从公开YARA规则中提取特征，提升恶意软件检测能力
Living off the Analyst: Harvesting Features from Yara Rules for Malware Detection
- 从公开YARA规则中提取子签名作为新特征
- 在EMBER 2018数据集上超越传统特征表现
- 发现既特异又通用的双重用途特征
恶意攻击者常采用'就地取材'策略，利用系统中已有的合法工具实施攻击。本文探讨反病毒开发者能否类似地复用现有成果以增强检测能力。通过从公开YARA规则中提取子签名，我们构建了一组能更有效区分恶意与良性样本的特征。实验表明，这些特征在EMBER 2018数据集上优于传统特征。手动分析显示，新增特征呈现幂律分布：既有高度特异、仅对应少数家族的特征，也存在高频出现的通用特征。尽管预期特征会过于特定，但实际效果良好。此外还发现部分子签名具备双重用途（如检测虚拟机环境）或广泛通用性（如DLL导入行为）。
原文摘要 · Abstract (English)
A strategy used by malicious actors is to "live off the land," where benign systems and tools already available on a victim's systems are used and repurposed for the malicious actor's intent. In this work, we ask if there is a way for anti-virus developers to similarly re-purpose existing work to improve their malware detection capability. We show that this is plausible via YARA rules, which use human-written signatures to detect specific malware families, functionalities, or other markers of interest. By extracting sub-signatures from publicly available YARA rules, we assembled a set of features that can more effectively discriminate malicious samples from benign ones. Our experiments demonstrate that these features add value beyond traditional features on the EMBER 2018 dataset. Manual analysis of the added sub-signatures shows a power-law behavior in a combination of features that are specific and unique, as well as features that occur often. A prior expectation may be that the features would be limited in being overly specific to unique malware families. This behavior is observed, and is apparently useful in practice. In addition, we also find sub-signatures that are dual-purpose (e.g., detecting virtual machine environments) or broadly generic (e.g., DLL imports).
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。