Identification of Processor’s Architecture of Executable Code Based on Machine Learning. Part 1. Frequency Byte Model
Mikhail Buinevich, Израилов Константин Евгеньевич · Proceedings of Telecommunication Universities · 2020
This article shows us the study results of a method for identifying the processor architecture of an executable code based on machine learning. In the first part of the article we see an overview of existing solutions for machine code identifying and we see how the author makes a new method assumption. The author considers features of the machine code instructions and build its frequency-byte model. There is a processor architecture identification scheme, which is based on this model. Apart from that we see the frequency signatures which are provided for the following Top 10 processor architectures: amd64, arm64, armel, armhf, i386, mips, mips64el, mipsel, ppc64el, s390x.