kookmin-sw / capstone-2020-5

악성코드 분석 보조 도구 asi
1 stars 0 forks source link

Embedding Models #9

Open shonhyeongy opened 4 years ago

shonhyeongy commented 4 years ago
  1. word2vec (cbow , skip-gram)
  2. doc2vec (cbow , skip-gram) ETC.
shonhyeongy commented 4 years ago

word2vec skip_gram

Mnemonic vec 8 vec 16 vec 32 vec 64 vec 128
mov xor
push
lea
jnz
jge
jz
jle
jl
pi2fd
jg
xor
jmp
lea
push
retn
inc
jnz
test
pop
vmread
push
xor
jmp
lea
test
jz
cmp
jnz
inc
jle
push
lea
jz
jnz
xor
jmp
test
cmp
inc
retn
push
lea
jz
jmp
jnz
cmp
test
xor
inc
retn
jmp xend
inc
fcmovnu
vfmadd213pd
xor
dec
lgdt
ht jge
setno
cvttps2pi
xor
mov
inc
or
jnz
lea
test
cmp
movzx
jz
mov
lea
push
jnz
cmp
jz
test
xor
inc
retn
mov
jnz
jz
cmp
lea
test
push
xor
retn
inc
mov
jnz
cmp
jz
test
push
lea
retn
xor
inc
add imul
sar
movsx
lea
bsr
vpbroadcastw
movzx
ja
ht js
vpsubb
movzx
ja
inc
sub
cmp
pop
imul
str
jbe
xor
lodsw
shl
shr
paddsw
add ovf
pmulhw
cmpsw
paddw
ucomisd
stc
sub
shr
shl
adc
ldind i4
ldelem i4
imul
movzx
or
movsx
sub
shl
shr
sar
or
imul
movzx
adc
and
movsx
pop fsincos
btc
fxsave
aeskeygenassist
fcmovnbe
vpcmpgtd
leave
xgetbv
sha1nexte
fcmovbe
xor
push
jnz
mov
retn
jz
call
add
vmlaunch
lea
retn
unknown
inc
mov
push
int
jmp
xor
call
setnl
retn
jmp
inc
cmp
lfence
jz
mov
stc
setz
xor
inc
retn
cmp
jz
jmp
mov
jnz
push
test
xor
push lea
mov
js
jz
pfrcp
pi2fd
jl
cvtpi2ps
jge
call
lea
mov
test
js
pop
call
jz
xor
jnz
jl
mov
lea
test
jz
jmp
xor
cmp
jnz
inc
jns
mov
lea
jz
test
jmp
jnz
xor
cmp
inc
jl
mov
lea
test
jz
jmp
jnz
cmp
xor
inc
retn
kjh3141592 commented 4 years ago

Word2Vec Skip-gram

DATA: 정상 5천개

Mnemomnic vec 8 vec 16 vec 32 vec 64 vec128
mov lea
setns
xor
test
cmovnz
cmovz
push
sets
setz
cmovs
lea
xor
cmovnz
push
cmovb
shlx
xchg
cmovz
add
cmp
lea
push
xor
xchg
cmovnz
cmovge
cmovz
inc
sar
movsx
lea
push
inc
xchg
setnz
cmovge
sar
xor
setnl
cwde
lea
push
inc
sar
xor
setnz
cmovge
imul
xchg
cmovg
jmp jge
jl
jnz
jnb
jbe
lea
jb
jg
mov
ja
jl
jb
jge
jnz
jg
ja
retn
jle
jz
jnb
retn
jl
jge
jg
jb
jle
jnz
jz
jns
jbe
retn
jg
lea
jle
jnz
jl
jge
js
ja
jz
retn
jl
jle
jns
jnz
jge
js
jb
jbe
jz
add pextrb
dec
prefetcht1
phaddsw
cmovz
cmp
stmxcsr
psrldq
movd
movq
sub
shl
prefetcht0
mov
movups
dec
shlx
adc
inc
cdq
sub
shl
prefetcht0
prefetchnta
mov
movaps
sar
pshufd
cdq
movups
sub
shl
imul
sar
mov
lea
neg
subpd
pshufd
cmp
sub
shl
movaps
mov
imul
lea
jg
movups
sar
neg
pop leave
xor
fninit
vzeroupper
fldl2e
cmpsd
retn
sfence
fcmovb
fcmovnb
retn
leave
vzeroupper
xor
sfence
pushf
popf
cmpltsd
cmpnlesd
cvtpd2pi
retn
vzeroupper
xor
emms
setz
sfence
leave
setnl
mov
fninit
retn
setz
emms
mov
vzeroupper
leave
setns
setnl
setnz
push
retn
vzeroupper
leave
mov
setz
setnl
setns
jmp
setnz
push
push jns
lea
setns
js
mov
fnclex
test
stosd
cmovs
crc32
lea
mov
test
fnclex
jmp
setns
js
fld1
fldz
cmovns
mov
lea
cmovs
cmovnz
cmovge
cmovns
test
cmovl
fnclex
movsx
lea
mov
stosd
setnz
setz
cwde
test
fstp
cmovnz
cmovz
mov
lea
test
stosd
setz
setnz
fstp
cmovnz
fldz
inc
kjh3141592 commented 4 years ago

Word2Vec CBOW

DATA: 정상 5천개

Mnemomnic vec 8 vec 16 vec 32 vec 64 vec128
mov jmp
lea
jz
jnz
jle
jbe
call
push
jge
jl
jmp
jle
jnz
xor
jbe
jz
jge
jl
jg
ldarg.1
jnz
jmp
jle
jz
jg
xor
jge
jbe
jl
cmpunordps
jmp
jle
jnz
jz
jg
xor
jge
lea
jbe
jl
jmp
jz
jnz
jle
jge
lea
jl
xor
jg
push
jmp mov
jnz
jl
jz
jbe
jge
jg
jle
lea
call
mov
jnz
ret
jz
lea
jl
ldarg.1
box
jle
jge
jnz
mov
jz
jg
jle
lea
jge
setnz
setz
call
mov
lea
jnz
jz
call
setz
jge
jle
jl
jg
mov
lea
jnz
jz
call
jge
jl
push
jle
jg
add jbe
ja
sub
jnb
jg
jle
jge
jz
jnz
jb
ldloc.2
imul
sub
adc
stloc.3
ldloc.3
ldloc.0
ja
stloc.1
sar
ldc.i4.1
imul
ldc.i4.3
ldc.i4.2
jg
ja
stelem.i4
ldelem.i4
sub
bge.s
imul
ja
jb
jnb
jg
jno
adc
sub
jbe
jl
jb
ja
jg
jnb
imul
sub
jl
jbe
adc
shl
pop leave
retn
cgt.un
pushf
stosd
setns
vzeroupper
fsincos
ldnull
fclex
leave
retn
callvirt
castclass
brfalse.s
isinst
ldelem.ref
blt.s
stloc.2
brtrue.s
retn
leave
ldsfld
callvirt
ldelem.ref
xor
pushf
stloc.s
vzeroupper
mov
leave
retn
vfmsub231ss
divpd
vfmsub213sd
vpminsd
vpackusdw
movdq2q
pextrb
pmovzxwd
retn
leave
mov
xor
leave.s
jmp
vcmpgtsd
cmpsd
vdivss
call
push lea
call
mov
jmp
test
throw
ldtoken
vfmsub231sd
jl
jge
lea
call
jz
jnz
mov
jle
jmp
stloc.0
ldarg
jge
call
lea
jz
jnz
js
jmp
box
jle
dup
ldc.i4.0
lea
call
jz
jnz
jmp
jle
mov
js
setnz
test
lea
call
jz
jnz
jmp
mov
jle
test
js
jl
kjh3141592 commented 4 years ago

FastText Skip-Gram

DATA: 정상 5천개

Mnemomnic vec 8 vec 16 vec 32 vec 64 vec128
mov setz
cmovnz
cmovz
setnz
setns
xor
setnl
sets
setl
test
lea
push
add
vmovsd
shlx
cmp
xor
inc
shl
jno
lea
xor
push
shlx
add
shl
sar
inc
setnl
cmovz
lea
push
xor
add
xchg
inc
setnz
vmovsd
cmp
sar
lea
push
add
xor
inc
cmp
cmovz
movzx
movsd
setz
jmp jl
jbe
jb
jnz
jge
jnb
ja
jle
jg
fsincos
jl
jge
jb
jnb
ja
jbe
jg
jle
retn
jnz
retn
jl
jle
jge
jb
jg
jnb
jbe
jnz
js
retn
jle
jg
jl
jge
jns
jnz
lea
js
jb
retn
jle
jl
jnz
jge
jg
jns
js
jz
jb
add dec
cmpneqsd
cmovbe
setnbe
stmxcsr
ucomisd
btr
cvtss2si
maxpd
cmp
sub
prefetcht0
cmpltpd
prefetcht1
mov
movups
adc
cmpnlepd
movddup
prefetchnta
sub
prefetcht0
prefetcht1
shl
prefetch
sar
unpckhpd
imul
mov
prefetchnta
sub
shl
mov
prefetcht1
prefetcht0
lea
cmp
imul
prefetch
pmuldq
sub
mov
imul
lea
cmp
shl
movaps
xorps
addpd
mulpd
pop leave
popf
pushf
jecxz
sti
stc
vroundsd
vzeroupper
cld
loopne
retn
retf
leave
vzeroupper
cmpltsd
popfw
cmplesd
pushf
xor
les
retn
popfw
cmpsw
xor
roundsd
cmpsd
popf
vzeroupper
vroundsd
vcmpgtsd
retn
leave
push
vroundsd
popf
cld
setz
roundsd
vpbroadcastw
popfw
retn
push
leave
mov
call
lea
cmplesd
vzeroupper
jmp
setz
push jns
js
lea
fnclex
call
stosd
test
cmovs
setns
jz
lea
mov
setns
fnclex
haddpd
fsincos
cmovns
cmovnz
cmovle
cmovz
lea
mov
test
fnclex
setns
cmovs
setnz
fld1
xor
setz
lea
mov
test
setnz
setz
cmovnz
stosd
xor
cmovns
ficom
lea
mov
setnz
setz
test
stosd
cmovnz
jz
xor
setns
kjh3141592 commented 4 years ago

FastText CBOW

DATA: 정상 5천개

Mnemomnic vec 8 vec 16 vec 32 vec 64 vec128
mov jmp
jg
jl
cmovnz
jnz
jge
jb
setz
jbe
ldloc.3
jmp
jle
jbe
jnz
jge
push
jz
jnb
jl
lea
jle
jnz
jmp
jge
jz
jl
jg
jbe
jnb
jb
jle
jnz
jz
jmp
jge
jg
xor
jbe
jnb
jl
jmp
jnz
jle
jz
jge
jl
jg
jnb
push
jbe
jmp mov
jg
jl
ldloc.3
cmovnz
jnz
jge
jb
ldloc.2
jbe
mov
jl
jb
jnz
jge
jbe
fcmovnbe
lea
fcmovnb
jg
mov
jge
lea
jl
jnz
jg
jle
jb
pushfw
ja
mov
lea
jge
jnz
movss
setp
push
jg
jle
jnb
mov
lea
movss
jge
jnz
jl
push
movaps
test
jz
add ldind.ref
ldelem
ldelema
stmxcsr
movzx
ldelem.r8
ldelem.r4
endfinally
stloc
starg.s
movddup
movshdup
movsldup
inc
imul
movntq
movd
movnti
movsx
movntdq
jno
imul
adc
psignw
movnti
cvttps2dq
fcmovb
cvtps2dq
paddusw
pavgw
jno
shlx
jg
imul
adc
movnti
fiadd
cmovb
fimul
movntdq
imul
jg
adc
fimul
fiadd
addsd
jno
jl
sub
ja
pop leave
newobj
retn
ldnull
ldvirtftn
rethrow
ldsfld
ret
leave.s
iret
retn
leave
popfw
popcnt
brtrue
popf
fsave
lds
callvirt
brtrue.s
retn
leave
popfw
popcnt
popf
popa
castclass
leave.s
isinst
pushf
retn
leave
popfw
leave.s
popf
movhlps
popcnt
br.s
movlhps
ldsfld
retn
leave
popfw
leave.s
popf
popa
popcnt
xor
br.s
ldsflda
push lea
call
jl
jmp
mov
ldelem.ref
jle
jge
ldstr
jnz
call
lea
ldtoken
mov
ldstr
pushfw
box
calli
jnz
pusha
lea
call
pushfw
calli
jmp
jnz
jz
pusha
pmulhw
mov
lea
call
pushfw
pusha
jnz
jz
jmp
mov
jle
jge
lea
call
pushfw
jmp
jnz
jz
mov
jl
pusha
test
kjh3141592 commented 4 years ago

Doc2Vec DM

DATA: 정상 5천개

Mnemomnic vec 8 vec 16 vec 32 vec 64 vec128
mov lea
stosd
xor
push
stosw
movsd
cmpxchg
sar
fldz
stosb
lea
push
xor
movss
cmpsb
xorps
cmpsd
sar
fst
jecxz
push
movss
pushf
xchg
vmovsd
movq
lea
bswap
paddsb
cpuid
push
lea
cpuid
aesenc
movaps
cmp
xadd
movss
xchg
imul
push
lea
vfmsub213sd
vfmsub231ss
vfmsub231sd
cmp
movzx
vfnmadd213ss
vpclmulqdq
vfmsub213ss
jmp jno
retn
jnb
jb
jl
ja
jbe
ror
jge
ud2
retn
vpmuldq
vfmsub213ps
vhaddps
retf
ldloc.2
jl
hlt
vpmullw
loope
retn
jns
js
jle
jnz
jg
ja
jnb
jb
pxor
retn
jnz
js
jle
jns
jz
jl
jb
jnb
jbe
retn
jnz
js
jz
jle
jns
jl
jb
jnb
jge
add sub
switch
cmpltss
cbw
ldc.i4.8
ldc.i4.4
and
ldc.i4.1
vldmxcsr
ldc.i4.6
vbroadcastsd
vmovaps
vmovddup
prefetcht0
prefetchnta
pavgb
vbroadcastss
vunpcklpd
vmovq
vmovhps
conv.i
mul
mul.ovf.un
vmovntdq
inc
add.ovf
ldind.u2
pshufb
vmovdqu
fadd
ldelem.i2
vaddss
vmovntdq
vminps
add.ovf
vcvtps2dq
vmaxps
vmovlps
bne.un.s
vpackuswb
add.ovf
blt.un
rem.un
blt.un.s
ldelem.i2
sub.ovf
bge.un
vpaddd
ble.un
div.un
pop leave
sfence
endfinally
vzeroupper
lodsd
pushf
jecxz
brtrue
brfalse
ror
leave
vpsrld
cmpltss
cvtpd2pi
vpslldq
vpmuldq
vfmsub213ss
vzeroupper
vfnmadd132sd
vcmpeqps
leave
jecxz
retn
castclass
retf
vzeroupper
cmpltsd
loop
jo
iret
leave
vhaddps
jecxz
cvttps2pi
retf
loope
andnpd
vfmsub231ps
iret
vcmpgt_oqps
leave
jmp
callvirt
vpmuldq
jecxz
cvttps2pi
iret
loop
retn
hlt
push lea
mov
call
fldz
setnle
stosd
ldtoken
fucom
fst
fstp
lea
mov
pmulhw
vcmpnle_uqps
movsx
vcmple_oqps
psubusw
movq
psubw
vfmadd231sd
mov
lea
paddsb
movss
test
paddusb
vaesenc
subps
movdqa
vpxor
mov
vfmsub231ss
lea
vfmsub231sd
vsubss
vfmadd231sd
vfmsub213sd
maxps
packssdw
vmaxss
mov
vfmsub231sd
vfmsub213sd
lea
vfmadd231sd
vcmpgt_oqps
vfmsub231ss
cmpnleps
maxps
minps
kjh3141592 commented 4 years ago

Doc2Vec DBOW

DATA: 정상 5천개

Mnemomnic vec 8 vec 16 vec 32 vec 64 vec128
mov lea
stosd
xor
push
stosw
movsd
cmpxchg
sar
fldz
stosb
lea
push
xor
movss
cmpsb
xorps
cmpsd
sar
fst
jecxz
push
movss
pushf
xchg
vmovsd
movq
lea
bswap
paddsb
cpuid
push
lea
cpuid
aesenc
movaps
cmp
xadd
movss
xchg
imul
push
lea
vfmsub213sd
vfmsub231ss
vfmsub231sd
cmp
movzx
vfnmadd213ss
vpclmulqdq
vfmsub213ss
jmp jno
retn
jnb
jb
jl
ja
jbe
ror
jge
ud2
retn
vpmuldq
vfmsub213ps
vhaddps
retf
ldloc.2
jl
hlt
vpmullw
loope
retn
jns
js
jle
jnz
jg
ja
jnb
jb
pxor
retn
jnz
js
jle
jns
jz
jl
jb
jnb
jbe
retn
jnz
js
jz
jle
jns
jl
jb
jnb
jge
add sub
switch
cmpltss
cbw
ldc.i4.8
ldc.i4.4
and
ldc.i4.1
vldmxcsr
ldc.i4.6
vbroadcastsd
vmovaps
vmovddup
prefetcht0
prefetchnta
pavgb
vbroadcastss
vunpcklpd
vmovq
vmovhps
conv.i
mul
mul.ovf.un
vmovntdq
inc
add.ovf
ldind.u2
pshufb
vmovdqu
fadd
ldelem.i2
vaddss
vmovntdq
vminps
add.ovf
vcvtps2dq
vmaxps
vmovlps
bne.un.s
vpackuswb
add.ovf
blt.un
rem.un
blt.un.s
ldelem.i2
sub.ovf
bge.un
vpaddd
ble.un
div.un
pop leave
sfence
endfinally
vzeroupper
lodsd
pushf
jecxz
brtrue
brfalse
ror
leave
vpsrld
cmpltss
cvtpd2pi
vpslldq
vpmuldq
vfmsub213ss
vzeroupper
vfnmadd132sd
vcmpeqps
leave
jecxz
retn
castclass
retf
vzeroupper
cmpltsd
loop
jo
iret
leave
vhaddps
jecxz
cvttps2pi
retf
loope
andnpd
vfmsub231ps
iret
vcmpgt_oqps
leave
jmp
callvirt
vpmuldq
jecxz
cvttps2pi
iret
loop
retn
hlt
push lea
mov
call
fldz
setnle
stosd
ldtoken
fucom
fst
fstp
lea
mov
pmulhw
vcmpnle_uqps
movsx
vcmple_oqps
psubusw
movq
psubw
vfmadd231sd
mov
lea
paddsb
movss
test
paddusb
vaesenc
subps
movdqa
vpxor
mov
vfmsub231ss
lea
vfmsub231sd
vsubss
vfmadd231sd
vfmsub213sd
maxps
packssdw
vmaxss
mov
vfmsub231sd
vfmsub213sd
lea
vfmadd231sd
vcmpgt_oqps
vfmsub231ss
cmpnleps
maxps
minps