YARA-Signator: Automated Generation of Code-based YARA Rules

2020/08/31 by Bilstein, Felix, Plohmann, Daniel

paper · doi:10.18464/cybin.v5i1.24

Abstract

Effective detection and identification signatures are an important component in the toolkit for malware analysis. The creation of such signatures is still widely a manual task that requires notable experience and knowledge on the side of analysts. In this paper, we present YARA-Signator, an approach for the automated generation of code-based YARA rules. The method is based on the isolation of instruction n-grams that on the one hand appear frequently within a malware family and on the other hand are not found in any other family. Applying YARA-Signator to the Malpedia data set, we show that in fact on average 51.85% of the instruction n-grams of length 4 and higher are only found in the respective family. The rules produced by the system using this data set achieve an overall F1 score of 0.983 and cause only very few false positives in a sanity check against a large goodware data set. YARASignator is made available as open source and a periodically updated reference rule set is provided for free through Malpedia.

Related

• Assessing the Effectiveness of YARA Rules for Signature-Based Malware Detection and Classification
• Living off the Analyst: Harvesting Features from Yara Rules for Malware Detection
• Yara: Down the Rabbit Hole Without Slowing Down
• Yara Studies: A Deep Dive into Scanning Performance
• Adaptive Detection of Polymorphic Malware: Leveraging Mutation Engines and YARA Rules for Enhanced Security