TECHNOLOGY LICENSING OPPORTUNITY Annotated and Translated Disassembled Code (@DisCo) A cross platform binary analysis method which annotates the features of a neutral intermediate language for use in machine learning. Opportunity: Idaho National Laboratory (INL), managed and operated by Battelle Energy Alliance, LLC (BEA), is offering the opportunity to enter into a license and/or collaborative research agreement to commercialize the Annotated Disassembled Code technology. Overview: The typical approach for machine learning in this problem domain either use the raw bytes, a graph representation or raw disassembler. INL’s research found that each of these representations fail to encode all the relevant information contained within executable code, leading to shortcomings when attempting to perform more sophisticated analysis tasks via machine learning. INL’s research into using supervised learning to analyze compiled software requires an assembly like language which is platform neutral and works well for machine learning. There are several problems that often occur with other assembly code representations. Assembly code typically consists of an operand and one or more arguments which often refer to a memory address. These addresses are part of any assembly languages vocabulary, making for a potential vocabulary size that is many orders of magnitude too large to work in any machine learning task which requires vocabulary. Of the popular assembly representations, only the graph-based approaches make any attempt to preserve information regarding the structure and semantics required in many analysis tasks. Most representations fail to handle addresses in a way that de-emphasizes the fact that the absolute value of the address is often unimportant. Also, raw assembly language is highly platform specific, working only with that one platform. Description: INL’s approach overlooks the address spaces, and instead delves into the singular operations performed within each function and block. The technology uses various assembler lifters and their respective intermediate languages to capture the underlying instruction statements. How many times each instruction appears within a block of code is counted, resulting in a vector that is able to fingerprint each function. This representation vectorizes the data into the correct forms needed by various machine learning models. This representation can be stored as text and is also suitable for use in a graph database. Benefits: Many platforms can be supported. It is possible to add support for new platforms as needed. Allows the use of machine learning techniques and models that have not been successfully used before. Applications: Binary analysis Development Status: TRL 4. The technology has been validate in a laboratory environment. IP Status: Provisional Patent Application No. 63/094,331, “Systems and Methods for Architecture-Independent Binary Code Analysis,” BEA Docket No. BA-1165. INL is seeking to license the above intellectual property to a company with a demonstrated ability to bring such inventions to the market. Exclusive rights in defined fields of use may be available. Please visit Technology Deployment’s website at https://inl.gov/inl-initiatives/technology-deployment for more information on working with INL and the industrial partnering and technology transfer process. Companies interested in learning more about this licensing opportunity should contact Andrew Rankin at
[email protected].