Skip to content

Augmented YARA rules fused with fuzzy hashing in ransomware triaging

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Triaging is an initial stage of malware analysis to assess whether a sample is malware or not and the degree of similarity it holds with known malware. It can be applied to any malware category such as ransomware, which is a type of malware that blocks access to a system or data, usually by encrypting it. It has become the main modus operandi for cybercriminals to extort monies from victims due to the growth of cryptocurrencies. Consequently, it severely affects all types of users whether they be from corporates or ordinary home users. Ransomware can be prevented in several different ways, however, the simple and initial step in prevention is its triaging without execution. Several triaging methods are in use such as fuzzy hashing, import hashing and YARA rules, amongst all, YARA rules are one of the most popular and widely used methods. Nonetheless, its success or failure is dependent on the quality of rules employed for malware triaging. This paper performs ransomware triaging using fuzzy hashing, import hashing and YARA rules and demonstrates how YARA rules can be improved using fuzzy hashing to obtain relatively better triaging results. Subsequently, it proposes the augmented YARA rules fused with fuzzy hashing to obtain improved triaging results and performance efficiency in comparison to all three triaging methods individually. Finally, the paper demonstrates how the use of the fused YARA rules can improve triaging results irrespective of the type of malware.
Original languageEnglish
Title of host publication2019 IEEE Symposium Series on Computational Intelligence (SSCI)
PublisherInstitute of Electrical and Electronics Engineers
Number of pages8
ISBN (Electronic)978-1-7281-2485-8
ISBN (Print)978-1-7281-2486-5
Publication statusPublished - 20 Feb 2020
Event2019 IEEE Symposium Series on Computational Intelligence (SSCI) - Xiamen, China
Duration: 6 Dec 20199 Dec 2019


Conference2019 IEEE Symposium Series on Computational Intelligence (SSCI)
Internet address


  • CameraReadyPaper-708

    Rights statement: © 2020 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

    Accepted author manuscript (Post-print), 605 KB, PDF document

Related information

Relations Get citation (various referencing formats)

ID: 19882788