English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Malicious document files used in targeted attacks often contain a smallprogram called shellcode. It is often hard to prepare a runnable environmentfor dynamic analysis of these document files because they exploit specificvulnerabilities. In these cases, it is necessary to identify the position ofthe shellcode in each document file to analyze it. If the exploit code usesexecutable scripts such as JavaScript and Flash, it is not so hard to locatethe shellcode. On the other hand, it is sometimes almost impossible to locatethe shellcode when it does not contain any JavaScript or Flash but consists ofnative x86 code only.  Binary fragment classification is often applied to visualize the location ofregions of interest, and shellcode must contain at least a small fragment ofx86 native code even if most of it is obfuscated, such as, a decoder for theobfuscated body of the shellcode. In this paper, we propose a novel method,o-glasses, to visualize the shellcode by recognizing the x86 native code usinga specially designed one-dimensional convolutional neural network (1d-CNN). Thefragment size needs to be as small as the minimum size of the x86 native codein the whole shellcode. Our results show that a 16-instruction-sequence(approximately 48 bytes on average) is sufficient for the code fragmentvisualization. Our method, o-glasses (1d-CNN), outperforms other methods inthat it recognizes x86 native code with a surprisingly high F-measure rate(about 99.95%).

o-glasses: Visualizing x86 Code from Binary Using a 1d-CNN