Assemblage: Automatic Binary Dataset Construction for Machine Learning

TL;DR

Assemblage is a scalable, cloud-based system that automatically constructs large, high-quality binary datasets from Windows and Linux binaries, facilitating improved machine learning models for binary analysis tasks.

Contribution

It introduces a reproducible, extensible platform for automatic binary dataset creation, overcoming limitations of existing corpora for binary analysis research.

Findings

Produced 890k Windows PE binaries and 428k Linux ELF binaries.

Enabled training of modern binary analysis models with high-quality datasets.

Demonstrated the importance of robust corpora for machine learning in binary analysis.

Abstract

Binary code is pervasive, and binary analysis is a key task in reverse engineering, malware classification, and vulnerability discovery. Unfortunately, while there exist large corpora of malicious binaries, obtaining high-quality corpora of benign binaries for modern systems has proven challenging (e.g., due to licensing issues). Consequently, machine learning based pipelines for binary analysis utilize either costly commercial corpora (e.g., VirusTotal) or open-source binaries (e.g., coreutils) available in limited quantities. To address these issues, we present Assemblage: an extensible cloud-based distributed system that crawls, configures, and builds Windows PE binaries to obtain high-quality binary corpuses suitable for training state-of-the-art models in binary analysis. We have run Assemblage on AWS over the past year, producing 890k Windows PE and 428k Linux ELF binaries across 29 configurations. Assemblage is designed to be both reproducible and extensible, enabling users to publish "recipes" for their datasets, and facilitating the extraction of a wide array of features. We evaluated Assemblage by using its data to train modern learning-based pipelines for compiler provenance and binary function similarity. Our results illustrate the practical need for robust corpora of high-quality Windows PE binaries in training modern learning-based binary analyses. Assemblage code is open sourced under the MIT license, and the dataset can be downloaded from https://assemblage-dataset.net