System and method for binary code decompilation using machine learning

1. A method of training a machine learning algorithm for decompiling binary code into readable source code, the method comprising:

collecting a data set including source code in a programming language and at least one element associated with the source code;

providing binary code using the data set;

training a model configured to decompile the binary code into source code using the data set by:

decompiling the collected binary code into intermediate source code in the programming language;

comparing the source code in the data set with the intermediate source code; and

updating the model and repeating the training if the source code in the data set differs from the intermediate source code by more than a threshold amount, and determining that the model is trained if the source code in the data set does not differ from the intermediate source code by more than a threshold amount.

2. The method of claim 1 , wherein the model is a sequence-to-sequence model.

3. The method of claim 1 , wherein the threshold amount includes an error rate.

4. The method of claim 1 , wherein comparing includes comparing a fuzzy hash of the source code in the data set to a fuzzy hash of the intermediate source code.

5. The method of claim 1 , wherein the at least one element includes the programming language associated with the source code, a compiler name and version associated with the source code, target triplets, a compiler type associated with the source code, or compiler flags.

6. The method of claim 1 , wherein providing binary code using the data set includes compiling the source code in the data set using the at least one element.

7. The method of claim 1 , wherein the source code in the data set is compared with the intermediate source code with a loss function.

8. The method of claim 1 , further comprising:

receiving an executable file or a binary code segment identified within a file;

receiving identifying information associated with the executable file or the binary code segment; and

decompiling the executable or the binary code segment using the identifying information

by processing the executable or the binary code segment using the trained machine learning algorithm.

9. A non-transitory computer-readable medium storing a computer program, which, when read and executed by a computer causes the computer to perform a method of training a machine learning algorithm for decompiling binary code into readable source code, the method comprising:

collecting a data set including source code in a programming language and at least one element associated with the source code;

providing binary code using the data set;

training a model configured to decompile the binary code into source code using the data set by:

decompiling the binary code into intermediate source code in the programming language;

comparing the source code in the data set with the intermediate source code; and

updating the model and repeating the training if the source code in the data set differs from the intermediate source code by more than a threshold amount, and determining that the model is trained if the source code in the data set does not differ from the intermediate source code by more than a threshold amount.

10. The non-transitory computer-readable medium of claim 9 , wherein the model is a sequence-to-sequence model.

11. The non-transitory computer-readable medium of claim 9 , wherein the threshold amount includes an error rate.

12. The non-transitory computer-readable medium of claim 9 , wherein comparing includes comparing a fuzzy hash of the source code of the data set to a fuzzy hash of the intermediate source code.

13. The non-transitory computer-readable medium of claim 9 , wherein the at least one element includes the programming language associated with the source code, a compiler name and version associated with the source code, target triplets, a compiler type associated with the source code, or compiler flags [ ].

14. The non-transitory computer-readable medium of claim 9 , wherein providing binary code using the data set includes compiling the source code in the data set using the at least one element.

15. The non-transitory computer-readable medium of claim 9 , wherein the source code in the data set is compared with the intermediate source code with a loss function.

16. A system for training a machine learning algorithm for decompiling binary code into readable source code, the system having one or more processors configured for:

collecting a data set including source code in the programming language and at least one element associated with the source code;

providing binary code using the data set;

training a model configured to decompile the binary code into source code using the data set by:

decompiling the binary code into intermediate source code in the programming language;

comparing the source code in the data set with the intermediate source code; and

updating the model and repeating the training if the source code in the data set differs from the intermediate source code by more than a threshold amount, and determining that the model is trained if the source code in the data set does not differ from the intermediate source code by more than a threshold amount.

17. The system of claim 16 , wherein the model is a sequence-to-sequence model.

18. The system of claim 16 , wherein the threshold amount includes an error rate.

19. The system of claim 16 , wherein comparing includes comparing a fuzzy hash of the source code of the data set to a fuzzy hash of the intermediate source code.

20. The system of claim 16 , wherein the at least one element includes the programming language associated with the source code, a compiler name and version associated with the source code, target triplets, a compiler type associated with the source code, or compiler flags.