论文标题
使用双缩影自动生成Yara规则
Automatic Yara Rule Generation Using Biclustering
论文作者
论文摘要
Yara规则是网络安全从业者和分析师中无处不在的工具。制定高质量的Yara规则来检测有趣的劳动软件家族，即使对于专家用户来说，也可能是劳动力和时间密集型的。几乎没有工具，并且在如何自动化特定家庭的Yara规则时所做的工作相对较少。在本文中，我们利用大型N-Grams（$ n \ geq 8 $）与新的双层算法相比，比当前可用的软件更有效地构建简单的Yara规则。我们的方法Autoyara很快，可以在部署到远程网络的团队中部署低资源设备。我们的结果表明，Autoyara可以通过以有用的真实阳性速率生产规则来帮助减少分析师的工作量，同时保持低阳性率，有时匹配甚至超过人类分析师。此外，恶意软件分析师的现实测试表明，Autoyara可以将构造Yara规则的分析师时间减少44-86％，从而使他们可以花时间在当前工具无法处理的更高级的恶意软件上。代码将在https://github.com/neuromorphiccomputationResearchProgram上提供。
Yara rules are a ubiquitous tool among cybersecurity practitioners and analysts. Developing high-quality Yara rules to detect a malware family of interest can be labor- and time-intensive, even for expert users. Few tools exist and relatively little work has been done on how to automate the generation of Yara rules for specific families. In this paper, we leverage large n-grams ($n \geq 8$) combined with a new biclustering algorithm to construct simple Yara rules more effectively than currently available software. Our method, AutoYara, is fast, allowing for deployment on low-resource equipment for teams that deploy to remote networks. Our results demonstrate that AutoYara can help reduce analyst workload by producing rules with useful true-positive rates while maintaining low false-positive rates, sometimes matching or even outperforming human analysts. In addition, real-world testing by malware analysts indicates AutoYara could reduce analyst time spent constructing Yara rules by 44-86%, allowing them to spend their time on the more advanced malware that current tools can't handle. Code will be made available at https://github.com/NeuromorphicComputationResearchProgram .
