:   -
 


          -.  20         ,   (, opcodes, CFG, IR),  , Graph Neural Networks, ,   ,   ,   LLM-, binary similarity,  malware  firmware,   Ghidra, radare2  Binary Ninja, fine-tuning,     .      ,     20252026 .      , reverse engineers  ,   Python   ML.         AI-assisted workflow        .





 

:   -








- (RE)       ,     IDA Pro, Ghidra, Binary Ninja  radare2.         (LLM)   :     ,  ,  ,      malware  firmware.

   ,    -, Python    .  -   :       fine-tuning LLM    .

        2025-2026 :   ML-  LLM4Decompile, Ventris, Graph Neural Networks,    Neo4j  NL2GQL,     Ghidra, radare2  Binary Ninja.

  ,    :  1-7  , 8-15   , 16-20  ,   .      ,  ,        .




 1.   -   





1.1.   -



- -        .  :  ,  ,  malware, firmware  ,   ,   .

 :     (PE, ELF, Mach-O)  ,    .  - ,   ,    (,  , )    ,   .




  RE


Triage -   , ,  packer/protector,  entropy .



Static analysis - ,  CFG  call graph, ,    .

Dynamic analysis -  (x64dbg, GDB, WinDbg),  API, memory dumps, sandbox.

Semantic recovery -  ,  , ,  .




1.2.   



     :    ,  ,   ( C++,    , ).  (VMProtect, Themida,   ),  (UPX,  packers),   (O1-O3, LTO)       .

   (       )     .       ,    .




1.3.    RE



    , ,   .  :

- 

2018-2020: RNN  function boundary detection   NMT-.



- 

2021-2023: Graph Neural Networks, BERT-   type recovery  naming,   neural decompilers (Neutron, Coda, NeurDP).

- 

2024-2026: LLM (LLM4Decompile, Ventris), agentic systems, hybrid symbolic+neural ,    Ghidra/IDA.

   : binary classification, function similarity, type recovery, function naming, neural decompilation, malware detection  clustering, summarization, YARA generation, agentic automation.




1.4. :     AI-assisted



:    ransomware  IDA,        (AES S-box, XOR-),  . :   (.  14)   encryption loops    95%,   LLM       YARA-.




 2.      





2.1.  


Supervised learning:    (  - ). : 10000 samples    malware - Random Forest      .

Unsupervised learning:    .  embeddings      malware    .

Self-supervised learning: Masked Language Modeling    assembly      .     .




2.2.   RE    ML


- 

Binary classification - malicious/benign   malware.

- 

Function similarity / clone detection -      .

- 

Type recovery -     .

- 

Function naming  summarization -    .

- 

Neural decompilation -  assembly/P-Code  C- .

- 

Anomaly detection -     firmware.




2.3. 


 : accuracy, precision, recall, F1-score, ROC-AUC.    re-executability rate (          ).  embeddings - cosine similarity  retrieval metrics (Recall@K).

        (O0, debug-),    stripped + O2/O3  -      .




2.4.  


- 

Data leakage:             train,   test -  .

- 

Domain shift: ,   GCC x86,     MSVC ARM64.

- 

Class imbalance:  malware-  95% benign - accuracy 95%   .

- 

Overfitting     .




2.5. 


scikit-learn -  baseline. PyTorch / TensorFlow - deep learning. Hugging Face Transformers -    LLM.  : LIEF, pefile, capstone, Ghidra headless, Binary Ninja API.




 3.     





3.1.  


   n-:  .        .text.    packer detection   ,   .

Opcode sequences:  (Capstone, Ghidra)     (mov, call, xor).  opcodes         .

Intermediate Representations: P-Code (Ghidra), LLVM IR, Binary Ninja IL, ESIL (radare2). IR    -      x86, ARM  MIPS.     cross-architecture analysis.




3.2.  


Control Flow Graph (CFG) -  =  ,  = . Data Flow Graph (DFG)   . Call graph -   .      Graph Neural Networks.

  :  ( URL, ,   ),   ( API  ), , , TLS-callbacks.




3.3. Canonicalization


         .  :

- 

     (ADDR, IMM).

- 

  (eax/rax -> REG0)     .

- 

    ( , ,   ).

- 

 NOP   .




3.4. Tokenization  


Assembly   .  vocabulary: , ,  .    :

push REG | mov REG, IMM | call ADDR | add REG, REG | ret

BPE  WordPiece      assembly.       -   .




3.5.    


  LIEF + Capstone    :     entropy, , ,  N  entrypoint,   4 .      baseline malware-.




 4.  ML-  RE





4.1. Feature engineering


 ,    :

- 

Entropy   ( entropy -    ).

- 

    .

- 

    ( VirtualAlloc + WriteProcessMemory + CreateRemoteThread - injection).

- 

 CFG:   ,  ,  .




  .


   .

   ,     (https://www.litres.ru/book/uchitel-nachalnoy/kurs-neiroseti-dlia-revers-inzhiniringa-74599103/)  .

      Visa, MasterCard, Maestro,    ,   ,     ,  PayPal, WebMoney, ., QIWI ,       .


