Metrika za ocjenu kvalitete pravila i uzoraka za detekciju zloćudnih programskih objekata

master's thesis

• Title (english): Metrics for quality evaluation of rules and patterns for malicious object detection
• Author: Borna Zeba
• Mentor: Josip Knezović (mentor)
• Committee member: Josip Knezović (predsjednik povjerenstva)
• Committee member: Hrvoje Mlinarić (član povjerenstva)
• Committee member: Daniel Hofman (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2021-07-15, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Detekcija temeljena na uzorcima i pravilima čini temelj obrane od zloćudnih programskih objekata. Iako je većina takvih rješenja zatvorenog kôda, alat za istraživanje zloćudnog softvera YARA pokazao se dominantnom tehnologijom u svijetu otvorenog kôda. YARA pravila često su korištena, a nerijetko su loše kvalitete i uzrokuju lažno pozitivne detekcije. U ovom radu predložen je algoritam za ocjenu kvalitete pravila te je ispitana njegova učinkovitost na velikoj količini javno dostupnih pravila. Predložena su buduća poboljšanja algoritma i uočene njegove mane.

Abstract (english)

Rule-based detection is one of the cornerstones of malware prevention. Although most such solutions are proprietary, malware research tool YARA proved prevalent in the open-source space. YARA rules are widely used and shared, however low-quality rules producing false detections are often encountered. This thesis presents a rule grading algorithm producing quality evaluation metrics that rate rules and patterns in regard to potential false positive detections. The algorithm is evaluated on a large corpus of publicly available rules and its shortcomings and future improvements are discussed.

• Keywords: zloćudan softver; YARA; pravilo; uzorak
• Keywords (english): malware; YARA; rule; pattern
• Language: english
• URN:NBN: urn:nbn:hr:168:143634
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-01-13 10:54:28