Generation of Static YARA-Signatures Using Genetic Algorithm
Alexander V. Zhdanov · 2019
This article is dedicated to the subject of malware detection using static YARA-signatures and Genetic Algorithm (GA). It proposes a solution and does a comparative analysis of two algorithms. The first uses n-gram distributions and an algorithm of machine learning known as Maximization-Maximization algorithm based on Multinomial Naive Bayes analysis. The second algorithm offers a solution to the problem via a method of directional generation of YARA-rules based on the GA which relates to the Artificial Intelligence (AI) methods. On the grounds of literature review, it can be seen that such application of the GA is novel in the static signatures generation domain and, in particular, for the YARA-rules generation and is considered to be the main contribution of the article. Also, advantages of the method applying the GA are shown on the basis of experiments conducted for cleanware and malware datasets.