Looking for the perfect signature: an automatic YARA rules generation algorithm in the AI-era

Given the high pace at which new malware variants are generated, antivirus software struggle to keep their signature database up-to-date, and AV scanners suffer from a considerable quantity of false negatives. Creating a high-quality signature able to be effective against new malware variants, while avoiding false positives detection, is a challenging task, and it requires a substantial portion of human expert’s time. Artificial intelligence techniques can be applied to solve the malware signature generation problem.The ultimate goal is to develop an algorithm able to automatically create a generalized family signature, eventually reducing threat exposure and increasing the quality of the detection. The proposed technique automatically generates an optimal signature to identify a malware family with very high precision and good recall using heuristics, evolutionary and linear programming algorithms.In this talk I will present YaYaGen (Yet Another YARA Rule Generator), a tool to automatically generate Android malware signatures. Performances have been evaluated on a massive dataset of millions of applications available in the Koodous project, showing promising results: in few minutes the algorithm is able to generate precise ruleset able to catch 0-day malware, better than human generated rules.

Presented by