Powered by OpenAIRE graph
Found an issue? Give us feedback
image/svg+xml art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos Open Access logo, converted into svg, designed by PLoS. This version with transparent background. http://commons.wikimedia.org/wiki/File:Open_Access_logo_PLoS_white.svg art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos http://www.plos.org/ ZENODOarrow_drop_down
image/svg+xml art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos Open Access logo, converted into svg, designed by PLoS. This version with transparent background. http://commons.wikimedia.org/wiki/File:Open_Access_logo_PLoS_white.svg art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos http://www.plos.org/
ZENODO
Other ORP type . 2025
License: CC BY
Data sources: ZENODO
ZENODO
Other ORP type . 2025
License: CC BY
Data sources: Datacite
ZENODO
Other ORP type . 2025
License: CC BY
Data sources: Datacite
versions View all 2 versions
addClaim

A Deep Dive into Function Inlining and its Security Implications for ML-based Binary Analysis

Authors: Abusabha, Omar; Uhm, Jiyong; Abuhmed, Tamer; Koo, Hyungjoon;

A Deep Dive into Function Inlining and its Security Implications for ML-based Binary Analysis

Abstract

This artifact accompanies the paper “A Deep Dive into Function Inlining and its Security Implications for ML-based Binary Analysis.”It provides the complete codebase, datasets, and scripts necessary to reproduce the experiments and figures presented in the paper, submitted to NDSS 2026. Contents The artifact consists of three main .tar.gz archives. It is designed to examine the impact of extreme function inlining on machine learning–based security tasks, including binary similarity detection (T1), function name prediction (T2), malware detection (T3), malware family prediction (T4), and vulnerability detection (T5). The archives are organized as follows: AE_NDSS_Code.tar.gz — Source code, analysis scripts, ML models, and utilities for dataset construction, feature extraction, and evaluation.Includes: Dataset Construction i.e. compilation and inlining-sweep scripts Modified TikNib feature extraction pipeline used mainly for T3 and T4 ML evaluation frameworks for all tasks Figure and results reproduction scripts AE_NDSS_Code_Docker.tar.gz (Optional)— A prebuilt Docker image recommended if you only want to run the ML models and reproduce the main figures. It provides: All Python/Conda dependencies Preconfigured environments for T1/T2/T5 Runtime support for Docker-in-Docker (required for T1/T5 models) System Python 3.9 (needed for T3/T4) Scripts for generating the main figures AE_NDSS_Dataset_VI.A.tar.gz — Provides the precompiled binary datasets used across evaluation tasks T1–T5, allowing reviewers to run experiments directly without rebuilding from source. AE_NDSS_Dataset_VI.B.tar.gz — Contains the datasets compiled across varying compiler settings, systematically exploring configurations that approach extreme inlining behavior. START_EVALUATION.md — Provides step-by-step setup, testing, and reproduction instructions for artifact reviewers. Notes on Excluded Data To comply with third-party licensing and redistribution restrictions, the following datasets are not included in this artifact: T4: The dataset originally curated from Alrawi et al. (“BadThings”) is available via their official repositories (Dropbox). T5: Firmware samples from Netgear and TP-Link are publicly referenced in prior work but are not redistributed here. SPEC CPU 2006 binaries: Not shared due to licensing restrictions. Scripts for reproducing related figures are included and runnable without these binaries.

Related Organizations
  • BIP!
    Impact byBIP!
    selected citations
    These citations are derived from selected sources.
    This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    0
    popularity
    This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
    Average
    influence
    This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    Average
    impulse
    This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
    Average
Powered by OpenAIRE graph
Found an issue? Give us feedback
selected citations
These citations are derived from selected sources.
This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Citations provided by BIP!
popularity
This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
BIP!Popularity provided by BIP!
influence
This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Influence provided by BIP!
impulse
This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
BIP!Impulse provided by BIP!
0
Average
Average
Average