  Malicious document files used in targeted attacks often contain a small
program called shellcode. It is often hard to prepare a runnable environment
for dynamic analysis of these document files because they exploit specific
vulnerabilities. In these cases, it is necessary to identify the position of
the shellcode in each document file to analyze it. If the exploit code uses
executable scripts such as JavaScript and Flash, it is not so hard to locate
the shellcode. On the other hand, it is sometimes almost impossible to locate
the shellcode when it does not contain any JavaScript or Flash but consists of
native x86 code only.
  Binary fragment classification is often applied to visualize the location of
regions of interest, and shellcode must contain at least a small fragment of
x86 native code even if most of it is obfuscated, such as, a decoder for the
obfuscated body of the shellcode. In this paper, we propose a novel method,
o-glasses, to visualize the shellcode by recognizing the x86 native code using
a specially designed one-dimensional convolutional neural network (1d-CNN). The
fragment size needs to be as small as the minimum size of the x86 native code
in the whole shellcode. Our results show that a 16-instruction-sequence
(approximately 48 bytes on average) is sufficient for the code fragment
visualization. Our method, o-glasses (1d-CNN), outperforms other methods in
that it recognizes x86 native code with a surprisingly high F-measure rate
(about 99.95%).
