Abstract: The present invention performs high-throughput disassembly for executable code comprising a plurality of instructions. An input of the executable code is received. Exhaustive disassembly is performed on the executable code to produce a set of exhaustively disassembled instructions. An instruction flow graph is constructed from the exhaustively disassembled instructions. Instruction embedding is performed on the exhaustively disassembled instructions to construct embeddings.

Abstract: The present invention performs high-throughput disassembly for executable code comprising a plurality of instructions. An input of the executable code is received. Exhaustive disassembly is performed on the executable code to produce a set of exhaustively disassembled instructions. An instruction flow graph is constructed from the exhaustively disassembled instructions. Instruction embedding is performed on the exhaustively disassembled instructions to construct embeddings.

Abstract: A novel high-throughput embedding generation and comparison system for executable code is presented in this invention. More specifically, the invention relates to a deep-neural-network based graph embedding generation and comparison system. A novel bi-directional code graph embedding generation has been proposed to enrich the information extracted from code graph. Furthermore, by deploying matrix manipulation, the throughput of the system has significantly increased for embedding generation. Potential applications such as executable file similarity calculation, vulnerability search are also presented in this invention.

Abstract: A novel high-throughput embedding generation and comparison system for executable code is presented in this invention. More specifically, the invention relates to a deep-neural-network based graph embedding generation and comparison system. A novel bi-directional code graph embedding generation has been proposed to enrich the information extracted from code graph. Furthermore, by deploying matrix manipulation, the throughput of the system has significantly increased for embedding generation. Potential applications such as executable file similarity calculation, vulnerability search are also presented in this invention.