Given the high pace at which new malware variants are generated, antivirus programs struggle to keep their signatures up-to-date, and AV scanners suffer from a considerable quantity of false negatives. The generation of effective signatures against new malware variants, while avoiding false positive detections, is a highly desirable but challenging task, typically requiring a substantial portion of human expert’s time. Artificial intelligence techniques can be applied to solve the malware signature generation problem. The ultimate goal is to develop an algorithm able to automatically create a generalized family signature, eventually reducing threat exposure and increasing the quality of the detection. The proposed technique automatically generates an optimal signature to identify a malware family with very high precision and good recall using heuristics, evolutionary and linear programming algorithms. In this talk I will present YaYaGen (Yet Another YARA Rule Generator), a tool to automatically generate Android malware signatures. Performances have been evaluated on a massive dataset of millions of applications available in the Koodous project, showing that in a few minutes the algorithm can generate precise ruleset able to catch 0-day malware, better than human generated ones. Speakers: Andrea Marcelli PhD Student @ Politecnico di Torino Security Researcher @ Hispasec Sistemas

1. Andrea Marcelli (@_S0nn1_)

2. Twitter
Email
Web
PhD Student
Security Researcher

3. The signature generation problem
The algorithm
Introducing YaYaGen
Demo

5. A unique pattern
Syntactic signatures
* this is where the most of the existing tools and researches focus on
Semantic signatures
Android malware

6. Reduce Automate 100% recall Save

7. “YARA is to files what Snort is to network traffic”
de-facto standard
syntactic signatures
Semantic signatures

8. rule YaYaSyringe {
meta:
author = "DEF CON 26"
strings:
$a = “text here”
$b = { E2 34 A1 C8 23 FB }
condition:
$a and $b
and androguard.filter("action.BATTERYCHECK")
and androguard.number_of_services == 3
…
}

10. APK Unsupervised Automatic

11. Each block is an attribute extracted through the analysis
quality of the analysis
static
dynamic
url: “malware.xxx”
permission:
“ACCESS_FINE_LOCATION”

12. Sample 1 Sample 2
=
Signature

13. Sample 1 Sample 2 Sample 3 Sample 4 Sample 5 Sample 6
Sample 7 Sample 8 Sample 9 Sample 10 Sample 11 Sample 12

14. dynamic greedy algorithm
+ + + +

15. clause literal

16. DNF
clause weighed
is the lowest

17. weighting system
higher the weight, the less FP
lower the weight, the more FP

18. TMIN TMAX

19. over-specific
Basic optimizer
Evo optimizer
TMAX
Raw Optimized

21. From
application analysis reports
YARA rules
to

22. 2 algorithms 2 optimizers heuristics
YARA rule parser
FP exclusion
Koodous

26. Rule Name Original YaYaGen Improvement
1,004 +86.3%
315 +43.2%
257 +89.0%
652 +16.6%
172 +8.2%
430 +131.2%

27. perform better 100 apps is
less 5 minutes