Embedding fuzzy rules with YARA rules for performance optimisation of malware analysis

Nitin Naik, Paul Jenkins, Nick Savage, Longzhi Yang, Kshirasagar Naik, Jingping Song

Research output: Chapter in Book/Report/Conference proceedingConference contribution

97 Downloads (Pure)

Abstract

YARA rules utilises string or pattern matching to perform malware analysis and is one of the most effective methods in use today. However, its effectiveness is dependent on the quality and quantity of YARA rules employed in the analysis. This can be managed through the rule optimisation process, although, this may not necessarily guarantee effective utilisation of YARA rules and its generated findings during its execution phase, as the main focus of YARA rules is in determining whether to trigger a rule or not, for a suspect sample after examining its rule condition. YARA rule conditions are Boolean expressions, mostly focused on the binary outcome of the malware analysis, which may limit the optimised use of YARA rules and its findings despite generating significant information during the execution phase. Therefore, this paper proposes embedding fuzzy rules with YARA rules to optimise its performance during the execution phase. Fuzzy rules can manage imprecise and incomplete data and encompass a broad range of conditions, which may not be possible in Boolean logic. This embedding may be more advantageous when the YARA rules become more complex, resulting in multiple complex conditions, which may not be processed efficiently utilising Boolean expressions alone, thus compromising effective decision-making. This proposed embedded approach is applied on a collected malware corpus and is tested against the standard and enhanced YARA rules to demonstrate its success.

Original languageEnglish
Title of host publication2020 IEEE International Conference on Fuzzy Systems, FUZZ 2020 - Proceedings
PublisherInstitute of Electrical and Electronics Engineers Inc.
Number of pages7
ISBN (Electronic)978-1-7281-6932-3
ISBN (Print)978-1-7281-6933-0
DOIs
Publication statusPublished - 26 Aug 2020
Event2020 IEEE International Conference on Fuzzy Systems - Glasgow, United Kingdom
Duration: 19 Jul 202024 Jul 2020

Publication series

NameIEEE International Conference on Fuzzy Systems
PublisherIEEE
ISSN (Print)1544-5616
ISSN (Electronic)1558-4739

Conference

Conference2020 IEEE International Conference on Fuzzy Systems
Abbreviated titleFUZZ 2020
Country/TerritoryUnited Kingdom
CityGlasgow
Period19/07/2024/07/20

Keywords

  • Fuzzy Hashing
  • Fuzzy Logic
  • Fuzzy Rules
  • Malware Analysis
  • Performance Optimisation
  • Ransomware
  • YARA Rules

Fingerprint

Dive into the research topics of 'Embedding fuzzy rules with YARA rules for performance optimisation of malware analysis'. Together they form a unique fingerprint.

Cite this