Hash-Grams On Many-Cores and Skewed Distributions

Raff, Edward; McLean, Mark

doi:10.1109/bigdata.2018.8622043

Cited by 3 publications

(1 citation statement)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For computational efficiency, our AutoYara system leverages the recently proposed work in "KiloGrams" that demonstrates how to find the top-k most frequent n-grams in a computationally efficient manner with fixed memory cost [20,21,23]. Their work argued that these large byte grams can be used as Yara rules.…”

Section: Related Workmentioning

confidence: 99%

Automatic Yara Rule Generation Using Biclustering

Raff

Zak

Munoz

et al. 2020

Proceedings of the 13th ACM Workshop on Artificial Intelligence and Security

Self Cite

View full text Add to dashboard Cite

Yara rules are a ubiquitous tool among cybersecurity practitioners and analysts. Developing high-quality Yara rules to detect a malware family of interest can be labor-and time-intensive, even for expert users. Few tools exist and relatively little work has been done on how to automate the generation of Yara rules for specific families. In this paper, we leverage large n-grams (n ≥ 8) combined with a new biclustering algorithm to construct simple Yara rules more effectively than currently available software. Our method, Au-toYara, is fast, allowing for deployment on low-resource equipment for teams that deploy to remote networks. Our results demonstrate that AutoYara can help reduce analyst workload by producing rules with useful true-positive rates while maintaining low false-positive rates, sometimes matching or even outperforming human analysts. In addition, real-world testing by malware analysts indicates Auto-Yara could reduce analyst time spent constructing Yara rules by 44-86%, allowing them to spend their time on the more advanced malware that current tools can't handle. Code will be made available at https://github.com/NeuromorphicComputationResearchProgram. CCS CONCEPTS • Security and privacy → Malware and its mitigation; • Computing methodologies → Rule learning; Motif discovery;

show abstract

Section: Related Workmentioning

confidence: 99%