<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Publishing DTD v1.3 20210610//EN" "https://jats.nlm.nih.gov/publishing/1.3/JATS-journalpublishing1-3.dtd">
<article article-type="research-article" dtd-version="1.3" xml:lang="ru">
  <front xmlns:xlink="http://www.w3.org/1999/xlink">
    <journal-meta>
      <journal-id journal-id-type="elibrary">9004</journal-id>
      <journal-title-group>
        <journal-title>Problems of information security. Computer systems</journal-title>
        <trans-title-group xml:lang="ru">
          <trans-title>Проблемы информационной безопасности. Компьютерные системы</trans-title>
        </trans-title-group>
      </journal-title-group>
      <issn pub-type="epub">2071-8217</issn>
    </journal-meta>
    <article-meta xmlns:xlink="http://www.w3.org/1999/xlink">
      <article-id pub-id-type="publisher-id">8</article-id>
      <title-group>
        <article-title>Recognizing function prologues in binary files with recurrent neural networks</article-title>
        <trans-title-group xml:lang="ru">
          <trans-title>Распознавание начал функций в бинарных файлах с использованием рекуррентных нейронных сетей</trans-title>
        </trans-title-group>
      </title-group>
      <contrib-group>
        <contrib contrib-type="author">
          <name>
            <surname>Shaikhanov</surname>
            <given-names>Artem</given-names>
          </name>
          <xref ref-type="aff" rid="aff1"/>
          <email>artem.shaykhanov@gmail.com</email>
        </contrib>
      </contrib-group>
      <aff id="aff1">Bauman Moscow State Technical University</aff>
      <pub-date publication-format="electronic" date-type="pub" iso-8601-date="2026-06-09">
        <day>09</day>
        <month>06</month>
        <year>2026</year>
      </pub-date>
      <issue>2</issue>
      <fpage>92</fpage>
      <lpage>112</lpage>
      <self-uri xmlns:xlink="http://www.w3.org/1999/xlink" content-type="pdf" xlink:href="https://jisp.spbstu.ru/userfiles/files/soderzhaniya/pib_2.pdf"/>
      <abstract xml:lang="en">
        <p>The article discusses the problem of recognising function prologues in binary files, which is one of the key subtasks of software reverse engineering. The proposed approach is to use a recurrent neural network that processes byte sequences of a binary file. A comparative analysis of existing neural network models for function recognition was conducted, and their advantages and limitations were identified, which made it possible to justify the choice of a simple and reproducible RNN architecture. The obtained results allow to make conclusions about the influence of model hyperparameters on the quality of model recognition. These hyperparameters correspond to the features of the machine architecture and binary file formats. The experiments were performed on binary files of the ESP32 microcontroller with Xtensa Little Endian architecture and STM-32WBA6 microcontroller of Cortex-M33 core with ARMv8-M architecture using both standard and random alignment, which made it possible to evaluate the model’s resistance to changes in the structure of binary data. Based on the developed model, an extension for the IDA Pro disassembler has been implemented, demonstrating the practical applicability of the proposed approach in real reverse engineering tasks.</p>
      </abstract>
      <kwd-group xml:lang="en">
        <kwd>Reverse engineering</kwd>
        <kwd>recognition</kwd>
        <kwd>binary file</kwd>
        <kwd>function prologue</kwd>
        <kwd>recurrent neural network</kwd>
        <kwd>IDA Pro</kwd>
      </kwd-group>
    </article-meta>
  </front>
</article>
