ABSTRACT
The explosion of complex binaries, embedded firmware, and sophisticated malware has pushed traditional, manual reverse engineering to its absolute limits. It's a relentless battle against undocumented systems, obfuscated code, and an overwhelming volume of samples that manual analysis simply cannot win at scale. This 32 hour course, "Machine Learning for Reverse Engineers," is your definitive solution, equipping you with the advanced AI techniques necessary to transform your workflow from painstaking to powerfully automated.
We begin by establishing a robust foundation in advanced program analysis. You will learn to automatically map intricate code relationships, rapidly cluster vast binary datasets by intrinsic code similarity, and efficiently identify novel samples by comparing them against known code sharing patterns. A significant focus will be placed on understanding and leveraging Intermediate Representations (IRs) – how they're constructed and how they serve as the bedrock for scalable, automated program analysis.
Next, we transition into the core of machine learning, directly demonstrating its profound impact on reverse engineering challenges. You'll gain practical, hands-on experience applying unsupervised learning algorithms to discover hidden structure and extract valuable features from raw binary data, even without prior knowledge. We will then architect robust supervised machine learning models to accurately classify binaries by family, behavior, or malicious intent, and make intelligent, data-driven predictions. The course will then delve into the transformative power of deep learning, enabling you to construct and optimize neural networks for sophisticated, automated binary analysis. Crucially, you will explore the practical integration of cutting-edge Generative AI (GenAI) techniques to radically improve your efficiency and productivity.
Each module is reinforced with intensive, hands-on labs within a dedicated virtual environment, ensuring you not only grasp the theoretical underpinnings but also build and deploy real-world solutions. You will leave this course with immediate, practical experience and actionable methodologies to conduct automated program analysis at scale for:
- Binary Analysis
- Malware Analysis
- Firmware Analysis
- Network/IoT Analysis
- Mobile Security Analysis
- Security Research / Vulnerability Discovery
WHO SHOULD ATTEND
- Reverse engineers, security researchers, and analysts with little to no experience with machine learning
- Analysts, security researchers, and reverse engineers who want to automate and scale their program analysis and reverse engineering process
KEY LEARNING OBJECTIVES
- Performing Shared Code Analysis
- Leveraging intermediate representations for advanced program analysis
- Introduction to Machine Learning
- Understanding your data using descriptive statistics and visualization techniques
- Exploring Unsupervised ML algorithms
- Developing Supervised ML models
- Building Neural Networks
- Applying Generative AI
- Evaluating, measuring, and optimizing the effectiveness of ML systems
- Automating machine learning workflows
COURSE DETAILS
Module 1:
- Introduction to advanced program analysis
- Identifying and extracting program features
- EXERCISE: Similarities Lab
- Leveraging N-Grams for program analysis
- EXERCISE: N-Grams Lab
- Performing agnostic program analysis
- EXERCISE: Architecture and Compiler Agnostic Analysis Lab
- Introduction to intermediate representations
- EXERCISE – IR Lab
Module 2:
- Introduction to Machine Learning
- Evaluating ML systems
- Unsupervised ML algorithm: K-Means Clustering
- EXERCISE: K-Means Lab
- Unsupervised ML algorithm: Agglomerative Hierarchical Clustering
- EXERCISE: Agglomerative Analysis Lab
- Unsupervised ML algorithm: DBSCAN
- EXERCISE: DBSCAN Lab
- Unsupervised ML algorithm: Principal Component Analysis
- EXERCISE: PCA Lab
Module 3:
- Introduction to Supervised Machine Learning
- Supervised ML algorithm: Logistic Regression
- EXERCISE: Logistic Regression Lab
- Supervised ML algorithm: Decision Tree
- EXERCISE: Decision Tree Lab
- Supervised ML algorithm: Random Forest
- EXERCISE: Random Forest Lab
- Supervised ML algorithm: K Nearest Neighbors
- EXERCISE: KNN Lab
- Supervised ML algorithm: Support Vector Machines
- EXERCISE: SVM Lab
Module 4:
- Introduction to Neural Networks
- Building Neural Networks for Program Analysis
- EXERCISE: Neural Networks Development Lab
- Evaluating Neural Networks
- EXERCISE: Neural Networks Performance Lab
- Transformers and Large Language Models (e.g., OpenAI GPT, Google Gemini, Llama, etc.)
- EXERCISE: Gen AI Lab
Prerequisites
- Knowledge of Python 3 programming
- Knowledge of computer architecture concepts
- Knowledge of an assembly language (e.g., x86/x64, ARM, etc.)
- Familiarity with navigating Linux environments and command line knowledge
Hardware Requirements
- A working laptop or desktop (no Netbooks, no Tablets, no iPads)
- Intel Core i5 (equivalent or superior) required
- 8GB RAM required, at a minimum
- 50 GB free hard disk space, at a minimum
Software Requirements
The following software needs to be installed on each student laptop prior to the workshop:
- Linux / Windows / Mac OS X desktop operating systems
- VMware Workstation or Fusion. The free 30-day trial is sufficient and can be downloaded by following the tutorial here: https://www.mikeroysoft.com/post/download-fusion-ws/
- Administrator / root access MANDATORY
Provided to Students
Students will be provided with access to course slides, sample code, and lab exercises which attendees can keep to continue their learning and practicing after the training ends.
YOUR INSTRUCTOR: Hahna Latonick
For the past 19 years of her engineering career, Hahna Kane Latonick has worked throughout the defense industry specializing in cybersecurity as a computer security researcher for the Department of Defense and several defense contracting companies. She has been featured as a cybersecurity subject matter expert on Fox Business News, ABC, U.S. News and World Report, and other national media outlets. She currently serves as a Director of R&D for a cybersecurity firm and has led four tech startups related to computer security, serving as CTO of two of them, VP of R&D, and Director of R&D. She has trained and developed security researchers at one of the top five aerospace and defense industry companies. She has also taught at Black Hat, DEF CON, CanSecWest, Ringzer0, and BSides. She’s had top place finishes at DEF CON CTFs: third place for the 2024 RF CTF and tying first place at the 2023 IoT CTF. She also placed 6th in the DEF CON CTF finals, ranking in the top 1.5% of ethical hackers worldwide. She also holds security certifications, including CISSP, CEH, and Certified Android Exploit Developer. Latonick attended Swarthmore College and Drexel University where she earned her B.S. and M.S. in Computer Engineering along with a Mathematics minor.
Twitter: https://twitter.com/hahnakane
LinkedIn: https://www.linkedin.com/in/hahnakane/
Ringzer0
COUNTERMEASURE25: 60+ days before the event 75% of fees refunded; 45-60 days before event 50% refunded, less than 45 days 0% refunded. Course changes are allowed up to 14 days before event start (some restrictions will apply). Attendee changes can be accommodated up to 14 days prior to the event.
Note: In the event of a class cancellation, Ringzer0 will endeavor to offer transfer to another training at no additional charge.
