Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Bridging the PLC Binary Analysis Gap: A Cross-Compiler Dataset and Neural Framework for Industrial Control Systems

Yonatan Gizachew Achamyeleh, Shih-Yuan Yu, Gustavo Quirós Araya, Mohammad Abdullah Al Faruque

TL;DR

PLC-BEAD, a comprehensive dataset containing 2431 compiled binaries from 700+ PLC programs across four major industrial compilers, and PLCEmbed, a transformer-based framework for binary code analysis that achieves 93\% accuracy in compiler provenance identification and 42\% accuracy in fine-grained functionality classification across 22 industrial control categories.

Abstract

Industrial Control Systems (ICS) rely heavily on Programmable Logic Controllers (PLCs) to manage critical infrastructure, yet analyzing PLC executables remains challenging due to diverse proprietary compilers and limited access to source code. To bridge this gap, we introduce PLC-BEAD, a comprehensive dataset containing 2431 compiled binaries from 700+ PLC programs across four major industrial compilers (CoDeSys, GEB, OpenPLC-V2, OpenPLC-V3). This novel dataset uniquely pairs each binary with its original Structured Text source code and standardized functionality labels, enabling both binary-level and source-level analysis. We demonstrate the dataset's utility through PLCEmbed, a transformer-based framework for binary code analysis that achieves 93\% accuracy in compiler provenance identification and 42\% accuracy in fine-grained functionality classification across 22 industrial control categories. Through comprehensive ablation studies, we analyze how compiler optimization levels, code patterns, and class distributions influence model performance. We provide detailed documentation of the dataset creation process, labeling taxonomy, and benchmark protocols to ensure reproducibility. Both PLC-BEAD and PLCEmbed are released as open-source resources to foster research in PLC security, reverse engineering, and ICS forensics, establishing new baselines for data-driven approaches to industrial cybersecurity.

Bridging the PLC Binary Analysis Gap: A Cross-Compiler Dataset and Neural Framework for Industrial Control Systems

TL;DR

PLC-BEAD, a comprehensive dataset containing 2431 compiled binaries from 700+ PLC programs across four major industrial compilers, and PLCEmbed, a transformer-based framework for binary code analysis that achieves 93\% accuracy in compiler provenance identification and 42\% accuracy in fine-grained functionality classification across 22 industrial control categories.

Abstract

Industrial Control Systems (ICS) rely heavily on Programmable Logic Controllers (PLCs) to manage critical infrastructure, yet analyzing PLC executables remains challenging due to diverse proprietary compilers and limited access to source code. To bridge this gap, we introduce PLC-BEAD, a comprehensive dataset containing 2431 compiled binaries from 700+ PLC programs across four major industrial compilers (CoDeSys, GEB, OpenPLC-V2, OpenPLC-V3). This novel dataset uniquely pairs each binary with its original Structured Text source code and standardized functionality labels, enabling both binary-level and source-level analysis. We demonstrate the dataset's utility through PLCEmbed, a transformer-based framework for binary code analysis that achieves 93\% accuracy in compiler provenance identification and 42\% accuracy in fine-grained functionality classification across 22 industrial control categories. Through comprehensive ablation studies, we analyze how compiler optimization levels, code patterns, and class distributions influence model performance. We provide detailed documentation of the dataset creation process, labeling taxonomy, and benchmark protocols to ensure reproducibility. Both PLC-BEAD and PLCEmbed are released as open-source resources to foster research in PLC security, reverse engineering, and ICS forensics, establishing new baselines for data-driven approaches to industrial cybersecurity.

Paper Structure

This paper contains 47 sections, 2 equations, 4 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Related Works and Background
  3. PLC Binary Analysis Challenges
  4. Machine Learning for Binary Analysis
  5. Need for Standardized PLC Datasets
  6. PLC-BEAD Dataset
  7. Dataset Overview and Design Goals
  8. Why an Integrated Source-Binary Dataset.
  9. Potential Impact.
  10. Dataset Construction
  11. Compilation Procedure.
  12. Compilation Result.
  13. Functionality Labeling
  14. Annotation Procedure.
  15. Dataset Organization
  16. ...and 32 more sections

Figures (4)

  • Figure 1: PLC-BEAD Dataset Construction Pipeline
  • Figure 2: Distribution Of Functional Labels (Top 12 Categories + Others)
  • Figure 3: The overall architecture of PLCEmbed
  • Figure 4: PLC DF process comprises four steps: data collection, examination, analysis, and reporting. To analyze security incidents, the investigator looks at raw evidence and leverages the forensic artifacts for the following stages. PLCEmbed serves as a tool to help investigators extract information from raw evidence, making the process more efficient.