LLMs-Driven Automated YARA Rules Generation with Explainable File Features & DNAHash

Overview: Wang Ge and Liu Yiping from Alibaba Cloud Security introduce an automated YARA rule generation framework designed to produce explainable detection rules with low false-positive rates for emerging malware families. Addressing the limitations of legacy tools like yarGen and AutoYara—which struggle with rule quality, large binary datasets, and semantic interpretability—the researchers integrate large language models (LLMs) to select string features, analyze decompiled pseudo-code, and identify opcode sequences. Their architecture combines natural language processing, decompilation-to-assembly offset mapping, and a novel structural "DNAHash" (field-in-hash) mechanism to handle complex and self-modifying code.

Key Topics: - Multi-modal feature extraction: IOC strings, NLP-filtered natural language strings, decompiled function pseudo-code, and DNAHash - Context-aware function labeling and assembly opcode slicing using fine-tuned LLMs (Qwen-32B) - Multi-stage feature filtering against massive benign corpuses and third-party library signature filtering (IDA APIs, Finger algorithm, CAPA) - Rule generation, 2D/hierarchical clustering, rule compression, and benchmark evaluations against yarGen and AutoYara

Technical Details: The framework divides automated rule generation into four core stages: feature extraction, feature filtering, LLM-driven decision making, and rule generation. During extraction, the pipeline extracts strings (categorized into 17 IOC patterns and NLP-filtered natural language strings with a minimum length of 6 characters), function call graphs (FCGs), and decompiled pseudo-code paired with address offsets. For obfuscated or self-modifying binaries where functions cannot be reliably decompiled, the system generates "DNAHash" features by calculating hash values across structural binary fields. To filter out noise, string features are cross-referenced against a multi-million benign sample repository (comprising 2.3 million benign files), while third-party library functions are excluded using disassembler APIs and a custom signature algorithm called "Finger." Suspicious functions are prioritized using CAPA behavioral matching rules, call frequency from the main entry point, and a custom importance evaluation algorithm.

In the LLM decision phase, the authors employ Qwen-32B (which can also act as a teacher model to distill knowledge into smaller models via Supervised Fine-Tuning [SFT] and Group Relative Policy Optimization [GRPO]). The model receives pseudo-code accompanied by subfunction CAPA labels and global variable references. It labels function behaviors (such as payload decryption, process injection, and file/registry tampering) and identifies precise pseudo-code line ranges suitable for YARA signatures. These line ranges are mapped back to non-contiguous assembly opcodes using the preserved address offsets; the system normalizes instructions by wildcarding operands and stripping prologue/epilogue stack-balancing instructions.

To construct final rules, the system performs two-dimensional clustering across files and features for opcodes and strings, and hierarchical clustering for shared DNAHash segments. A rule compression module applies subset compression and intersection rule merging to combine frequent patterns and reduce rule bloat. In benchmarks evaluating the top 60 active malware families against 2.3 million benign samples and AutoYara’s public dataset, the framework demonstrated superior detection rates and significantly lower false positive rates compared to yarGen (which missed variants due to strict API whitelisting or caused false alarms in simple mode) and AutoYara.

Key Takeaways: Security operations teams can overcome the brittleness of traditional automated YARA generators by augmenting LLMs with structural context (CAPA tags, call graphs, and address offsets) rather than relying on pure token heuristics. Combining semantic function analysis with structural DNA hashing provides defense-in-depth against packed or polymorphic malware. Furthermore, generating human-explainable detection rules that detail specific malware behaviors (e.g., self-decryption or process injection) substantially reduces alert triage time for SOC analysts while maintaining zero false positives against benign baseline repositories.

(AI summary — Gemini Flash)