Abstract: Binaries configured for execution within respective computing environments may be disassembled into architecture-specific intermediate (AIL) representations. The AIL representations may be converted into canonical intermediate language (CIL) representations. The CIL representations may comprise normalized, architecture-independent code configured to characterize functionality of respective components of a binary (e.g., respective functions or the like). Feature vectors may be extracted from the CIL representations. The feature vectors may be used to identify components of respective binaries, assign security classifications to the binaries, and/or the like.

Abstract: Binaries configured for execution within respective computing environments may be disassembled into architecture-specific intermediate (AIL) representations. The AIL representations may be converted into canonical intermediate language (CIL) representations. The CIL representations may comprise normalized, architecture-independent code configured to characterize functionality of respective components of a binary (e.g., respective functions or the like). Feature vectors may be extracted from the CIL representations. The feature vectors may be used to identify components of respective binaries, assign security classifications to the binaries, and/or the like.

Abstract: Network monitoring systems, computer-readable storage media, and methods monitor a network. Communication data is captured from the network in a substantially passive manner. The communication data is organized to represent a plurality of conversations between a plurality of hosts on the network. Each conversation of the plurality includes a first address of a first host of the plurality of hosts, a service port identifier on the first host, and a second address of a second host of the plurality of hosts. Information correlated to at least some of the plurality of conversations is presented on a graphical user interface.