Using recurrent neural networks for probabilistic classification of the processor architecture of executable files

Abstract

The main problem of applying recurrent neural networks to the problem of classifying processor architectures is that the use of a recurrent neural network is complicated by the lack of blocks that allow memorizing and taking into account the result of work at each next step. To solve this problem, the authors proposed a strategy for using a neural network based on the mechanism of controlled recurrent blocks. Each neuron of such a network has a memory cell, which stores the previous state and several filters. The update filter determines how much information will remain from the previous state and how much will be taken from the previous layer. The reset filter determines how much information about previous states is lost. The purpose of the work is to increase the efficiency of determining the processor architecture by code from executable files running on this processor by creating methods, algorithms and programs that are invariant to constant data (strings, constants, header sections, data sections, indents) contained in executable files. The paper discusses the features of the use of recurrent neural networks on the example of the problem of classifying the processor architecture by executable code from compiled executable files. The features of the machine code of various processor architectures used in modern computing have been briefly considered. The use of recurrent neural networks has been proposed, which have advantages in terms of speed and accuracy in solving classification problems. It is noted that in order to improve the classification results and practical use, it is necessary to provide a larger volume of the training sample for each of the classes, as well as to expand the number of classes. The proposed method based on a neural network with a mechanism of controlled recurrent blocks has been implemented in the software package that allows processing digital data from executable files for various processor architectures, in particular at the initial stage of security audit of embedded systems in order to determine a set of technical means that can be applied to analysis at subsequent stages. Conclusions have been drawn about the results of measuring the performance metrics of the algorithm and the possibility of expanding functionality without making changes to the architecture of the software package.