Post

AV system is hard in part b/c you are constantly searching for new features. But analysts are also writing Yara rules, can you steal them as features? New paper #IEEEBigData looks are how you can live of the analyst w/ @cmat.bsky.social @cknicholas.bsky.social @csee-umbc.bsky.social 🧵

Yara rules are basically fancy regular expressions. We can take all the 'atoms' of the rule, like $av4, and turn them into binary present/absent features for our model to incorporate. Nature of Yara means these are usually pretty fast to find/extract too 📰https://arxiv.org/abs/2411.18516

"But aren't Yara rules very precise, why would they generalize?" Yes, individualy they tend to be very high recall or precision, but not both. Individually though - people use the condition statement to get the final target precision. The atoms themselves are pretty diverse!

Training on only the Yara signatures as features is surprisingly decent as a malware detector! Not amazing, but decent! But the real value here is that they are being created/updated already - and you can add them to your existing feature sets.

We test several ways you can add them based on how much computational cost you want to pay. The idea is basically simple: you have your existing features and concatenate the new features to a representation of the original (could be them, or a logit, or something else).

And voila, you can outperform Ember-only features by adding features selected by mining Yara rules! It is a fairly non-trivial lift, considering how little effort was involved and that you don't need to add that many Yara atoms to get a lift.