Assemblyline — Canada's Machine-Learning Malware Triage Platform Defending Government Networks

The Canadian Centre for Cyber Security, part of the Communications Security Establishment (CSE), operates sensors across Government of Canada networks and open-sourced Assemblyline in 2017, a machine-learning malware-analysis platform used to triage suspicious files at scale for government agencies and critical-infrastructure partners.

Alongside Assemblyline, CSE data scientists built a separate machine-learning malware-classification model specifically aimed at catching custom, nation-state malware that commodity antivirus tools (built for generic threats) do not detect.

Flagged files from the ML classifier are quarantined, and the model is refined once commercial antivirus vendors catch up to the same threats, per CSE's own AI Strategy.

CSE's Annual Report 2023-2024 states Assemblyline scanned over 1 billion suspicious files that year, with 308 partner organisations (58 government, 250 critical infrastructure) — up 35% year-on-year — and sensors covering roughly 900,000 devices across 167 federal institutions and Crown corporations. The Cyber Centre reports blocking an average of 6.6 billion potentially malicious actions per day, up from 6.3 billion in 2022-23. Independent reporting by the ICTC-CTIC policy institute and the Canadian magazine The Walrus corroborates the order of magnitude of blocked activity and sensor deployment, drawing on the same annual reports and an interview with CSE's chief.

CSE has not published a false-positive or accuracy rate specific to the ML classifier, nor a breakdown of how much blocked activity is specifically machine-learning-driven versus signature- or rule-based detection. No independent audit of detection accuracy exists; media corroboration confirms scale, not ML-specific performance claims.