# Spectrogram of an executable binary [closed]

One of the approaches I have been searching so far is the application of utilizing Neural Network to classify Spectrogram images, which is heavily used in speech recognition.

I am conducting an experiment to identify the similarities of binary executable (raw 0s and 1s), and planning to deploy the same concept of speech recognition on binary executable. I have been preparing the executable with the following criteria:

1- The sampling rate is 8 KHz.

2- The bit Depth is 8-Bits. This means that each sample's amplitude will be represented using 1 Byte.

I am being stuck in generating the Spectrogram. Now my background is networks and programming and I have been doing a lot of research to generate it. The challenge is the identification of the frequencies of the samples I have in order to have the 3-dimensions of spectrogram (frequency, time and amplitude). I did a research, where FFT can be used to generate the frequency domain from the time domain, but not sure if it is feasible for binary executable.

Python supports .wave files spectrogram plotting, but the files I have are executable and not music or sound.

1- Can I identify the used frequencies in my binary by having the sampling rate and amplitude?

2- Can I generate a spectrogram of an executable binary, even if it is NOT originally speech or music?

3- Is there any tool/code that I can utilize for the spectrogram generation?

• Program executables have no "sampling rate." Whatever you use for the "time" dimension will be completely arbitrary. – JRE Dec 19 '19 at 8:34
• You could open a copy of your binary file in Audacity. You can open raw binary files, and tell Audacity what sampling rate and bit depth to use, as well as the number of channels it should assume. Then you could use Audacity's spectrogram functions on it. The frequencies will be completely arbitrary. – JRE Dec 19 '19 at 8:38
• I'm voting to close this question as off-topic because the specific problem that is attempted to be tackled here is not exactly DSP. The justification behind using the spectrogram is the desire to study frequency variations inherent in speech. These variations cannot be defined over an arbitrary byte stream. Better approaches for assessing similarity exist for those cases (for example, even a straight longest-string-similarity would readily return a result). – A_A Dec 20 '19 at 13:57
• I am curious. Could you go further with your question? – Laurent Duval May 23 at 15:35

This serves as potential starting points only, on how to transpose classical signal processing tools to specific kinds of binary data.

First, remember that standard spectrograms, fed as inputs to classifiers, can be seen as means to extract attributes from non-stationary data. There is apparently little need for inversion, so we are interested in analysis only (no synthesis).

Here, we have sequences of 8-bit words $$w_0w_1w_2\ldots w_{N-1}$$. When dealing with binary patterns, the frequency domain might not be the most appropriate. In that case, as with communication systems, the related notion of sequency could be useful. It relates to blocky oscillating patterns of $$\pm 1$$ (or $$0/1$$):

The number of zero-crossing increases in a manner similar to augmenting frequencies in Fourier transforms. I would thus prefer to use those vectors in sliding windows to analyze your binaries. You can find literature in such functions as Walsh, Paley or Hadamard (or WaLeyMard) sequences, depending on their ordering. The proper choice of the transform length is not evident. This seems to exist already, under the name: "Walsh spectrogram": On Generating Walsh Spectrograms, 1976.

I would think it might depend a bit (pun intended) on the compiling or storage system. There is a possibility to look at dyadic size factors with Haar wavelets or Haar wavelet packets.

Note that there exist transformations for data taking values in finite fields, from The Fast Fourier Transform in a Finite Field, 1971, J. M. Pollard.

Other references:

• Harmut, H. F., 1970: Transmission of information by orthogonal functions
• Agaian, S. S., 1984: Hadamard Matrices and Their Applications