Update README.md
Browse files
README.md
CHANGED
|
@@ -25,8 +25,8 @@ Not actively maintained after publishing
|
|
| 25 |
To use this model, use [inference.py in our repository](https://github.com/NetherlandsForensicInstitute/asmtransformers/blob/main/asmtransformers/README.md#inference).
|
| 26 |
|
| 27 |
# Intended use
|
| 28 |
-
The model
|
| 29 |
-
nor
|
| 30 |
|
| 31 |
# Architecture description
|
| 32 |
|
|
@@ -35,7 +35,7 @@ The model is a Bert-base architecture with 12 layers, 12 attention heads and a h
|
|
| 35 |
The model is trained in two phases - a masked language modeling (MLM) pretraining phase and a fine-tuning phase for function similarity.
|
| 36 |
|
| 37 |
The MLM pre-training phase uses a loss function that includes jump target prediction (see [Wang et al.](https://arxiv.org/pdf/2205.12713)).
|
| 38 |
-
This pretraining
|
| 39 |
|
| 40 |
We perform the finetuning phase using [Batched Semi Hard Triplet Loss](https://sbert.net/docs/package_reference/sentence_transformer/losses.html#batchsemihardtripletloss) on batches of size 1024.
|
| 41 |
The training set for this phase includes triplets that are formed using versions of the same function compiled for different instruction set architectures.
|
|
@@ -115,7 +115,7 @@ cross-compile source packages for multiple ISAs and optimisation levels. We used
|
|
| 115 |
We also added an optimization level that includes vectorization and cryptographic instructions that we refer to as Optimized-custom, or Oc.
|
| 116 |
The binary files from each source package are disassembled using Ghidra and the resulting control-flow graphs (CFGs) are exported.
|
| 117 |
|
| 118 |
-
This results in a maximum of 24 (6 optimisation levels and 4 ISAs)
|
| 119 |
However, because not all source packages can be built for all ISAs and because some optimisation levels result in identical code, the actual number is often lower than that.
|
| 120 |
|
| 121 |
The dataset is split into a train, test and an evaluation set. This in done on source package basis, so all binaries and functions belonging to one source package are part of
|
|
@@ -162,9 +162,9 @@ either the training set or the test set, not both.
|
|
| 162 |
----------------------------
|
| 163 |
|
| 164 |
# Preprocessing
|
| 165 |
-
Several preprocessing steps
|
| 166 |
-
Immediate operands and addresses have been normalized to the nearest power-of-two reduce token explosion caused by raw numeric values.
|
| 167 |
-
Finally, target addresses of jumps, conditional branches or call instructions are normalised to
|
| 168 |
|
| 169 |
# Performance
|
| 170 |
We report two performance metrics: Mean Reciprocal Rank (MRR) and Accuracy@1.
|
|
|
|
| 25 |
To use this model, use [inference.py in our repository](https://github.com/NetherlandsForensicInstitute/asmtransformers/blob/main/asmtransformers/README.md#inference).
|
| 26 |
|
| 27 |
# Intended use
|
| 28 |
+
The model is trained and tested to be used for similarity search of assembly code. It is not trained/tested on any other languages than ARM, AMD64, RISC-V or i386,
|
| 29 |
+
nor is it tested on other downstream tasks.
|
| 30 |
|
| 31 |
# Architecture description
|
| 32 |
|
|
|
|
| 35 |
The model is trained in two phases - a masked language modeling (MLM) pretraining phase and a fine-tuning phase for function similarity.
|
| 36 |
|
| 37 |
The MLM pre-training phase uses a loss function that includes jump target prediction (see [Wang et al.](https://arxiv.org/pdf/2205.12713)).
|
| 38 |
+
This pretraining is perfomed using a masking probability of 0.4 that was determined through ablation experiments. This is in line with the findings of [Wettig et al., 2023](https://aclanthology.org/2023.eacl-main.217.pdf).
|
| 39 |
|
| 40 |
We perform the finetuning phase using [Batched Semi Hard Triplet Loss](https://sbert.net/docs/package_reference/sentence_transformer/losses.html#batchsemihardtripletloss) on batches of size 1024.
|
| 41 |
The training set for this phase includes triplets that are formed using versions of the same function compiled for different instruction set architectures.
|
|
|
|
| 115 |
We also added an optimization level that includes vectorization and cryptographic instructions that we refer to as Optimized-custom, or Oc.
|
| 116 |
The binary files from each source package are disassembled using Ghidra and the resulting control-flow graphs (CFGs) are exported.
|
| 117 |
|
| 118 |
+
This results in a maximum of 24 (6 optimisation levels and 4 ISAs) potential CFGs which are semantically identical, i.e. they represent the same functionality.
|
| 119 |
However, because not all source packages can be built for all ISAs and because some optimisation levels result in identical code, the actual number is often lower than that.
|
| 120 |
|
| 121 |
The dataset is split into a train, test and an evaluation set. This in done on source package basis, so all binaries and functions belonging to one source package are part of
|
|
|
|
| 162 |
----------------------------
|
| 163 |
|
| 164 |
# Preprocessing
|
| 165 |
+
Several preprocessing steps were taken. The CFGs are processed into a flat token list using ISA aware tokenizers.
|
| 166 |
+
Immediate operands and addresses have been normalized to the nearest power-of-two to reduce token explosion caused by raw numeric values.
|
| 167 |
+
Finally, target addresses of jumps, conditional branches or call instructions are normalised to function-relative `JUMP_ADDR_*` tokens.
|
| 168 |
|
| 169 |
# Performance
|
| 170 |
We report two performance metrics: Mean Reciprocal Rank (MRR) and Accuracy@1.
|