Embedding Fuzzy Rules with YARA Rules for Performance Optimisation of Malware Analysis

Nitin Naik, Paul Jenkins, Nick Savage, Longzhi Yang, Kshirasagar Naik, Jingping Song

Research output: Chapter in Book/Published conference outputConference publication


YARA rules utilises string or pattern matching to perform malware analysis and is one of the most effective methods in use today. However, its effectiveness is dependent on the quality and quantity of YARA rules employed in the analysis. This can be managed through the rule optimisation process, although, this may not necessarily guarantee effective utilisation of YARA rules and its generated findings during its execution phase, as the main focus of YARA rules is in determining whether to trigger a rule or not, for a suspect sample after examining its rule condition. YARA rule conditions are Boolean expressions, mostly focused on the binary outcome of the malware analysis, which may limit the optimised use of YARA rules and its findings despite generating significant information during the execution phase. Therefore, this paper proposes embedding fuzzy rules with YARA rules to optimise its performance during the execution phase. Fuzzy rules can manage imprecise and incomplete data and encompass a broad range of conditions, which may not be possible in Boolean logic. This embedding may be more advantageous when the YARA rules become more complex, resulting in multiple complex conditions, which may not be processed efficiently utilising Boolean expressions alone, thus compromising effective decision-making. This proposed embedded approach is applied on a collected malware corpus and is tested against the standard and enhanced YARA rules to demonstrate its success.

Original languageEnglish
Title of host publication2020 IEEE International Conference on Fuzzy Systems, FUZZ 2020 - Proceedings
ISBN (Electronic)9781728169323
Publication statusPublished - 26 Aug 2020
Event2020 IEEE International Conference on Fuzzy Systems, FUZZ 2020 - Glasgow, United Kingdom
Duration: 19 Jul 202024 Jul 2020

Publication series

NameIEEE International Conference on Fuzzy Systems
ISSN (Print)1098-7584


Conference2020 IEEE International Conference on Fuzzy Systems, FUZZ 2020
Country/TerritoryUnited Kingdom

Bibliographical note

© 2020 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.


  • Fuzzy Hashing
  • Fuzzy Logic
  • Fuzzy Rules
  • Malware Analysis
  • Performance Optimisation
  • Ransomware
  • YARA Rules


Dive into the research topics of 'Embedding Fuzzy Rules with YARA Rules for Performance Optimisation of Malware Analysis'. Together they form a unique fingerprint.

Cite this