ASSEMBLAGE-DEEPHISTORY: A Cross-Build Binary Dataset with Temporal Coverage
The paper introduces ASSEMBLAGE-DEEPHISTORY, a comprehensive cross-build binary dataset containing 73,610 binaries from 248 open-source projects that unifies compilation context, source code, and CVE labels across compilers, optimization levels, and time, enabling novel analyses of binary vulnerability detection and similarity.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are trying to teach a robot how to spot a specific type of broken lock in a million different doors.
In the world of computer security, researchers have been struggling with a problem: they have datasets of "doors" (software programs), but these datasets are incomplete. Some datasets show doors made by different factories (compilers) but only for one specific year. Others show doors from many different years but only made by one factory. None of them show you the same door design, built by different factories, over many years, while also telling you exactly which ones have a broken lock (a vulnerability).
This paper introduces ASSEMBLAGE-DEEPHISTORY, a massive new dataset that finally connects all these dots. Think of it as a "Time-Traveling Door Museum."
The "Time-Traveling Door Museum"
The researchers collected 73,610 different versions of software "doors" from 248 open-source projects.
- The Variety: They didn't just build them one way. They built the same source code using different tools (GCC, Clang, MSVC), on different operating systems (Windows and Linux), and with different settings (optimization levels).
- The Time Machine: They didn't just take a snapshot of today. They went back in time, collecting versions of these projects spanning over two years for many of them.
- The Map: Every single door in this museum is linked to its original blueprint (source code), its history of changes, and a specific list of "broken locks" (CVEs) that were found in them.
Why This Matters: The "Robot" Test
The authors used this museum to test three big ideas, acting like a teacher giving a student a very tricky exam.
1. The "Pattern Matching" vs. "Real Understanding" Test
They asked Large Language Models (AI robots) to find the broken locks.
- The Trap: If the AI just memorized what a broken lock looks like in one specific factory's door, it would fail when the door was built by a different factory.
- The Result: The AI models were surprisingly good at finding the broken locks when they had a description of the problem. However, when they had to look at the raw "door" (the compiled binary) without a description, they struggled. This suggests that while AI is getting better, it sometimes relies on surface-level clues rather than truly understanding the deep mechanics of the code.
2. The "Fingerprint" Test
Researchers tried to see if they could tell which doors belonged to the same family just by looking at their "fingerprints" (digital signatures).
- They tried three different ways of taking fingerprints: one that looks at the whole door shape, one that looks at the internal wiring, and one that looks at the dust on the surface.
- The Result: The "dust" method (called TLSH) was the best at grouping doors from the same family together. The other methods got confused because the different factories made the doors look so different, even though they were the same design.
3. The "Time and Change" Test
They wanted to know: What makes two versions of the same door look different? Is it just the passage of time? Is it the number of changes made? Or is it the specific files that were swapped out?
- Using a special math model, they broke down the differences. They found that how many files were changed was the biggest factor in making the doors look different. Interestingly, just the passage of time (calendar days) didn't matter as much as the actual work done on the code.
The Bottom Line
This paper doesn't just give us a bigger pile of data; it gives us a structured library where every piece of software is connected to its history, its builders, and its flaws.
The main lesson learned is that software is messy. A vulnerability (a broken lock) stays the same in the blueprint, but once it's built into a door by different factories, it looks very different. To truly understand security, we need to study these differences together, not in isolation. This new dataset is the first tool that lets researchers do exactly that.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.