Systems and methods for architecture-independent binary code analysis

A system, comprising:

• a processor coupled to a memory;
• and
• a binary analysis platform configured for operation on the processor, the binary analysis platform comprising:
• a normalization module configured to generate canonical intermediate language (CIL) code for binary from architecture-specific, intermediate language (AIL) code of the binary,
• a feature module configured to determine feature vectors for respective functions of the binary based on CIL code associated with the respective functions, and
• a machine-learned (ML) classifier configured to assign a security label to the binary based, at least in part, on the feature vectors determined for one or more of the functions, the security label configured to quantify a security threat associated with the binary.

A non-transitory computer-readable storage medium comprising instructions configured to cause a computing device to implement operations for binary code analysis, the operations comprising:

• generating canonical intermediate language (CIL) code for a binary;
• extracting feature vectors for respective functions of the binary from the CIL code;
• and
• assigning a security label to the binary based, at least in part, on classification of one or more of the feature vectors by a machine-learned (ML) classifier, the security label configured to quantify a security threat associated with the binary.