This extended abstract of the doctoral thesis introduces the recognition of specific behavior by generic reverse compilation. The generic reverse compilation is a process that transforms executables from different architectures and object file formats to the same high level language. This process is covered by a tool Lissom Decompiler. For a purpose of behavior recognition, we introduce Language for Decompilation-LfD. LfD represents a simple imperative language, which is suitable for a

more »

... n. The specific behavior is given by the known executable (e.g. malware) and the recognition is performed as finding the ratio of similarity with other unknown executable. This ratio of similarity is calculated by a tool LfDComparator, which processes two LfD sources to decide their similarity.