Yara rule enhancement using Bert-based strings language model
Lianqiu Xu, Meng Qiao · 2022 5th International Conference on Advanced Electronic Materials, Computers and Software Engineering (AEMCSE) · 2022
In recent years, with the development and popularity of information technology, how to protect information systems from malicious code is now a hot issue. Malicious code will cause irreversible damage through a series of malicious behaviors for information theft or system damage, so it needs to be detected before it has a bad impact. Yara is a common tool used by network security practitioners or analysts to effectively detect malicious code. However, Yara rules are generally written manually, and their quality is related to the level of analysts, which makes it difficult to guarantee the effectiveness of Yara detection. Some of the current work can automatically generate Yara rules, but most of the methods are blacklist matching in nature, which may cause a degradation of the detection effect when the database is small. To solve the above problems, this paper proposes the Bert-based strings language model (beslm), which can effectively learn the semantic information of Yara rules and the association relationship between strings through pre-training phase and finetuning phase, and can filter out high-quality strings and thus improve the detection effect. The experimental results demonstrate that the Yara rules automatically generated by beslm improve 13.3%, 13.8%, and 15.1% on average in three detection metrics compared with the comparison method.