# Instruction2 vec: Efficient Preprocessor of Assembly Code to Detect Software Weakness with CNN +
## 1 Introduction  
Potential software weakness that can lead to exploitable security vulnerabilities continues to pose a risk to computer systems. According to Common Vulnerability and Exposures (CVE) [1], 14,714 vulnerabilities were reported in 2017; this was more than twice the number reported in 2016. Various techniques have been proposed to detect vulnerabilities. Among them, static binary analysis detects vulnerabilities without executing binary code. Most static binary analysis processes generate a model by abstracting code and then match the generated model to an existing pattern or rule [2; 3; 4]. However, it is difficult to add new rules and patch them every time an unknown vulnerability arises. This limitation reduces the performance of static binary analysis and increases false positives. In this paper, we propose an improved static binary analysis technique that automatically learns software weakness using machine learning to overcome the above-mentioned limitation. Our ultimate goal was to create a framework for auditing assembly code like humans. Our framework models code using _Instruction2 vec_ ([[https://github.com/firmcode/instruction2](https://github.com/firmcode/instruction2) vec]([https://github.com/firmcode/instruction2](https://github.com/firmcode/instruction2) vec)) and then learns and detects software weaknesses using Text-CNN [5]. Our study is the improvement over our earlier work [6], submitted to ICONI 2017, 17-20 December 2017, Vientiane, Laos. This paper inherits the contribution of the previous paper and proposes a more scalable framework. We also tested our framework with more datasets. Finally, we demonstrate that it can detect software weakness in real world code using STONESOUP. The differences between our framework and existing static binary analysis are described below. Firstly, we suggest a new framework that models assembly code more efficiently. This is called _Instruction2 vec_, inspired by _Word2 vec_[7]. The modeling method of typical static binary analysis tends to over-approximate, which makes it difficult for vulnerabilities to be detected [2]. We studied code modeling method for machine to understand code like humans, taking a cue from _Word2 vec_[5] of nature language processing (NLP). _Word2 vec_ vectorizes each word based on distributional semantics to make the machine understand the meaning of the word. As _Word2 vec_ cannot consider the syntax of the assembly language, we propose _Instruction2 vec_, which can consider it. We proposed to effectively model the assembly code, and then compared it with _Word2 vec_ and _Binary2 img_ used in malware classification[8] to assess its performance. Second, our framework can overcome the pattern-based limit of static binary analysis. Typical static binary analysis detects software weakness by modeling code and matching it with rules or patterns [2; 3; 4]. However, a pattern-based detection algorithm requires human resources and money because it uses the patterns or rules created by experts. In addition, it is difficult to resolve new software weakness using such an algorithm. Our approach performs static binary analysis using deep learning, which does not require patterns, rules, or designs from experts. Our framework can rapidly and easily respond to a new vulnerability by learning software weakness in a preformed deep learning model. This is because Text-CNN--which is our deep learning model--automatically learns the weakness code and extracts its features. The features of weakness code are depicted in a classification model, and Text-CNN can detect weakness in new code based on this model. We compared _Instruction2 vec_ with three preprocessing frameworks--_Instruction2 vec_, _Word2 vec_, and _Binary2 img_--to assess the efficiency of _Instruction2 vec_. Our evaluation was focused on CWE-121, and, after training the _Juliet Test Suite_[9], we tested it with STONESOUP [10] (Securely Taking On New Executable Software of Uncertain Provenance).