AI
Why Automated YARA Rule Generation Falls Short
Malware volume is growing. Manual YARA rule writing can’t keep pace, so automated methods have emerged, but they come with problems. Tools like YaraGen focus on string-based features. AutoYara targets byte sequences. Both use machine learning or deep learning to extract static features, yet both still struggle with false positive rates and features that analysts can’t interpret.
LMD YARA addresses three specific gaps: rule quality, feature interpretability, and how to connect LLM reasoning to the actual assembly code that YARA rules require.
Three Feature Types and How They Are Extracted
LMD YARA pulls three feature types from each binary. String features cover 17 IOC-related patterns plus natural language strings (minimum 6 characters). Function features include decompiled code with address offsets and line numbers so the LLM’s output can map back to assembly sequences. DNAHash computes hash values across structural binary fields for cases where self-modifying code makes strings and functions useless.
A benign-sample filter database removes strings that appear too frequently in clean binaries and strips library functions identified by a signature algorithm called Finger.
Fine-Tuning an LLM to Select and Filter Features
Off-the-shelf LLMs fail at this task.
“our test shows the large model are not good at such specific task” — Xiaochen Wang
To fix that, the team fine-tuned using SFT to teach the model the output format, then applied GRPO to sharpen feature selection. Training data came from YARA rules accumulated over years, paired with benign strings from a clean-file corpus. The fine-tuned model selects top string features for rule generation, identifies function behavior, and extracts op code sequences. Two failure modes, unexpected features and invalid output format, are explicitly handled in post-processing.
LLM-Driven Function Behavior Analysis
Functions across a malware family are clustered by SSDeep hash. Cluster centers go to Qwen3-32B, which analyzes pseudo code and context (CAPA labels, global variables), assigns a behavior label, and selects line ranges suitable for op code features. Those pseudo code lines map back to assembly and convert to a YARA byte signature, with wildcards applied for compiler variation.
In the backdoor family rule example (14:26), the model chose lines 19-25 of an XOR decryption function. Human experts had independently selected line 20 of the same function as the key feature in their handwritten rule.
Benchmark Results Against YaraGen and AutoYara
On a public malware dataset from three sources (post-2025), LMD YARA outperforms YaraGen and AutoYara across the top 60 families by sample count on both training and test sets. Against 2.3 million benign samples, it produces significantly fewer false positives. YaraGen’s “simple rule” mode achieves a high detection rate but generates far more false positives.
On one active malware family where common strings were all API names, YaraGen’s string whitelist forced it to rely on rare strings, missing most samples. LMD YARA added an XOR decryption function feature and hit 100% detection with zero false positives.
Notable Quotes
our test shows the large model are not good at such specific task Xiaochen Wang · ▶ 11:03
This model suggest line line 19 to 25 is Liu Eping · ▶ 14:37
that using interpretable function level features can help reduce force alarms, Liu Eping · ▶ 22:07
Key Takeaways
- LMD YARA cuts false positives by pairing a benign-sample filter database with an LLM that understands function-level behavior.
- Fine-tuning with SFT and GRPO is required because off-the-shelf LLMs fail at structured feature selection for YARA.
- DNAHash adds a binary-field hash layer that improves detection on obfuscated samples where string and function features are absent.