Malware Detection and Analysis Using YARA Tool
Bhargavi Jadhav, Malhar Jadhav · International Journal of Advanced Research in Science Communication and Technology · 2024
Malicious software, or malware, is one of the biggest threats to the vast amounts of data and files handled today. One widely used tool for malware detection is YARA(Yet Another Recursive Acronym), which uses YARArules to match suspicious content in files or network packets analyzed by antivirus engines. It works with most hosts running Windows, Linux, or Mac operating systems. However, while YARA is effective, its scanning process can be quite slow, especially with large datasets. This paper explores ways to optimize YARA's scanning process to make it faster and more efficient. We discuss various modes available within YARA to enhance performance, such as fast mode for quicker scanning and recursive mode for in-depth analysis. By fine-tuning these settings, we aim to reduce scan times without compromising detection accuracy.