Data Structures and Algorithms

    

Using Yara Tags to Build a Heuristic Scanner

Authors: Jason Reaves

YARA is a tool that has been pretty heavily adopted within the Cyber Security community, it was built to aid malware researchers with identifying and classifying malicious objects[1]. Instead of approaching this problem with a purely good or bad mindset in detecting malicious objects, we can utilize added functionality of YARA, namely tags, to approach the problem of judging how malicious or suspicious an object is by looking at the problem in smaller sets. This concept is commonly used in heuristic engines used by antiviruses and sandboxes where you can give a weight of maliciousness to an object. The aim of this paper is to introduce a method for such an engine to be built by an organization utilizing existing software.

Comments: 9 Pages.

Download: PDF

Submission history

[v1] 2020-03-10 16:36:59

Unique-IP document downloads: 678 times

Vixra.org is a pre-print repository rather than a journal. Articles hosted may not yet have been verified by peer-review and should be treated as preliminary. In particular, anything that appears to include financial or legal advice or proposed medical treatments should be treated with due caution. Vixra.org will not be responsible for any consequences of actions that result from any form of use of any documents on this website.

Add your own feedback and questions here:
You are equally welcome to be positive or negative about any paper but please be polite. If you are being critical you must mention at least one specific error, otherwise your comment will be deleted as unhelpful.

comments powered by Disqus