TF-IDF features yield high accuracy (99%) compared to the
existing byte-histogram and signature-based features (91%).

  * •

We show that character-level $(1,2,3)$-gram TF-IDF features extracted from
encoded binaries yield high accuracy with $16\times$ fewer features compared
to the number of byte-level $(1,2,3)$-gram TF-IDF features.

The remainder of this paper is organized as follows. Section II provides the
preliminaries on binary files and $N$-gram TF-IDF feature model from NLP.
Section III presents related work. Section IV presents the proposed NLP and
encoding-based object code feature selection methods. Sections V and VI
details the experiments and presents the experimental results. Section VII
provides concluding remarks.

##  II Preliminaries

In this section we present preliminaries on binary files and some
characteristics of binaries that can be leveraged to identify the ISA.

###  II-A Structures of Binary Files and Instruction Sets

We first detail the relevant components of the binary files studied in this
paper. Then we introduce the concept of an ISA and two components of a binary
instruction: opcode and operand.

A binary file consists of instructions and resources (e.g., data values,
memory addresses, file meta-data such as file size) that are stored as “0"s
and “1"s (binaries). Typically binaries are structured as 8-bit (1-byte) terms
(e.g., 11010111 01000011). An 8-bit binary term is often represented as a two-
digit Hexadecimal (Hex) number for ease of analysis (e.g., 11010111 01000011
in binary = d7 43 in hex). In this paper we focus on binary files
corresponding to executable files, compiled programs, and operating system
files that can be processed and executed by a computer to carry out tasks
(e.g., computer programs).

File header (e.g., ELF header, PE header) and object code are two important
components of binary files required for their analysis. File header provides
file meta-data such as file size, instruction length (e.g., 16-bit, 32-bit,
64-bit), details of any object code sections, and instruction set architecture
of the processor that runs the binaries. The object code section contains
binaries related to set of instructions. In this paper we assume file headers
of the binary files are missing and only (partial) object code of binary files
are available for analysis.

Instruction Set Architecture (ISA) specifies rules for interpreting
instructions in object code binaries to the processor. Examples of popular
ISAs include ARM, MIPS, and x86_64. The instruction length of an ISA indicates
the number of consecutive bytes that defines one instruction for the
processor. Architectures such as ARM and MIPS support fixed length (mostly
32-bit) instructions (Fig. 1 and Fig. 2) whereas x86_64 supports variable
length instructions (Fig. 3).

Figure 1:  32-bit data processing instruction format of ARM architecture [36].
Cond: Condition field, I: Immediate operand, Opcode: Operation code, S: Set
condition codes, Rn: 1st operand register, Rd: Destination register.
Typically, the opcode which defines the arithmetic and data operations (e.g.,
Add, Store) to be carried out by the processor occupies fewer bits in an
instruction compared to the operand which specifies the data values and
memory/register addresses. Figure 2: Three different 32-bit instruction
formats of MIPS architecture [37]. Rs: Source register, Rt: Source/destination
register, Rd: Destination register, Shamt: Shift values, Funct: Instructions
to harware, Immediate value: Stores the constant values used in the immediate
instructions (e.g., ADDI: add immediate). R format is used for the most
arithmetic and logic instructions (e.g., ADD, XOR). I format is used for the
data transfer, immediate and conditional branch instructions (e.g., MOVE,
ADDI, BEQ: branch on equal). J format is used for unconditional jump
instructions (e.g., JMP).  Figure 3: Variable length instruction format of
X86_64 architecture [38]. ModR/M: used for memory addresses or opcode
extensions, SIB: Scaled index byte. The length of an X86_64 instruction
depends on the size of opcode or the usage of ModR/M and SIB.

Opcode and operand are two main parts of a binary instruction. The opcode
specifies the data transfer, arithmetic and logic, control, and floating point
operations that need to be carried out by the processor. Length of an opcode
varies both between and within different architecture types (e.g., 4-bit ARM
opcodes in Fig. 1 vs. 6-bit MIPS opcodes in Fig. 2 vs. 1,2 or 3-byte x86_64
opcodes in Fig. 3). The operand specifies the data values and memory/register
addresses that are used in the operations specified by the opcode. The length
of an operand depends on both architecture type and the type of data that it
stores (e.g., 4-bit ARM destination register (Rd) address in Fig. 1 vs. 5-bit
MIPS R format Rd address in Fig. 2 vs. 26-bit MIPS J format memory address in
Fig. 2). Architectures have multiple instruction formats to support operations
that use different type and number of operands (e.g., R, I and J instruction
formats in Fig. 2).

###  II-B Endianness of an Instruction Set Architecture

The endianness defines the byte order of a multi-byte data variable
representation. There are two types of endianness: (i) little-endian and (ii)
big-endian. Under little-endian representation of a 2-byte number, the most-
significant byte occupies the lowest memory address. In big-endian
representation, the least-significant byte occupies the lowest memory address.
For example, a data variable with value 1 is stored as 0x0100 and 0x0001 under
little-endian and big-endian 2-byte representations, respectively. Examples of
common little-endian ISAs include ARM, AVR, and x86_64. ISAs such as MIPS,
PowerPC, and SPARC use big-endian representation.

###  II-C $N$-gram Term Frequency-Inverse Document Frequency

$N$-gram, Term Frequency (TF), and Inverse Document Frequency (IDF) are widely
used feature methods in Natural Language Processing (NLP) tasks such as text
mining and auto-completion of sentences [34, 35, 39, 40]. We provide the
definitions and discuss some of the characteristic properties of these NLP-
based feature methods below.

######  Definition II.1 ($N$-gram)

An $N$-gram is a contiguous sequence of $N$ terms (e.g., characters, words) in
the content of a document (e.g., text message, news article). Typically,
$N$-grams are extracted by moving a window of length $N$ forward, one222NLP
applications that involves learning subject-verb relationships and word
semantics in languages may require moving the window forward by multiple
terms. term at a time, along the content of a document.

######  Definition II.2 (Term Frequency [34])

The term frequency (TF) is the number of times each term appears in a
document. Typically, TF values are divided by the total number of terms
(normalized) in the document to mitigate the effect of the document
length333Documents can have different lengths with regard to the number of
terms recorded in them. In such scenario, a term $\tau$ may appear more
frequently in longer documents compared to shorter documents. Hence
unnormalized TF values of $\tau$ in longer documents will be higher than the
values corresponding to shorter ones faulty indicating $\tau$ is more dominant
pattern inherent to longer documents.. TF of a term $\tau$ is

$\mbox{TF($\tau$)}=\frac{\mbox{\\# of times $\tau$ appeared in the
document}}{\mbox{\\# of terms in the document}}.$ (1)

######  Definition II.3 (Inverse Document Frequency [34])

The inverse document frequency (IDF) measures the informativeness of terms in
a collection of documents (corpus). It assigns lower values to terms that
commonly appear among the documents in the corpus as they do not contribute in
distinguishing the contents of documents. Conversely, higher values are
assigned to the less frequent terms in the corpus as they may constitute
patterns inherent to the content of the documents. IDF of a term $\tau$ is

$\mbox{IDF($\tau$)}=\log\left(\frac{\mbox{\\# of documents in the
corpus}+1}{\mbox{\\# of documents with $\tau$}+1}\right)+1.$ (2)

######  Definition II.4 (TF-IDF [34])

The TF-IDF is a statistic that measures the importance of a term to a document
in a corpus. TF-IDF value of a term $\tau$ is defined as:

$\mbox{TF-IDF($\tau$)}=\mbox{TF($\tau$)}\times\mbox{IDF($\tau$)}$ (3)

In the context of NLP tasks, the $N$-gram TF-IDF presents a way to associate
meaningful numerical values to words (i.e., scoring of words) that can be
provided as the inputs to the ML models. A number assigned to a $N$-gram word
in a document under $N$-gram TF-IDF method is increased proportionally by the
number of times the corresponding $N$-gram word appears in the particular
document, but is decreased by the number of documents that contain the word.
Therefore, words that are common in each document, such as “a", “the", “and",
“this", “that", and “if" will have lower TF-IDF values even though they may
appear frequently, as they do not help in identifying the content of a
document in particular. However, if a specific $N$-gram word appears
frequently in a document (or a smaller subset of documents), while not
appearing frequently in others, it probably means that this particular
$N$-gram word is very relevant to the content of the document (or the subset
of documents).  For example, if a $1$-gram word “Computer" appears frequently
in $20$ web articles out of $1000$, then it is likely that these $20$ articles
are related to computers.

###  II-D Encoded Binaries

A binary-to-text encoding converts binary data to a sequence of printable
characters. Such encodings are necessary for transmission of data when the
communication channels do not allow binary data (such as email or Network News
Transfer Protocol-NNTP). Rows III-VI in Table 2 below present examples of the
binary code in Row I encoded into four popular binary-to-text encoding
methods; Base16, Base32, Base64, and Base 85, respectively.

Under Base16, every byte of binary data is encoded to 2 characters. Base32
encodes 5-bytes of binary data into 8 characters. Base64 encodes 3-bytes of
binary data into 4 characters. Lastly, Base85 encodes 4-bytes of data into 5
characters. The suffix of the encoding method name provides the number of
distinct characters included in the alphabet of the encoding method. For
example Base16 alphabet consists of 16 characters; digits $0-9$, and letters
$A-F$. Additionally, Base32 and Base64 encoding use a padding character,
“$=$".

| File format | Example
---|---|---
I | Binary |  | 11010111 01000011 11010100 01000100
---
11010110 01000100 11011000 01000101
II | Hex | d7 43 d4 44 d6 44 d8 45
III | Base16 encoded | D743D444D644D845
IV | Base32 encoded | 25B5IRGWITMEK===
V | Base64 encoded | 10PURNZE2EU=
VI | Base85 encoded | f0e%UejS.Z

TABLE 2: An example illustrating different binary files formats. Binary data
in row I has been grouped into 8-bit values to represent 1-byte of data
following the normal convention. Row II shows the hexadecimal (Hex)
representation of the binaries in row I. Row III, Row IV, Row V, and Row VI
present the Base16, Base32, Base64, and Base85 encoding of the binaries given
in Row I, respectively.

##  III Related Work

In this section we first present an overview of binary code feature extraction
techniques proposed in the literature for different applications. Then we
present existing binary code features used for ML-based ISA identification and
provide a brief review of cyber security applications that use the N-gram TF-
IDF feature model.

Feature extraction from binaries has been widely studied in the areas of ML-
based malware detection [41, 42, 43] and file type identification [44, 45,
46]. The authors of [41] presented a feature extraction method for malware
detection that uses information gain to select top 500, 4-gram byte patterns
found in the training set binaries. The work in [42] proposed malware
detection using a set of features composed with byte entropy histograms,
string 2D histograms, and vectors corresponding to the hash values of binary
file’s metadata and import address tables. The authors of [43] combined the
Boolean features related to the usage of dynamic-link library (DLL) files,
function calls, GNU strings, and byte sequences to detect malware. The work in
[44] introduced byte frequency distributions (BFDs) of object code and file
header/trailer, and byte frequency cross-correlation distribution for file
type identification. The authors of [45] suggested file type identification
using a combination of the BFD and the frequency distribution corresponding to
the rate of change of the byte content. The authors of [46] used cosine
similarity of BFD features to predict the file type.

ML frameworks presented in [27] and [28] use information gain based top $N$
4-gram byte features for target architecture identification of firmware
binaries. However, these approaches assume that a single instruction is stored
in four bytes (32-bit) and hence are not suitable when identifying
architectures that use different byte sizes (e.g., 8-bit, 16-bit, 64-bit) or
variable length instructions (e.g., x86_64) to store instructions. Moreover,
information gain computations require finding the number of different
instruction set bit patterns recorded in each 4-gram byte pattern
corresponding to each target architecture considered. Such a pattern searching
procedure becomes computationally exhaustive when the number of target
architectures is increased.

The author of [29] proposed to combine the byte-histogram features (i.e., BFD)
with a set of features that capture endianness of binaries for ISA
identification. Under this method, all the features are extracted from the
decoded program binaries (files in binary or hex format). First for each
binary file, a normalized byte-histogram is generated by counting all
individual byte values in the file content. This provides $256$ features. The
endianness features are extracted by counting byte pairs which correspond to
code sections – which increment by one (0x0001 vs 0x0100) – as well as those
sections that correspond to a decrement by one (0xfffe vs 0xfeff).  The
authors of [30] adapted the byte-histogram along with endianness features
introduced in [29] and proposed a simplified technique to determine the
endianness of a binary file. Under the simplified endianness features, if it
was found that there were more 0x0001’s than 0x0100’s then the entry of the
feature vector corresponding to the big endianness was assigned a value of 1
and the entry corresponding to the little endianness was assigned 0. If it is
found that the abundance is of the form 0x0100, then the reverse assignments
are made.

Recently, the works [31] and [32] extended the byte-histogram and endianness
features introduced in [29] by adding additional signature-based features
extracted from the function epilogue and function prologue sections.
Specifically, [31] introduced 31 new signature-based features extracted from
binary files of amd64, arm, armel, mips32, powerpc, powerpc64, s390x and x86
ISAs. The authors of [32] introduced two additional signature-based features
to identify powerpc ISAs. However, there is no guarantee that these signature-
based features are included in partial binaries. As observed in [31],
extending signature-based features to identify additional ISAs will require
significant effort and expert knowledge. Additionally, we note that the byte-
histogram or BFD features are susceptible to frequent byte patterns commonly
observed among binaries of different architectures (i.e., noisy byte
patterns).

The N-gram TF-IDF feature model has been used in cyber security applications
such as software vulnerability assessments [47, 48] and cyber threat detection
[49, 50, 51, 52]. The authors of [47] used TF-IDF features extracted from bug
reports to develop a tool for identifying software bugs. The work presented in
[48] used TF-IDF features of Android application package’s (Apk’s) manifest
file to evaluate the security of Android applications. The authors of [49]
extracted TF-IDF features from process logs to build an intrusion detection
system for a computer network. The research presented in [50] used TF-IDF
features extracted from opcode sequences to classify ransomware families. The
authors of [51] and [52] used TF-IDF features extracted from Application
Programming Interface (API) call sequences for malware classification.

Binary file format |  Granularity of features | Number of features
---|---|---
1-gram |  2-gram |  3-gram | Total
Base16 encoded |  character |  16 |  256 |  4096 |  4368
Base32 encoded |  character |  32 |  1024 |  5000 |  6056
Base64 encoded |  character |  64 |  4096 |  5000 |  9160
Base85 encoded |  character |  85 |  7225 |  5000 |  12310
Decoded (in Hex) |  byte |  256 |  65536 |  5000 |  70792

TABLE 3: Details of the (1,2,3)-gram TF-IDF features extracted from the
different encoded binary file formats.

##  IV Proposed NLP Approaches for Object Code Feature Extraction

In this section we propose two object code feature selection methods named
byte-level (1,2,3)-gram TF-IDF features (Section IV-A) and encoded character-
level (1,2,3)-gram TF-IDF features (Section IV-B) for ML-based ISA
identification. We first present the key observations that motivate the
$N$-gram TF-IDF structure of the two object code feature methods.

The accuracy of instruction set architecture identification largely depends on
the ability of the set of object code features to capture bit patterns that
help distinguish between different architectures. In Section II-A, we observed
that the opcodes and operands are two of the most important information
embedded in binary instructions and they can have different lengths both
within the instructions of same ISA and across the instructions of different
ISAs. Hence, identifying a sufficient number of bit patterns that can enable
high accuracy ISA identification across increased number of architectures is a
non-trivial task that requires domain knowledge about the ISAs.

In what follows, we describe a method to characterize binary code features
that does not require domain knowledge about the ISAs. Our approach involves
the following steps: i) identify the smallest unit that has meaning (e.g., in
NLP, this unit is a word) within the binaries; ii) identify the fixed-length
patterns that need to be extracted from the binaries; iii) form a frequency
vector of all possible lengths $1,2,\dots$ that can be used as the set of
features for the binary files. We note that the frequency vector must satisfy
the following properties:

  1. 1.

Length of object code binaries should not influence444 Consider any two
binaries $X$ and $Y$ of same architecture type $A$ with $X$ having smaller
length and $Y$ having significantly larger object code length. In such
scenario, $X$ will be seen as much less type $A$ compared to $Y$ as the
frequency of the architecture specific bit patterns in $X$ will be always
significantly less than the frequency of the same bit patterns in $Y$.
frequency values.

  2. 2.

Values corresponding to frequent patterns that also commonly appear among the
binary files (i.e., noisy patterns) should be attenuated as they do not help
in distinguishing between the ISAs of the binaries.

  3. 3.

Values corresponding to frequent patterns appearing only in a small subset of
binary files should be boosted since such patterns will have higher
probability of being ISA-specific patterns that can aid architecture
identification.

We adapt $N$-gram TF-IDF feature model for extracting object code features. We
propose two approaches to determine what will constitute a meaningful _term_
in binaries and selecting an appropriate $N$ for capturing architecture
prominent patterns.

###  IV-A Byte-level $N$-gram TF-IDF Features

As noted in Section II-A an instruction recorded in a binary file is composed
of a collection of consecutive bytes. Processors read and process each code
section of a binary file byte-by-byte to execute instructions. Therefore, we
first choose a byte as a term when adapting $N$-gram TF-IDF for extracting
features from object code binaries.

Opcodes define architecture specific operations whereas operands define data
and addresses that usually takes random values. Thus, the opcodes consist of
more structured patterns that can characterize ISAs of binaries. For example
in Section II-A we observed that ARM and MIPS architectures typically have
opcodes of length of 4-bits and 6-bits (Fig. 1 and Fig. 2) respectively while
opcodes of X86_64 can be either 1-byte, 2-byte or 3-bytes. This implies we can
expect higher TF-IDF values for 1-gram byte patterns that include 4-bit and
6-bit opcode patterns in respective ARM and MIPS feature vectors. Similarly
feature vectors of X86_64 binaries will have higher TF-IDF values for 1-gram,
2-gram or 3-gram byte patterns corresponding to 1-byte, 2-byte or 3-byte
opcodes, respectively. Therefore, we extract $1$-gram, $2$-gram and $3$-gram
(i.e., $N=1,2,$ and $3$) byte patterns from binaries and use a vector
corresponding to their TF-IDF values as the binary object code features.

Further, 2-gram byte-level TF-IDF values allow capturing consecutive byte
patterns in operands that are induced by the endianness property of an
architecture (Section II-B). For example, the data value $1$ can be considered
as a commonly used operand across the binaries as many object codes may
include instructions related to increasing _for_ and _while_ loops variables
by 1. Then TF-IDF feature vectors of big endian MIPS architecture binaries can
expect to have higher values associated with the 0x0001 2-gram byte pattern
compared to the values of 0x0100. On the other hand features of little endian
ARM and X86_64 may have higher values for 0x0100 and relatively lower values
for 0x0001.

Our proposed byte-level object code features include all $(1,2)$-gram byte
patterns and top $5000$ ranked 3-gram byte-patterns. The rank ordering of the
observed 3-gram byte-patterns are done using the frequency of those patterns
across all binary files in the training set binaries. We only include top
$5000$ ranked 3-gram byte-patterns since capturing all such patterns will
require a large number of features ($256^{3}>>5000$) that can drastically
increase the computation time and resources such as memory and processing
power required for ML-based ISA identification. Therefore, byte-level
(1,2,3)-gram TF-IDF features do not depend on a limited number of pre-selected
byte patterns based on the domain knowledge and heuristics that may be
completely absent in some (partial) binary data. Rather, our approach provides
a more general set of expert agnostic features to identify byte patterns
induced by opcodes and endianness of ISAs.  There are $2^{8}=256$ possible
1-gram byte (8-bit) patterns. Hence, the total number of required feature
values to represent each binary file under this method can be as large as
$256+256^{2}+5000=70792$.

###  IV-B Character-level $N$-gram TF-IDF Features from Encoded Binaries

As discussed in Section IV-A, bit-patterns of opcodes play a more vital role
in identifying ISAs since they contain operations inherent to the target
processor architecture. In addition, we observe that opcode information
embedded in the instructions are typically less than 1-byte (e.g., 4-bit
opcodes in ARM, 6-bit opcodes in MIPS, AVR, and PowerPC) with the exception of
1,2, or 3-byte opcodes in X86_64. We also observe that there are other bit
patterns of different lengths recorded in instructions (outside the bit
patterns related to opcodes and operands) that may be used to distinguish
between architecture types. Examples include 4-bit condition field in ARM
instructions which is (Fig. 1) mostly set to $1110$ for indicating “always
execute" and 1-byte instruction prefixes in X86_64 instructions (e.g., 0xf0 -
repeat/lock prefix; 0xf2 and 0xf3 - string manipulation prefixes). Hence,
accurately capturing such fine-grained bit patterns specific to architectures
requires choosing terms with less than 8-bits (ideally 4, 5 or 6-bit terms).

As noted in Section II-D, encoding methods naturally provide a way to group
binary data into different length bits. Therefore, we propose to extract
character-level (1,2,3)-gram TF-IDF features from encoded binaries to enable
capturing architecture specific fine grained bit patterns. Table 3 provides
the number of features we used under each encoding method and their
composition. Using this method allows us to reduce the required number of
features by approximately $16\times$ compared to byte-level features discussed
in Section IV-A.

Binary file format | Granularity of features | Number of features
---|---|---
Histogram |  Endianness |  Histogram |  Endianness |  Total
Base16 encoded |  character |  2-byte |  16 |  4 |  20
Base32 encoded |  character |  2-byte |  32 |  4 |  36
Base64 encoded |  character |  2-byte |  64 |  4 |  68
Base85 encoded |  character |  2-byte |  85 |  4 |  89
Decoded (in Hex) |  byte |  2-byte |  256 |  4 |  260

TABLE 4: Details of histogram + endianness features extracted from different
binary file formats.

##  V Experiment Setup

This section presents the details of the experiments used to compare the
performance of ML algorithms for ISA identification under two types of feature
selection methods: $1)$ Histogram along with Endianness (Hist. + Endian)
features and $2)$ (1,2,3)-gram TF-IDF features. First, we detail the
characteristics of the datasets used in our experiments. Then we present the
properties of the different types of features extracted from the datastes.
All the experiments are implemented using Python 3.8.5 on a workstation with
Intel(R) Xeon(R) W-2145 CPU @ 3.70GHz processor and $128$ GB memory.

###  V-A Datasets of Object Code Binaries Used

Our primary dataset consists of $202,066$ distinct Base64 encoded binaries
downloaded from Praetorian’s “Machine Learning Binaries" challenge web page
[53]. Each encoded binary string in this dataset consists of 88 characters (66
bytes) on average and belongs to one of the following twelve architecture
types: avr, alphaev56, arm, m68k, mips, mipsel, powerpc, s390, sh4, sparc,
x86_64, and xtensa. We divided the primary dataset into 50 non-overlapping
groups, each of which was further partitioned into a training set with $2856$
encoded binaries ($238$ per architecture) and a testing set with $960$ encoded
binaries ($80$ per architecture).

We applied a series of decoding and encoding operations to the Base64 encoded
binaries of each dataset to create datasets for four other data formats:
binary, Base16, Base32, and Base85. The 8-bit (byte) values in binary
formatted datasets were further converted to their corresponding 2-character
Hex values for ease of analysis.

###  V-B Baseline Object Code Features

We use the byte-histogram and endianness features introduced in [29] for ISA
identification as our baseline for byte-level (1,2,3)-gram TF-IDF features.
The byte-histogram features of each binary are extracted by counting the
number of times each distinct Hex value appears in the decoded binary. The
byte-histogram of each binary is then normalized by the total number of Hex
values recorded in the corresponding binary. Note that the byte-histogram
features are equivalent to the 1-gram TF features and they form the first
$2^{8}=256$ entries in the feature vector. Then four more domain
knowledge/heuristic-based features are added to the feature vector for
capturing the endianness. These additional features are extracted by counting
the number of times each 2-byte Hex values, 0x0001, 0x0100, 0xfffe, and 0xfeff
appear in each binary. These counts are also normalized by the total number of
Hex values in the binary.

In order to evaluate the effectiveness of our character-level (1,2,3)-gram TF-
IDF features extracted from the encoded binaries, we use character-histogram
and endianness features. The character-histogram features of each binary are
extracted by counting the number of times each distinct character appears in
the encoded binary. The character-histogram of each encoded binary is then
normalized by the total number of characters recorded in the corresponding
binary. Since the domain knowledge/ heuristic-based four endianness features
introduced in [29] are based on the 2-byte Hex values, we extract the four
endianness features from the decoded binaries in Hex format following the same
steps as in byte-histogram and endianness features. Table 4 summarizes the
details about the histogram + endianness features.

##  VI Results and Discussions

In this section, we present the experimental results and related discussions.
We use the following abbreviations to denote the different ML algorithms used
in the experiments. SVM: Support Vector Machine, LR: Logistic Regression, DT:
Decision Tree, RF: Random Forest, GNB: Gaussian Naive Bayes, MNB: Multinomial
Naive Bayes, CNB: Complement Naive Bayes, KNN: K-Nearest Neighbor, and PTN:
Perceptron. We will use histogram + endianess to refer to the baseline
features. We refer to [54] for the detailed descriptions about the
aforementioned ML algorithms.

Figure 4: Accuracy of instruction set architecture identification under
different machine learning algorithms corresponding to byte-histogram along
with endianness features and byte-level (1,2,3)-gram TF-IDF features extracted
from decoded binaries. Each accuracy value is computed across 50 independent
datasets. The byte-level (1,2,3)-gram TF-IDF features consistently results in
a higher accuracy compared to the byte-histogram + endianness features.

capposition = below, floatrowsep =qquad, [0.45] [0.45]
[0.45] [0.45]

Figure 5: Base16 encoded binaries Figure 6: Base32 encoded binaries Figure 7:
Base64 encoded binaries Figure 8: Base85 encoded binaries Figure 9: Accuracy
of 12 architecture program binaries classification of different machine
learning algorithms corresponding to character-histogram along with endianness
features and character-level (1,2,3)-gram TF-IDF features under different
encoded binary file formats, Base16, Base32, Base64, and Base85. Each accuracy
value is computed across 50 independent datasets. The character-level
(1,2,3)-gram TF-IDF features consistently results in a higher accuracy
compared to the histogram + endianness features.

capposition = below, floatrowsep =qquad, [0.45] [0.45]

Figure 10: Byte-histogram + Endianness features from decoded binaries Figure
11: Byte-level (1,2,3)-gram TF-IDF features from decoded binaries Figure 12:
2-D t-SNE plots corresponding to byte-histogram + endianness features (Fig.
12-(a)) and byte-level N-gram TF-IDF features (Fig. 12-(b)) extracted from
randomly chosen training datasets consist of decoded binaries. The byte-level
(1,2,3)-gram TF-IDF features provide better separability compared to the byte-
histogram + endianness features.

###  VI-A Accuracy of the ML models

Fig. 4 compares the accuracy of instruction set architecture identification
under different ML algorithms corresponding to byte-histogram + endianness
features and byte-level (1,2,3)-gram TF-IDF features extracted from the
decoded binaries. Accuracy values that we report in our experiments are
averaged over 50 independent datasets that contain binaries from 12 different
architectures. Our results show that using byte-level (1,2,3)-gram TF-IDF
features increase the accuracy values by $9\%-10\%$ on average across the ML
models considered. Properties of byte-level (1,2,3)-gram TF-IDF features such
as ability to suppress the effects of noisy bytes, providing more generalized
set of features to capture the architecture related characteristics such as
endianness, and providing increased number of features that can capture byte
patterns specific to architectures enables consistently achieving higher
levels of accuracy. However, the high accuracy is achieved at the expense of
considering around $200\times$ more features than the baseline (compare last
rows of Table 3 and Table 4).

Fig. 9 illustrates the accuracy of different ML algorithms corresponding to
character-histogram + endianness features and character-level (1,2,3)-gram TF-
IDF features when base16, base32, base64, and base85 encoded binaries are
used. Our results show that character-level (1,2,3)-gram TF-IDF features has a
higher accuracy than the character-histogram + endianness features across all
ML models. Character-level encoded (1,2,3)-gram TF-IDF features provide the
noise reduction and increased generalizability advantages of (1,2,3)-gram TF-
IDF features. It also provides increased number of fine grained features to
capture bit patterns specific to architectures that are smaller than 8-bits
(e.g., nibble patterns of opcodes). More importantly, using encoded character-
level (1,2,3)-gram TF-IDF features requires only $\sum_{i=1}^{3}16^{i}$
features compared to $\sum_{i=1}^{3}256^{i}$ features corresponding to the
byte-level (1,2,3)-gram TF-IDF features.

###  VI-B Quality of the features via t-SNE

capposition = below, floatrowsep =qquad, [0.5] [0.5] [0.5] [0.5] [0.5] [0.5]
[0.5] [0.5]

Figure 13: Character-histogram + Endianness features of Base16 binaries Figure
14: Character-level (1,2,3)-gram TF-IDF features of Base16 binaries Figure 15:
Character-histogram + Endianness features of Base32 binaries Figure 16:
Character-level (1,2,3)-gram TF-IDF features of Base32 binaries Figure 17:
Character-histogram + Endianness features of Base64 binaries Figure 18:
Character-level (1,2,3)-gram TF-IDF features of Base64 binaries Figure 19:
Character-histogram + Endianness features of Base85 binaries Figure 20:
Character-level (1,2,3)-gram TF-IDF features of Base85 binaries Figure 21: 2-D
t-SNE plots corresponding to byte-histogram + endianness features and
character-level N-gram TF-IDF features extracted from randomly chosen training
datasets consist of Base16, Base32, Base64, and Base85 encoded binaries. The
character-level (1,2,3)-gram TF-IDF features provide better separability
compared to the character-histogram + endianness features.

Fig. 6 compares the 2-D t-SNE representations of histogram + endianness
features and N-gram TF-IDF features of the decoded binaries. Our experiments
suggest that byte-level N-gram TF-IDF features result in better separation of
the data points corresponding to the different architectures. In contrast,
using histogram + endianness features lead to data points of mips and mipsel
architectures being indistinguishable. This explains the high classification
accuracy achieved using the proposed byte-level N-gram TF-IDF features.

Fig. 7 shows the 2-D t-SNE representations of histogram + endianness features
and N-gram TF-IDF features of the base16, base32, base64, and base85 encoded
binaries. Our experiments show that baseline histogram + endianness features
results in poor separation of the clusters related to the data points
corresponding to the different architectures. On the other hand, N-gram TF-IDF
features extracted from Base16 encoded binaries provide a better separation
for the clusters related to different architectures. In fact, comparing with
Fig. 6, we can observe this separation is slightly better than the separation
achieved via byte-level N-gram TF-IDF features.

###  VI-C Number of training data required

Fig. 22 and Fig. 23 plot accuracy values against the number of training data
when classifying different number of ISAs using the Support Vector Machine
(SVM) and Logistic Regression (LR) ML models, respectively. These experiments
use byte-level (1,2,3)-gram TF-IDF features extracted from decoded binaries.
Our results show that byte-level (1,2,3)-gram TF-IDF features achieve high
accuracy in both SVM ( $>$ 98 %) and LR ( $>$ 97%) consistently under all
architecture scenarios. Moreover, in SVM only around 1000 binaries (84
binaries per architecture) are required in the training data set to achieve
accuracy $>$ 98 %. In the case of LR, 1300 binaries (103 binaries per
architecture) are required in the training data set to achieve accuracy $>$ 97
%. This shows that byte-level (1,2,3)-gram TF-IDF features does not require
large number of training data to achieve high accuracy. Similar results can be
observed in the case of character-level (1,2,3)-gram TF-IDF features extracted
from encoded binaries.

Figure 22: SVM accuracy results under different number of architectures when
(1,2,3)-gram TF-IDF features are used. The red line indicates the 98% accuracy
margin. Figure 23: LR accuracy results under different number of architectures
when (1,2,3)-gram TF-IDF features are used. The red line indicates the 97%
accuracy margin.

##  VII Conclusion

In this paper we proposed binary object code feature extraction methods based
on $N$-gram Term Frequency-Inverse Document Frequency (TF-IDF) feature model
for instruction set architecture (ISA) identification. We used byte-level
$N$-gram TF features to extract the successive bytes patterns inherent to
architectures. Setting $N=1$, can recover a class of object code features used
in the literature called byte histogram features. However, such approaches
require additional domain knowledge/heuristic-based features for capturing
successive byte patterns inherent to ISAs and they may be absent in partial
binaries. Histogram-based features are also susceptible to noisy byte values.
Hence, histogram and signature-based approaches fail to achieve high accuracy
for the binaries with limited data that is corrupted by noise.  We scaled
byte-level $N$-gram TF features by their respective IDF values to attenuate
the effect of noisy byte data. Using a 12-architecture dataset, we showed
byte-level (1,2,3)-gram TF-IDF features are adequate to achieve high accuracy
performance in the Machine Learning (ML)-based ISA identification models. We
observed instruction bytes have architecture specific fine grained bit
patterns and extracted such patterns using character-level $N$-gram TF-IDF
features of encoded binaries (e.g., base16, base32, base64, base85). We
observed character-level (1,2,3)-gram TF-IDF features of encoded binaries
achieving high accuracy while only using less number of features (up to
$\approx 16\times$) compared to the byte-level (1,2,3)-gram TF-IDF features.
Our binary code feature extraction methods do not require any prior domain
specific knowledge on the ISAs and hence, easily extendable to ISA
identification with different number of ISAs. Promising future research
directions include investigation of the effect of NLP and binary-to-text
encoding-based object code feature extraction methods in the fields of file
type identification and malware binary detection.

## References

  * [1] B. Dit, M. Revelle, M. Gethers, and D. Poshyvanyk, “Feature location in source code: a taxonomy and survey,” _Journal of software: Evolution and Process_ , vol. 25, no. 1, pp. 53–95, 2013.
  * [2] P. Rajba and W. Mazurczyk, “Information hiding using minification,” _IEEE Access_ , vol. 9, pp. 66 436–66 449, 2021.
  * [3] S. Henry, “A technique for hiding proprietary details while providing sufficient information for researchers; or, do you recognize this well-known algorithm?” _Journal of Systems and Software_ , vol. 8, no. 1, pp. 3–11, 1988.
  * [4] C. K. Behera and D. L. Bhaskari, “Different obfuscation techniques for code protection,” _Procedia Computer Science_ , vol. 70, pp. 757–763, 2015.
  * [5] G. Naumovich and N. Memon, “Preventing piracy, reverse engineering, and tampering,” _computer_ , vol. 36, no. 7, pp. 64–71, 2003.
  * [6] A. Moser, C. Kruegel, and E. Kirda, “Limits of static analysis for malware detection,” in _Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007)_. IEEE, 2007, pp. 421–430.
  * [7] P. Sun, L. Garcia, G. Salles-Loustau, and S. Zonouz, “Hybrid firmware analysis for known mobile and iot security vulnerabilities,” in _2020 50th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)_. IEEE, 2020, pp. 373–384.
  * [8] Y. R. Lee, B. Kang, and E. G. Im, “Function matching-based binary-level software similarity calculation,” in _Proceedings of the 2013 Research in Adaptive and Convergent Systems_ , 2013, pp. 322–327.
  * [9] K. Han, J. H. Lim, and E. G. Im, “Malware analysis method using visualization of binary files,” in _Proceedings of the 2013 Research in Adaptive and Convergent Systems_ , 2013, pp. 317–321.
  * [10] C. Willems, T. Holz, and F. Freiling, “Toward automated dynamic malware analysis using cwsandbox,” _IEEE Security & Privacy_, vol. 5, no. 2, pp. 32–39, 2007.
  * [11] G. Canfora, F. Mercaldo, C. A. Visaggio, and P. Di Notte, “Metamorphic malware detection using code metrics,” _Information Security Journal: A Global Perspective_ , vol. 23, no. 3, pp. 57–67, 2014.
  * [12] D. Andriesse, _Practical Binary Analysis: Build Your Own Linux Tools for Binary Instrumentation, Analysis, and Disassembly_. no starch press, 2018.
  * [13] A. Kapoor, “An approach towards disassembly of malicious binary executables,” Ph.D. dissertation, University of Louisiana at Lafayette, 2004.
  * [14] H. Xue, S. Sun, G. Venkataramani, and T. Lan, “Machine learning-based analysis of program binaries: A comprehensive study,” _IEEE Access_ , vol. 7, pp. 65 889–65 912, 2019.
  * [15] E. Cozzi, M. Graziano, Y. Fratantonio, and D. Balzarotti, “Understanding linux malware,” in _2018 IEEE symposium on security and privacy (SP)_. IEEE, 2018, pp. 161–175.
  * [16] T. McIntosh, P. Watters, A. Kayes, A. Ng, and Y.-P. P. Chen, “Enforcing situation-aware access control to build malware-resilient file systems,” _Future Generation Computer Systems_ , vol. 115, pp. 568–582, 2021.
  * [17] “Ghidra.” [Online]. Available: https://www.nsa.gov/resources/everyone/ghidra/
  * [18] “Ida pro.” [Online]. Available: https://hex-rays.com/ida-pro/
  * [19] Capstone, “The ultimate disassembly framework,” May 2020. [Online]. Available: https://www.capstone-engine.org/
  * [20] ReFirmLabs, “Refirmlabs/binwalk: Firmware analysis tool.” [Online]. Available: https://github.com/ReFirmLabs/Binwalk
  * [21] J. L. Hennessy and D. A. Patterson, _Computer architecture: a quantitative approach_. Elsevier, 2011.
  * [22] K. Liu, H. B. K. Tan, and X. Chen, “Binary code analysis,” _Computer_ , vol. 46, no. 8, pp. 60–68, 2013.
  * [23] M. A. B. Khadra, D. Stoffel, and W. Kunz, “Speculative disassembly of binary code,” in _2016 International Conference on Compliers, Architectures, and Sythesis of Embedded Systems (CASES)_. IEEE, 2016, pp. 1–10.
  * [24] A. Yazdinejad, H. HaddadPajouh, A. Dehghantanha, R. M. Parizi, G. Srivastava, and M.-Y. Chen, “Cryptocurrency malware hunting: A deep recurrent neural network approach,” _Applied Soft Computing_ , vol. 96, p. 106630, 2020.
  * [25] B. B. Rad, M. Masrom, and S. Ibrahim, “Opcodes histogram for classifying metamorphic portable executables malware,” in _2012 International Conference on e-Learning and e-Technologies in Education (ICEEE)_. IEEE, 2012, pp. 209–213.
  * [26] D. Bilar, “Opcodes as predictor for malware,” _International journal of electronic security and digital forensics_ , vol. 1, no. 2, pp. 156–168, 2007\.
  * [27] K. A. Sickendick, “File carving and malware identification algorithms applied to firmware reverse engineering,” 2013.
  * [28] Y. Ma, L. Han, H. Ying, S. Yang, W. Zhao, and Z. Shi, “Svm-based instruction set identification for grid device firmware,” in _2019 IEEE 8th Joint International Information Technology and Artificial Intelligence Conference (ITAIC)_. IEEE, 2019, pp. 214–218.
  * [29] J. Clemens, “Automatic classification of object code using machine learning,” _Digital Investigation_ , vol. 14, pp. S156–S162, 2015.
  * [30] B. Beckman and J. Haile, “Binary analysis with architecture and code section detection using supervised machine learning,” in _2020 IEEE Security and Privacy Workshops (SPW)_. IEEE, 2020, pp. 152–156.
  * [31] P. D. Nicolao, M. Pogliani, M. Polino, M. Carminati, D. Quarta, and S. Zanero, “Elisa: Eliciting isa of raw binaries for fine-grained code and data separation,” in _International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment_. Springer, 2018, pp. 351–371.
  * [32] S. Kairajärvi, A. Costin, and T. Hämäläinen, “Isadetect: Usable automated detection of cpu architecture and endianness for executable binary files and object code,” in _Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy_ , 2020, pp. 376–380.
  * [33] K. Chowdhary, “Natural language processing,” _Fundamentals of artificial intelligence_ , pp. 603–649, 2020.
  * [34] J. Ramos _et al._ , “Using tf-idf to determine word relevance in document queries,” in _Proceedings of the first instructional conference on machine learning_ , vol. 242, no. 1. Citeseer, 2003, pp. 29–48.
  * [35] A. Aizawa, “An information-theoretic perspective of tf–idf measures,” _Information Processing & Management_, vol. 39, no. 1, pp. 45–65, 2003\.
  * [36] “Arm instruction set.” [Online]. Available: https://iitd-plos.github.io/col718/ref/arm-instructionset.pdf
  * [37] “Mips32 architecture.” [Online]. Available: https://www.mips.com/products/architectures/mips32-2/
  * [38] “x86-64 instructions set.” [Online]. Available: http://linasm.sourceforge.net/docs/instructions/index.php
  * [39] B. Trstenjak, S. Mikac, and D. Donko, “Knn with tf-idf based framework for text categorization,” _Procedia Engineering_ , vol. 69, pp. 1356–1364, 2014\.
  * [40] P. Bafna, D. Pramod, and A. Vaidya, “Document clustering: Tf-idf approach,” in _2016 International Conference on Electrical, Electronics, and Optimization Techniques (ICEEOT)_. IEEE, 2016, pp. 61–66.
  * [41] J. Z. Kolter and M. A. Maloof, “Learning to detect and classify malicious executables in the wild.” _Journal of Machine Learning Research_ , vol. 7, no. 12, 2006.
  * [42] J. Saxe and K. Berlin, “Deep neural network based malware detection using two dimensional binary program features,” in _2015 10th international conference on malicious and unwanted software (MALWARE)_. IEEE, 2015, pp. 11–20.
  * [43] M. G. Schultz, E. Eskin, F. Zadok, and S. J. Stolfo, “Data mining methods for detection of new malicious executables,” in _Proceedings 2001 IEEE Symposium on Security and Privacy. S &P 2001_. IEEE, 2000, pp. 38–49.
  * [44] M. McDaniel and M. H. Heydari, “Content based file type detection algorithms,” in _36th Annual Hawaii International Conference on System Sciences, 2003. Proceedings of the_. IEEE, 2003, pp. 10–pp.
  * [45] M. Karresand and N. Shahmehri, “File type identification of data fragments by their binary structure,” in _Proceedings of the IEEE Information Assurance Workshop_ , 2006, pp. 140–147.
  * [46] I. Ahmed, K.-s. Lhee, H. Shin, and M. Hong, “Content-based file-type identification using cosine similarity and a divide-and-conquer approach,” _IETE Technical Review_ , vol. 27, no. 6, pp. 465–477, 2010.
  * [47] D. Behl, S. Handa, and A. Arora, “A bug mining tool to identify and analyze security bugs using naive bayes and tf-idf,” in _2014 International Conference on Reliability Optimization and Information Technology (ICROIT)_. IEEE, 2014, pp. 294–299.
  * [48] H. Yuan, Y. Tang, W. Sun, and L. Liu, “A detection method for android application security based on tf-idf and machine learning,” _Plos one_ , vol. 15, no. 9, p. e0238694, 2020.
  * [49] R.-C. Chen and S.-P. Chen, “Intrusion detection using a hybrid support vector machine based on entropy and tf-idf,” _International Journal of Innovative Computing, Information, and Control (IJICIC)_ , vol. 4, no. 2, pp. 413–424, 2008.
  * [50] T. K. Tran and H. Sato, “Nlp-based approaches for malware classification from api sequences,” in _2017 21st Asia Pacific Symposium on Intelligent and Evolutionary Systems (IES)_. IEEE, 2017, pp. 101–105.
  * [51] H. Zhang, X. Xiao, F. Mercaldo, S. Ni, F. Martinelli, and A. K. Sangaiah, “Classification of ransomware families with machine learning based onn-gram of opcodes,” _Future Generation Computer Systems_ , vol. 90, pp. 211–221, 2019.
  * [52] M. Ali, S. Shiaeles, G. Bendiab, and B. Ghita, “Malgra: Machine learning and n-gram malware feature extraction and detection system,” _Electronics_ , vol. 9, no. 11, p. 1777, 2020.
  * [53] “Tech challenge: Machine learning binaries,” Feb 2021. [Online]. Available: https://www.praetorian.com/challenges/machine-learning-challenge/#explore-the-sample
  * [54] P. Harrington, _Machine learning in action_. Simon and Schuster, 2012.

|  Dinuka Sahabandu  is a Ph.D. candidate in the Department of Electrical and
Computer Engineering at the University of Washington - Seattle. He received
the B.S. degree and M.S. degree in Electrical Engineering from the Washington
State University - Pullman in 2013 and 2016, respectively. His research
interests include game theory for network security and control of multi-agent
systems.
---|---
|  J. Sukarno Mertoguno  is a Professor in the School of Cybersecurity and
Privacy at Georgia Tech. He previously served as Chief Innovation Officer at
GTRI. He received his Ph.D. from SUNY-Binghamton. His education background
includes theoretical physics and electrical engineering. Before joining
Georgia Tech, Dr. Mertoguno managed basic and applied scientific research in
cybersecurity and complex software for the Office of Naval Research (ONR), and
prior to ONR he was a system and chip architect in the San Francisco Bayt
Area. He developed several novel concepts, such as BFT++, Learn2Reason,
CryptoFactory, and bottom-up formal methods. He has led major projects
including DARPA PAPPA, DARPA AIMEE, DARPA ReMath, DARPA REPO, DARPA V-SPELLS,
and US-Israel Consortium on Cybersecurity for Energy Sector.
---|---
|  Radha Poovendran (F’15) is a Professor in the Department of Electrical and
Computer Engineering at the University of Washington (UW) - Seattle. He served
as the Chair of the Electrical and Computer Engineering Department at UW for
five years starting January 2015. He is the Director of the Network Security
Lab (NSL) at UW. He is the Associate Director of Research of the UW Center for
Excellence in Information Assurance Research and Education. He received the
B.S. degree in Electrical Engineering and the M.S. degree in Electrical and
Computer Engineering from the Indian Institute of Technology- Bombay and
University of Michigan - Ann Arbor in 1988 and 1992, respectively. He received
the Ph.D. degree in Electrical and Computer Engineering from the University of
Maryland - College Park in 1999. His research interests are in the areas of
wireless and sensor network security, control and security of cyber-physical
systems, adversarial modeling, smart connected communities, control-security,
games-security, and information theoretic security in the context of wireless
mobile networks. He is a Fellow of the IEEE for his contributions to security
in cyber-physical systems. He is a recipient of the NSA LUCITE Rising Star
Award (1999), National Science Foundation CAREER (2001), ARO YIP (2002), ONR
YIP (2004), and PECASE (2005) for his research contributions to multi-user
wireless security. He is also a recipient of the Outstanding Teaching Award
and Outstanding Research Advisor Award from UW EE (2002), Graduate Mentor
Award from Office of the Chancellor at University of California - San Diego
(2006), and the University of Maryland ECE Distinguished Alumni Award (2016).
He was co-author of award-winning papers including IEEE/IFIP William C. Carter
Award Paper (2010) and WiOpt Best Paper Award (2012).
---|---