Automatic Yara Rule Generation Using Biclustering
Authors:
Open Access
- 9 November 2020
- conference paper
- Published by Association for Computing Machinery (ACM)
- p. 71-82
Abstract
Yara rules are a ubiquitous tool among cybersecurity practitioners and analysts. Developing high-quality Yara rules to detect a malware family of interest can be labor- and time-intensive, even for expert users. Few tools exist and relatively little work has been done on how to automate the generation of Yara rules for specific families. In this paper, we leverage large n-grams (n ≥ 8) combined with a new biclustering algorithm to construct simple Yara rules more effectively than currently available software. Our method, AutoYara, is fast, allowing for deployment on low-resource equipment for teams that deploy to remote networks. Our results demonstrate that AutoYara can help reduce analyst workload by producing rules with useful true-positive rates while maintaining low false-positive rates, sometimes matching or even outperforming human analysts.In addition, real-world testing by malware analysts indicates AutoYara could reduce analyst time spent constructing Yara rules by 44-86%, allowing them to spend their time on the more advanced malware that current tools can't handle. Code will be made available at https://github.com/NeuromorphicComputationResearchProgram.Keywords
All Related Versions
This publication has 14 references indexed in Scilit:
- Would a File by Any Other Name Seem as Malicious?2019
- Empirical assessment of machine learning-based malware detectors for AndroidEmpirical Software Engineering, 2014
- Automatic Generation of String Signatures for Malware Detection2009
- Identifying almost identical files using context triggered piecewise hashingDigital Investigation, 2006
- Paragraph: Thwarting Signature Learning by Training Maliciously2006
- Misleading worm signature generators using deliberate noise injection2006
- Polygraph: Automatically Generating Signatures for Polymorphic Worms2005
- Spectral Biclustering of Microarray Data: Coclustering Genes and ConditionsGenome Research, 2003
- Co-clustering documents and words using bipartite spectral graph partitioning2001
- Direct Clustering of a Data MatrixJournal of the American Statistical Association, 1972