{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/sorel-20m-a-large-scale-benchmark-dataset-for","title":"SOREL-20M: A Large Scale Benchmark Dataset for Malicious PE Detection","arxiv_id":"2012.07634","date":"2020-12-14","proceeding":null,"authors":["Richard Harang","Ethan M. Rudd"],"abstract":"In this paper we describe the SOREL-20M (Sophos/ReversingLabs-20 Million) dataset: a large-scale dataset consisting of nearly 20 million files with pre-extracted features and metadata, high-quality labels derived from multiple sources, information about vendor detections of the malware samples at the time of collection, and additional ``tags'' related to each malware sample to serve as additional targets. In addition to features and metadata, we also provide approximately 10 million ``disarmed'' malware samples -- samples with both the optional\\_headers.subsystem and file\\_header.machine flags set to zero -- that may be used for further exploration of features and detection strategies. We also provide Python code to interact with the data and features, as well as baseline neural network and gradient boosted decision tree models and their results, with full training and evaluation code, to serve as a starting point for further experimentation.","url_abs":"https://arxiv.org/abs/2012.07634v1","url_pdf":"https://arxiv.org/pdf/2012.07634v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"links_only","authors_date_abstract":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license), from the Kaggle arXiv metadata snapshot of 2026-09-12"},"code_links":[{"paper_slug":"sorel-20m-a-large-scale-benchmark-dataset-for","repo_url":"https://github.com/sophos-ai/SOREL-20M","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"unanswered"}},{"paper_slug":"sorel-20m-a-large-scale-benchmark-dataset-for","repo_url":"https://github.com/pralab/toucanstrike","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"unanswered"}},{"paper_slug":"sorel-20m-a-large-scale-benchmark-dataset-for","repo_url":"https://github.com/sophos/sorel-20m","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[],"methods":[],"datasets_introduced":[{"slug":"sorel-20m","name":"SOREL-20M","full_name":"Sophos/ReversingLabs-20 Million"}],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2012.07634","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2012.07634"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/sophos/sorel-20m","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/sophos-ai/SOREL-20M","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/pralab/toucanstrike","reach":{"status":"unanswered"}}],"summary":{"ran_draft_wrong":1,"ran_honours":1,"ran_fixture":2},"by_repo_kind":{"listed":{"samples":4,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"10193da1ef835668","entry":"collect_dataframes","repo":"sophos/sorel-20m","repo_kind":"listed","path":"plot.py","file_url":"https://github.com/sophos/sorel-20m/blob/HEAD/plot.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"10193da1ef835668"}},{"code_sha256_prefix":"9e266df9604ad5a4","entry":"detach_and_copy_array","repo":"sophos/sorel-20m","repo_kind":"listed","path":"evaluate.py","file_url":"https://github.com/sophos/sorel-20m/blob/HEAD/evaluate.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"9e266df9604ad5a4"}},{"code_sha256_prefix":"29e5572fdd11dfde","entry":"get_roc_curve","repo":"sophos/sorel-20m","repo_kind":"listed","path":"plot.py","file_url":"https://github.com/sophos/sorel-20m/blob/HEAD/plot.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"29e5572fdd11dfde"}},{"code_sha256_prefix":"d17b01e37fe1ada2","entry":"get_tprs_at_fpr","repo":"sophos/sorel-20m","repo_kind":"listed","path":"plot.py","file_url":"https://github.com/sophos/sorel-20m/blob/HEAD/plot.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"d17b01e37fe1ada2"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}