Embedding Fuzzy Rules with YARA Rules for Performance Optimisation of Malware Analysis

Naik, Nitin, Jenkins, Paul, Savage, Nick, Yang, Longzhi, Naik, Kshirasagar and Song, Jingping (2020) Embedding Fuzzy Rules with YARA Rules for Performance Optimisation of Malware Analysis. In: 2020 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE). IEEE International Conference on Fuzzy Systems . IEEE, Pistcataway, pp. 1-7. ISBN 9781728169330, 9781728169323

[img]
Preview
Text
FUZZ_IEEE_20_Embedded_YARA_Rules.pdf - Accepted Version

Download (827kB) | Preview
Official URL: https://doi.org/10.1109/FUZZ48607.2020.9177856

Abstract

YARA rules utilises string or pattern matching to perform malware analysis and is one of the most effective methods in use today. However, its effectiveness is dependent on the quality and quantity of YARA rules employed in the analysis. This can be managed through the rule optimisation process, although, this may not necessarily guarantee effective utilisation of YARA rules and its generated findings during its execution phase, as the main focus of YARA rules is in determining whether to trigger a rule or not, for a suspect sample after examining its rule condition. YARA rule conditions are Boolean expressions, mostly focused on the binary outcome of the malware analysis, which may limit the optimised use of YARA rules and its findings despite generating significant information during the execution phase. Therefore, this paper proposes embedding fuzzy rules with YARA rules to optimise its performance during the execution phase. Fuzzy rules can manage imprecise and incomplete data and encompass a broad range of conditions, which may not be possible in Boolean logic. This embedding may be more advantageous when the YARA rules become more complex, resulting in multiple complex conditions, which may not be processed efficiently utilising Boolean expressions alone, thus compromising effective decision-making. This proposed embedded approach is applied on a collected malware corpus and is tested against the standard and enhanced YARA rules to demonstrate its success.

Item Type: Book Section
Uncontrolled Keywords: YARA Rules, Fuzzy Rules, Fuzzy Logic, Fuzzy Hashing, Malware Analysis, Performance Optimisation, Ransomware
Subjects: G400 Computer Science
Department: Faculties > Engineering and Environment > Computer and Information Sciences
Depositing User: John Coen
Date Deposited: 05 Nov 2020 14:41
Last Modified: 05 Nov 2020 14:45
URI: http://nrl.northumbria.ac.uk/id/eprint/44693

Actions (login required)

View Item View Item

Downloads

Downloads per month over past year

View more statistics