This is somewhat open-ended question, so bear with me please.
Be it a binary payload that you pull from network packet, firmware blob you pull of some EPROM or data intercepted straight from physical bus - does anybody here use machine learning models to learn data representation?
The problem here is that we have a large sequence(s) of binary data of known length which has some kind of a structure (think stream of IP packets) which is yet to be understood.
Assuming we have enough of this data, we can deduce data representations in unsupervised manner, e.g. if we have pcap capture of a network packet flow on ethernet network, we can deduce what ethernet header is, that it is typically followed by something like IP header, then UDP/TCP header and some paylond in the end.
You could replace "classifier" with whatever else we use those ML models (in this case probably RNN-GRU/LSTM) for nowadays (apart from classification it could generate fake traffic etc). But the point is that unlike with common ML domains such as natural language processing, I'm not aware of any model that can be used to replace manual parsing. Most popular NLP model to learn what words mean in context of a sequence nowadays is word2vec, but is there anything like that for representing binary sequences?
PS: I used example in the image just to demonstrate the problem, that could very well be binary code of unknown architecture, USB request block or anything else, point being that it is typically highly structured, opaque and sequential binary input.
I guess the real question is, does anybody use ML for reverse engineering? If so, do you mind sharing your experiences?