Evaluating automatically generated YARA rules and enhancing their effectiveness

Nitin Naik, Paul Jenkins, Rodger Cooke, Jonathan Gillett, Yaochu Jin

Research output: Chapter in Book/Report/Conference proceedingConference contribution

183 Downloads (Pure)

Abstract

Emerging as a widely accepted technique for malware analysis, YARA rules due to its flexible and customisable nature, allows malware analysts to develop rules according to the requirements of a specific security domain. YARA rules can be automatically generated using tools, however, they may require post-processing for their optimisation, and may not be effective for the specific security domain. This compels the requirement to enhance automatically generated YARA rules and increase their effectiveness for malware analysis without increasing computa- tional overheads. Reflecting on the above requirement, this paper initially evaluates automatically generated YARA rules using three YARA tools: yarGen, yaraGenerator and yabin. These tools are Python-based open-source tools used to generate YARA rules automatically utilising different underlying techniques. Subsequently, it proposes a method to enhance automatically generated YARA rules using a fuzzy hashing method. This proposed enhancement method can improve the effectiveness of YARA rules irrespective of the chosen YARA tool used to generate YARA rules, which is demonstrated through several experiments on samples of collected malware and goodware.
Original languageEnglish
Title of host publication2020 IEEE Symposium Series on Computational Intelligence (SSCI)
PublisherIEEE
Pages1146-1153
Number of pages8
ISBN (Electronic)978-1-7281-2547-3
ISBN (Print)978-1-7281-2548-0
DOIs
Publication statusPublished - 5 Jan 2021
Event2020 IEEE Symposium Series on Computational Intelligence (SSCI) - Canberra, Australia
Duration: 1 Dec 20204 Dec 2020

Conference

Conference2020 IEEE Symposium Series on Computational Intelligence (SSCI)
Abbreviated titleSSCI
CountryAustralia
CityCanberra
Period1/12/204/12/20

Keywords

  • Malware Analysis
  • YARA Rules
  • Fuzzy Hashing
  • yarGen
  • yaraGenerator
  • yabin
  • Ransomware
  • Indicator of Compromise
  • IoC String

Fingerprint

Dive into the research topics of 'Evaluating automatically generated YARA rules and enhancing their effectiveness'. Together they form a unique fingerprint.

Cite this