機械学習を使用した
不正プログラムの開発環境
推定手法の提案
警察大学校サイバーセキュリティ対策研究・研修センター
警察庁情報通信局情報技術解析課 課付
大坪 雄平

教授

1

Introduction2Forensic Scientists

3
Designed by macrovector / Freepik (http://www.freepik.com)

Computer Forensics
Attackers

Find Digital Evidences
Deletedfiles

Malicious
Documents
Victim PC

MemoryEmailC2 Server
4Author Identification
Compiler Provenance
Compiler
FamilyVersionOptimization level

Malicious EXE
MZSpecific Strings

This Program is …

Secret key
abc123

JFIF

Static Link Libraries
Resources

Compile time

Language
API name

5Multiple Compiler Binary
a.cpp

Make

A.exe

What is the truth label of A.exe?

b.cpp

r.rc

s.txt

t.jpeg6

Multiple Compiler Binarya.cpp

A Compiler

a.obj

b.cpp

B Compiler

b.obj

r.rc

A.exe

What is the truth label of A.exe?
- A Compiler?
- B Compiler?

r.res

s.txt

t.jpeg7

Multiple Compiler Binarya.cpp

A Compiler

a.obj

b.cpp

B Compiler

b.obj

x.cpp
?

X Compiler

x.lib

r.rc

A.exe

What is the truth label of A.exe?
- A Compiler?
- B Compiler?
- X Compiler?

r.res

s.txt

t.jpeg8

Multiple Compiler Binarya.cpp

A Compiler

a.obj

b.cpp

B Compiler

b.obj

x.cpp
?

X Compiler

x.lib

r.rc

C Linker

A.exe

What is the truth label of A.exe?
- A Compiler?
- B Compiler?
- X Compiler?
- C Linker?

r.res

s.txt

t.jpeg9

Multiple Compiler Binarya.cpp

A Compiler

a.obj

b.cpp

B Compiler

b.obj

x.cpp
?

X Compiler

x.lib

r.rc

C Linker

A.exe

What is the truth label of A.exe?
- A Compiler?
- B Compiler?
- X Compiler?
- C Linker?

What is the truth label of a.obj?
- A Compiler
r.res

s.txt

What is the truth label of b.obj?
- B Compilert.jpegWhat is the truth label of x.lib?
- Hmm... I think VC, because MS provide it!

10

Multiple Compiler Binary
Easy to make the ground trutha.cpp

A Compiler

a.obj

b.cpp

B Compiler

b.obj

x.cpp
?

X Compiler

x.lib

r.rc

C Linker

A.exe

What is the truth label of A.exe?
- A Compiler?
- B Compiler?
- X Compiler?
- C Linker?

What is the truth label of a.obj?
- A Compiler
r.res

s.txt

What is the truth label of b.obj?
- B Compilert.jpegWhat is the truth label of x.lib?
- Hmm... I think VC, because MS provide it!

11

Fragmented Files
Collect as much of the attacker's trace as possible evenfrom fragmented files.
A.exe

Forensics

Deletedfiles

Recoveryfile
Memory12Preliminaries

13

o-glasses
x86 code (e.g., shellcode) detector [arXive.1806.05328]

Softmax

FFN

BN

FNN

BN

128-bitlengthinstructions

FFN

x86
instructions

CNN

Input
: 16 x86 instructions
Output : Program or not
F1: 0.9995

CNN

ConvertBinary14

o-glasses
x86 code (e.g., shellcode) detector [arXive.1806.05328]

Softmax

FFN

BN

FNN

BN

128-bitlengthinstructions

FFN

x86
instructions

CNN

Input
: 16 x86 instructions
Output : Program or not
F1: 0.9995

CNN

ConvertBinary・Applying to compiler identification
・Black Box Problem
15

Attention Is All You Need[Łukasz Kaiser et al., NIPS, 2017]16

Basic of Attention
Input

Query

[q_length, depth][q_length, depth]

matmulSoftmax

Key
Att. W[m_length, depth][q_length, m_length]

MemoryValue[m_length, depth][m_length, depth]

matmulOutput[q_length, depth]17Basic of Attention
Input[q_length, depth]

query =Query'key2'
matmulSoftmax
memory = {'key1':'value2',
Key'key2':'value2',
Att. W'key3':'value3',
MemoryValuematmulOutput'key4':'value4'}
memory[query] = 'value2'[q_length, depth][m_length, depth][q_length, m_length][m_length, depth][m_length, depth][q_length, depth]18Basic of Attention
Input

Query

[q_length, depth][q_length, depth]

matmulSoftmax

query = 'key2'
memory = {'key1':'value2','key2':'value2','key3':'value3','key4':'value4'}
memory[query] = 'value2'

Key
Att. W[m_length, depth][q_length, m_length]

MemoryValue[m_length, depth][m_length, depth]

matmulOutput[q_length, depth]

19Basic of Attention
Input

Query

[q_length, depth][q_length, depth]

matmulSoftmax

query = 'key2'
memory = {'key1':'value2','key2':'value2','key3':'value3','key4':'value4'}
memory[query] = 'value2'

Key
Att. W[m_length, depth][q_length, m_length]

MemoryValue[m_length, depth][m_length, depth]

matmulOutput[q_length, depth]20Basic of Attention
Input

Query

[q_length, depth][q_length, depth]

matmulSoftmax

query = 'key2'
memory = {'key1':'value2','key2':'value2','key3':'value3','key4':'value4'}
memory[query] = 'value2'

Key
Att. W[m_length, depth][q_length, m_length]

MemoryValue[m_length, depth][m_length, depth]

matmulOutput[q_length, depth]21Dot-Product Attention vs. Dictionary Object

softmax

Query

Key

q

k k k kAtt. W

Value
v
v
v
v

Att. W

query = 'key2'
memory = {'key1':'value2','key2':'value2','key3':'value3','key4':'value4'}
memory[query] = 'value2'
key[m_length, depth]v[m_length, depth]

value

memory[m_length, depth]22Self-Attention
Input

Query

[q_length, depth][q_length, depth]

matmulSoftmax

Key
Att. W[m_length, depth][q_length, m_length]

Input

Value

[m_length, depth][m_length, depth]

matmulOutput[q_length, depth]

23

Positional Encoding (PE)PE (Positional Encoding) adds information about the word position
to the input word vectors for learning the context of words.

𝑌 𝑋 = 𝑋 + 𝛼𝑃𝐸
𝑃𝐸 𝑝𝑜𝑠,2𝑖 = sin 𝑝𝑜𝑠/100002𝑖/𝑑𝑚𝑜𝑑𝑒𝑙
𝑃𝐸 𝑝𝑜𝑠,2𝑖+1 = cos 𝑝𝑜𝑠/100002𝑖/𝑑𝑚𝑜𝑑𝑒𝑙

24

Proposed Method25

Convert
128-bitlengthinstructions

CNN
Key

CNN

Value

Softmax

FFN

BN

Att. Output

matmulAtt. W

Softmax

matmul

CNN

Query

CNN

CNN

x86
instructions

CNN

Att. Input

PE

CNN

o-glassesX
Binary26

Convert
128-bitlengthinstructions

Key

Value

Softmax

FFN

BN

Att. Output

matmulAtt. W

Softmax

Query

CNN

CNN

BinarymatmulCNN

CNN

Same as o-glasses
CNN

x86
instructions

CNN

Att. Input

PE

CNN

o-glassesX
Attention

27

Preprocessing details
Binary60 B9 67 01 00 00 EB 0F

128-bit length
instructions60
B9 67 01 00 00
EB 0F

PUSHA
MOV ECX,0x167
JMP loc_17

16 bytes

60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
B9 67 01 00 00 00 00 00 00 00 00 00 00 00 00 00
EB 0F 00 00 00 00 00 00 00 00 00 00 00 00 00 00

x86
instructions

128-bitlengthinstructions

Same as o-glasses

128 bits
0000011000000000 … … … … … 00000000
1001110111100110 … … … … … 00000000
1101011111110000 … … … … … 00000000

CNN

x86 instructions

ConvertBinary28

st
The 1 CNN Layer
Each unit in CNN has specially local connections to the input units, called a Kernel.
Every kernel shares the weight parameters with the others in the same layer.

BinaryInstruction vector

128-bit length instruction

Instruction vector

128-bit length instruction.
.
.

Instruction vector.
.
.

128-bit length instruction

x86
instructions

128-bitlengthinstructions

CNN

128-bit length instruction

ConvertDepth (=96)

Kernel size = 128

CNN

Stride size = 128

Each kernel covers a single instruction by adjusting the hyperparameters.

Same as o-glasses

Instruction vector
29Evaluation

30

#Codex86

VC17,32,none(Od)1,170

369,605

VC17,32,max(Ox)1,147

255,143x86-64

VC17,64,none(Od)1,456

540,568

VC17,64,max(Ox)1,242

542,020x86

VC03,32,none(Od)1,350

292,277

VC03,32,max(Ox)1,306

270,743x86-64

-

-

-

-

-

-

x86

GCC,32,none(O0)2,111227,004

GCC,32,max(O3)1,844

239,821x86-64

GCC,64,none(O0)1,582283,276

GCC,64,max(O3)1,580

287,775x86

Clang,32,none(O0)1,205101,024

Clang,32,max(O3)1,19686,521x86-64

Clang,64,none(O0)1,892332,278

Clang,64,max(O3)1,883

246,500

x86

VC2017
GCC
Clang
ICC

ProgramTotal: 19 labels
Compiler: 4 families
Visual C++, GCC, Clang and Intel C++ Compiler
Opt. level: 2 types
maximum or not
CPU Arc.
: 2 types
x86 or x86-64

VC2003

Collecting source code files from GitHub
Compiling various compilers and options#Binaries

ICC,32,none(Od)1,761

1,494,677

ICC,32,max(Ox)1,724

1,161,499

x86-64Training Dataset

Label

ICC,64,none(Od)1,796

1,419,705

ICC,64,max(Ox)1,728

1,046,958

Others101

912,855

Total

28,074

10,110,249

31

4-fold Cross Validation (Input: 64 instructions)
Predict
Train

VC
1

2

3

GCC
4

5

6

7

8

Clang
9

10

11

12

13

ICC
14

15

16

Others
17

18

19

R

P

F1

VC03,32,none(Od)1 .9604 .0355 .0026 .0002 .0002 .0002 .0001 .0000 .0000 .0000 .0001 .0000 .0000 .0000 .0001 .0002 .0000 .0000 .0004 .9500 .9604 .9552

VC17,32,none(Od)2 .0463 .9517 .0002 .0007 .0001 .0001 .0000 .0000 .0000 .0000 .0001 .0000 .0000 .0000 .0000 .0002 .0000 .0000 .0006 .9625 .9517 .9570

VC03,32,max(Ox)3 .0026 .0001 .9875 .0061 .0001 .0003 .0000 .0002 .0000 .0000 .0000 .0002 .0000 .0000 .0000 .0022 .0000 .0000 .0006 .9786 .9875 .9830

VC17,32,max(Ox)4 .0004 .0010 .0144 .9774 .0001 .0005 .0000 .0001 .0000 .0001 .0001 .0008 .0000 .0001 .0000 .0044 .0000 .0000 .0007 .9887 .9774 .9830

VC17,64,none(Od)5 .0002 .0001 .0002 .0001 .9978 .0008 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .0001 .0000 .0001 .0001 .0001 .0004 .9977 .9978 .9977

VC17,64,max(Ox)6 .0002 .0001 .0004 .0004 .0013 .9931 .0000 .0000 .0000 .0005 .0000 .0000 .0001 .0006 .0000 .0001 .0000 .0023 .0008 .9955 .9931 .9943

GCC,32,none(O0)7 .0002 .0000 .0001 .0000 .0000 .0000 .9973 .0009 .0004 .0001 .0003 .0004 .0000 .0000 .0002 .0000 .0000 .0000 .0000 .9972 .9973 .9973

GCC,32,max(O3)8 .0001 .0000 .0005 .0002 .0000 .0000 .0011 .9921 .0000 .0003 .0002 .0051 .0000 .0000 .0000 .0004 .0000 .0000 .0000 .9946 .9921 .9933

GCC,64,none(O0)9 .0001 .0001 .0000 .0000 .0000 .0000 .0008 .0000 .9970 .0006 .0000 .0000 .0010 .0002 .0000 .0000 .0001 .0000 .0000 .9979 .9970 .9975

GCC,64,max(O3)10 .0000 .0000 .0000 .0000 .0001 .0002 .0001 .0006 .0003 .9800 .0000 .0003 .0003 .0168 .0000 .0001 .0001 .0012 .0000 .9819 .9800 .9809

Clang,32,none(O0)11 .0003 .0002 .0000 .0000 .0000 .0000 .0004 .0004 .0000 .0001 .9972 .0006 .0007 .0000 .0001 .0000 .0000 .0000 .0000 .9959 .9972 .9965

Clang,32,max(O3)12 .0001 .0000 .0006 .0011 .0000 .0001 .0004 .0068 .0000 .0003 .0006 .9869 .0000 .0019 .0000 .0012 .0000 .0000 .0000 .9790 .9869 .9829

Clang,64,none(O0)13 .0000 .0000 .0000 .0000 .0000 .0001 .0000 .0000 .0009 .0003 .0010 .0000 .9973 .0003 .0000 .0000 .0000 .0001 .0000 .9979 .9973 .9976

Clang,64,max(O3)14 .0000 .0000 .0001 .0001 .0001 .0006 .0000 .0001 .0002 .0147 .0000 .0015 .0002 .9810 .0000 .0001 .0001 .0013 .0001 .9796 .9810 .9803

ICC,32,none(Od)15 .0001 .0000 .0001 .0000 .0000 .0000 .0002 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .9994 .0002 .0000 .0000 .0000 .9995 .9994 .9994

ICC,32,max(Ox)16 .0002 .0001 .0029 .0028 .0000 .0001 .0000 .0003 .0000 .0001 .0000 .0005 .0000 .0000 .0001 .9930 .0000 .0001 .0000 .9916 .9930 .9923

ICC,64,none(Od)17 .0000 .0000 .0000 .0000 .0001 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .9996 .0001 .0000 .9995 .9996 .9995

ICC,64,max(Ox)18 .0000 .0000 .0001 .0000 .0001 .0016 .0000 .0001 .0000 .0012 .0000 .0000 .0000 .0013 .0000 .0001 .0002 .9952 .0000 .9948 .9952 .9950

Others

19 .0000 .0000 .0000 .0001 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .0000 .9997 .9964 .9997 .9980

32

Comparison of Performance of Related Work33

InputSHR EDX, 0x8

MOV EDX, [EBP-XOR EAX, [ECX]

MOV ECX, [EBP+AND EAX, 0xff0

MOV EAX, [EDX*AND EDX, 0xff

SHR EDX, 0x10

MOV EDX, [EBP-

MOV [EBP-0x8],

MOV ECX, [EAX+

MOV EAX, [EBP+JNZ 0x40001b7

CMP DWORD [EBP

MOV [EDX+0xc],

ENTER 0x558b,

L2-norm

Calculating ‘Why’ with the Attention Mechanism
ENTER 0x558b, 0x8.222 .020 .141 .067 .105 .109 .178 .102 .188 .029 .082 .153 .058 .130 .088 .190 .03

MOV [EDX+0xc], ECX.115 .059 .038 .045 .134 .112 .048 .085 .117 .037 .047 .128 .078 .091 .066 .117 .03

CMP DWORD [EBP+0x10], 0x80.029 .040 .048 .025 .041 .044 .048 .036 .038 .033 .036 .050 .053 .040 .058 .038 .03

JNZ 0x40001b7.016 .033 .033 .055 .008 .033 .042 .028 .026 .029 .016 .014 .017 .035 .037 .026 .03

MOV EAX, [EBP+0x8].019 .038 .020 .022 .031 .009 .015 .006 .013 .048 .063 .019 .060 .007 .041 .013 .05

MOV ECX, [EAX+0xc].079 .110 .036 .058 .123 .054 .026 .046 .056 .080 .080 .083 .084 .042 .048 .056 .06

MOV [EBP-0x8], ECX.036 .052 .033 .028 .032 .018 .030 .008 .017 .066 .091 .023 .087 .013 .055 .017 .07

MOV EDX, [EBP-0x8].041 .066 .036 .044 .021 .017 .027 .013 .018 .096 .075 .019 .050 .012 .052 .018 .10

SHR EDX, 0x10.063 .021 .073 .059 .063 .086 .076 .066 .065 .021 .018 .073 .039 .095 .084 .065 .02

AND EDX, 0xff

.255 .040 .108 .110 .159 .158 .129 .216 .154 .030 .028 .123 .121 .153 .112 .155 .03

MOV EAX, [EDX*4+0x0].153 .111 .091 .138 .039 .075 .083 .058 .071 .160 .105 .056 .088 .071 .126 .071 .13

AND EAX, 0xff000000.044 .100 .061 .066 .024 .056 .064 .034 .032 .061 .021 .050 .016 .057 .033 .031 .06

MOV ECX, [EBP+0x8].062 .070 .034 .035 .074 .022 .025 .013 .035 .078 .146 .047 .073 .016 .051 .035 .08

XOR EAX, [ECX].207 .151 .134 .117 .065 .122 .113 .206 .087 .113 .094 .077 .079 .139 .028 .086 .09

MOV EDX, [EBP-0x8].039 .064 .035 .042 .020 .016 .026 .012 .017 .093 .072 .018 .050 .012 .051 .017 .10

SHR EDX, 0x8.063 .024 .079 .089 .060 .071 .070 .070 .066 .027 .024 .067 .049 .086 .069 .066 .02
34

Typical Instructions for each compilere.g.,when focusing on the NOP instruction...
VC03,32,none(Od)VC17,32,none(Od)

GCC,32,none(O0)Clang,32,none(O0)ICC,32,none(Od)

1 XOR ECX, [EAX*4+0x0]

1 IMUL ECX, EAX, 0x0

1 AND EAX, 0xff000000

1 AND EAX, 0xff000000

1 IMUL EAX, EAX, 0x4

2 AND EAX, 0xff000000

2 IMUL ECX, EAX, 0x9

2 MOVZX EAX, AL

2 NOP WORD [EAX+EAX+0x0]

2 AND EAX, 0xff000000

3 XOR EDX, [EAX*4+0x0]

3 IMUL EDX, ECX, 0xc

3 LEA EDX, [EAX*4+0x0]

3 AND ECX, 0xff0000

3 IMUL EDX, EDX, 0x4

4 AND ECX, 0xff0000

4 XOR ECX, EBP

4 ADD DWORD [EBP-0x8], 0x1

4 XOR EAX, [ECX*4+0x1028]

4 CALL 0x4003c76

5 XOR EAX, [EDX*4+0x0]

5 IMUL ECX, EAX, 0x3

5 AND EAX, 0xff0000

5 NOP DWORD [EAX+0x0]

5 MOV EAX, 0xffffffff

VC03,32,max(Ox)VC17,32,max(Ox)

GCC,32,max(O3)Clang,32,max(O3)

ICC,32,max(Ox)1 AND ESI, 0xff0000

1 NOP

1 LEA ESI, [ESI+0x0]

1 NOP WORD [CS:EAX+EAX+0x0]

1 NOP DWORD [EAX+0x0]

2 AND ECX, 0xff0000

2 MOVZX ECX, BYTE [EAX+EBP]

2 LEA EDI, [EDI+0x0]

2 MOV EBP, 0xff000000

2 LEA EBX, [EDX+EDX]

3 AND EDI, 0xff

3 PUSH DWORD [ESP+0x24]

3 AND EAX, 0xff000000

3 MOV EDX, 0xff00

3 LEA ECX, [ESI+ESI]

4 XOR ECX, EBP

4 SUB DWORD [ESP+0x2c], 0x1

4 AND EAX, 0xff0000

4 MOV DL, [ESP+0x15]

4 LEA EDX, [ESI+ESI]

5 AND ECX, 0xff

5 XOR EAX, ESP

5 AND EBX, 0xff0000

5 MOV ESI, 0xff00

5 PXOR XMM0, [ESP+0x20]

Fig.
5. Typical instructions
for each compiler
against aes.c
VC17,64,none(Od)
GCC,64,none(O0)Clang,64,none(O0)ICC,64,none(Od)

1 IMUL RAX, RAX, 0x0

1 AND EAX, 0xff000000

1 AND EAX, 0xff000000

1 ADD RDX, RAX

2 INC EAX

2 ADD RAX, 0x1

2 MOV RCX, [RBP-0x8]

2 AND EAX, 0xff000000

3 XOR RCX, RSP

3 MOV RBP, RSP

3 XOR ECX, [RAX*4+0x0]

3 IMUL RDX, RDX, 0x4 35

4 MOV RAX, RCX

4 ADD DWORD [RBP-0x8], 0x1

4 NOP WORD [RAX+RAX+0x0]

4 CMP EAX, EDX

Case Study: Various Optimization Levels
OfficeMalScanner.exe (OMS)

Original Code（no optimization）

Static Link Library（maximum optimization）

36

.text segment(Program Code)

Bit-Image of OMS
NULL (0x00)
Control Characters (0x01-0x1F)
Printable Characters (0x20-0x7F)
Others (0x80-0xFF)
Stirling[10] : a hex editor

Bit-Image View

Hex View[10] K. Goto, "Stirling," https://www.vector.co.jp/soft/win95/util/se079072.html, 1998.

37

.text segment(Program Code)Visualization of OMS by o-glassesX
0x00
0x01-0x1F
0x20-0x7F
0x80-0xFF

1 VC03,32,none
2 VC17,32,none
3 VC03,32,max
4 VC17,32,max
5 VC17,64,none
6 VC17,64,max
7 GCC,32,none
8 GCC,32,max
9 GCC,64,none
10 GCC,64,max
11 Clang,32,none
12 Clang,32,max
13 Clang,64,none
14 Clang,64,max
15 ICC,32,none
16 ICC,32,max
17 ICC,64,none
18 ICC,64,max
19 Others

Visual C++

GCC

Clang

Intel C++ Compiler
38

.text segment(Program Code)Visualization of OMS by o-glassesX
0x00
0x01-0x1F
0x20-0x7F
0x80-0xFF

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

1 VC03,32,none
2 VC17,32,none
3 VC03,32,max
4 VC17,32,max
5 VC17,64,none
6 VC17,64,max
7 GCC,32,none
8 GCC,32,max
9 GCC,64,none
10 GCC,64,max
11 Clang,32,none
12 Clang,32,max
13 Clang,64,none
14 Clang,64,max
15 ICC,32,none
16 ICC,32,max
17 ICC,64,none
18 ICC,64,max
19 Others

Low Optimization Level
High Optimization Level

39

Case Study: Tracking Emdivi RATs in Dev. Env.
EMDIVI malware family is used in targeted email attacks against Japanese organizations.
It allows machines to be remotely controlled by attackers for malicious commands and other activities.

40

The Version of Emdivi- Almost attached malware is compiled just before used
So, the sender and the developer may be in the same group- Frequently Updated
t17: For initial compromise
t19,t20 : For expanding the intrusion (High stealth performance)
41
https://www.macnica.net/security/report_01.html/

Emdivi dataset
Analysis Report made by Macnica Netwoks
https://www.macnica.net/security/report_01.html/

163 MD5 Hashes of the Emdivi Family

42Difference of Emdivi Rats in Dev. Env.
All Sample
Architecture
Compiler family
Optimization level: 32-bit (x86): Visual C++: max

Focusing on Compiler Version
Yellow : relatively new compilerBlue: relatively old compiler

Type A: Yellow
Type B: Blue -> Yellow
Type C: Yellow -> Blue -> Yellow
VC03,32,none
VC17,32,none
VC03,32,max
VC17,32,max
VC17,64,none
VC17,64,max

43

Compile-time and version of Emdivi RATs
16

14

12

10

Type A

8

6

4

16

2

0
16

1

2

3

14

14

12

10

Type B

8

12

6

4

2

10

0
16

1

2

3

14

12

8

Type C

10

8

6

6

4

2

4

5

6

7

8

9

10

11

12

1

2

3

4

5

6

7

8

9

10

11

t100
t20 ←For expanding the intrusion
t19 ←For expanding the intrusion
t17 ←For initial compromise
t16
t15
t11
t9
4

5

6

7

8

9

10

11

12

1

2

3

4

5

6

7

8

9

10

11

12

1

2

3

4

5

6

7

8

9

10

11

12

1

2

3

4

5

6

7

8

9

10

11

12

9

10

11

12

5 months
12

1

2

3

4

5

6

7

8

9

10

11

12

1

2

3

4

5

6

7

8

3 months

0
1

4

2

3

4

5

6

7

2012

8

9

10

11

12

1

2

3

4

5

6

7

2013

8

9

10

11

12

1

2

3

4

5

6

7

2014

8

9

10

11

12

1

2

3

4

5

6

7

2015

8

9

10

11

12

44

Limitation
Obfuscated CodeInput machine code need to be already de-obfuscated.

Multi CPU Architectures
This method may be applied to many CPU architecture besides x86.
Splitting binary by instruction is difficult in two more CPU architectures inputs at the same time.
This limitation will be resolved, if new bin2vec method supporting multi CPU Arc. is released…

45

Conclusion
High Recognition Rate for Stripped Machine Code16-instruction input: .956 accuracy
64-instruction input: .988 accuracy

Solution to Black Box Problem
o-glassesX can calculate how much input data contributes to output in units of instructions

Case Study: Emdivi
It has been revealed that there are three attackers in the same attack group.
o-glassesX and our dataset are available athttps://github.com/yotsubo/o-glassesX

46