Sophos AI YaraML Rules Repository
#Security Testing#Malware Analysis
A simple framework for extracting actionable data from Android malware
YaraML: A Tool for Automatic Yara Rule Generation
YaraML is a tool that automatically generates Yara rules from training data. It does this by translating scikit-learn logistic regression and random forest binary classifiers into the Yara language.
Simply provide YaraML with a directory containing malware files and another directory with benign files, regardless of their format. The tool will extract substring features, refine your feature space, train a model, and then 'compile' the model into a textual Yara rule.
To understand what this process looks like, refer to the logistic regression Powershell detector generated by YaraML, which is provided below.
