diff --git a/README.md b/README.md index 7df3385..35526e4 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ Automatically discover malware families and generate high-quality, tightly scoped YARA rules using probabilistic clustering and Bloom-filtered n-gram analysis. -[**Documentation**](https://botacin-s-lab.github.io/AutoPYaraPyPI/) · [PyPI](https://pypi.org/project/autopyara/) · [Report a Bug](https://github.com/Botacin-s-Lab/AutoPYaraPyPI/issues) · [Changelog](CHANGELOG.md) · [Releasing](RELEASING.md) +[**Documentation**](https://botacin-s-lab.github.io/AutoPYaraPyPI/) · [Paper](docs/paper/AutoPYara_ACSAC2026.pdf) · [PyPI](https://pypi.org/project/autopyara/) · [Report a Bug](https://github.com/Botacin-s-Lab/AutoPYaraPyPI/issues) · [Changelog](CHANGELOG.md) · [Releasing](RELEASING.md) @@ -207,7 +207,7 @@ tool.train( ## 📖 Documentation -Full documentation lives at **[botacin-s-lab.github.io/AutoPYaraPyPI](https://botacin-s-lab.github.io/AutoPYaraPyPI/)**. It's intentionally basic for now — installation, quick start, and the API reference — with more material (including the accompanying paper, once published) landing there over time. +Full documentation lives at **[botacin-s-lab.github.io/AutoPYaraPyPI](https://botacin-s-lab.github.io/AutoPYaraPyPI/)** — installation, quick start, the API reference, and the [ACSAC 2026 paper page](https://botacin-s-lab.github.io/AutoPYaraPyPI/paper/). ## 🧪 Development @@ -226,22 +226,33 @@ We're accepting contributions — if you run into an issue or have a fix, fork t ## 📄 Citation -If you use AutoPYara in academic work, please cite: +**AutoPYara has been accepted at ACSAC 2026.** [Read the paper (PDF)](docs/paper/AutoPYara_ACSAC2026.pdf). If you use AutoPYara in academic work, please cite: > Mabon Ninan\*, Nhat Minh Nguyen\*, Soumyajyoti Dutta, Sidharth Anil, and Marcus Botacin. -> **"AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering."** *Annual Computer Security Applications Conference (ACSAC 2026)*, to appear. +> **"AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering."** *Annual Computer Security Applications Conference (ACSAC)*, 2026. > \*Equal contribution. Texas A&M University — {ninanmm, nmnguy29, soumyajyoti1998, sid.anil, botacin}@tamu.edu ```bibtex @inproceedings{autopyara2026, title = {AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering}, author = {Ninan, Mabon and Nguyen, Nhat Minh and Dutta, Soumyajyoti and Anil, Sidharth and Botacin, Marcus}, - booktitle = {Proceedings of the Annual Computer Security Applications Conference (ACSAC)}, - year = {2026}, - note = {To appear} + booktitle = {Annual Computer Security Applications Conference (ACSAC)}, + year = {2026} } ``` +### Artifacts and resources + +| Resource | Link | +|---|---| +| ACSAC permanent artifact (Zenodo) | https://zenodo.org/records/23107801 | +| ACSAC artifact source (GitHub) | https://github.com/Botacin-s-Lab/AutoPYara/ | +| API documentation (GitHub Pages) | https://botacin-s-lab.github.io/AutoPYaraPyPI/ | +| PyPI source repository (GitHub) | https://github.com/Botacin-s-Lab/AutoPYaraPyPI | +| Java backend engine (GitHub) | https://github.com/Botacin-s-Lab/AutoPYaraBackend | +| YARA rules & benchmark data (Zenodo) | https://zenodo.org/records/22665898 | +| Python package, `pip install autopyara` (PyPI) | https://pypi.org/project/autopyara/ | + The `AutoYara` preset builds on the original [AutoYara](https://github.com/FutureComputing4AI/AutoYara) project (Apache 2.0); if you use it, please also cite: > Edward Raff, Richard Zak, Gary Lopez Munoz, William Fleming, Hyrum S. Anderson, Bobby Filar, Charles Nicholas, and James Holt. diff --git a/docs/architecture.md b/docs/architecture.md index 23fdc1e..1e00e64 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -194,4 +194,4 @@ This project was also the subject of a related thesis: > Nhat Minh Nguyen. **"AutoPYara: A Python/Java Framework for Automatic YARA Rule Generation Using Semi-Supervised Clustering."** M.S. Thesis, Texas A&M University, Spring 2025. -See the [homepage's Citation section](index.md#citation) for how to cite the AutoPYara paper itself. +See the [Paper & Resources](paper.md) page for the ACSAC 2026 paper and how to cite it. diff --git a/docs/index.md b/docs/index.md index 5862ea7..4fbdb8e 100644 --- a/docs/index.md +++ b/docs/index.md @@ -28,8 +28,8 @@ AutoPYara is a Python framework for automated YARA rule generation from collecti The result: cluster-aware, precision-engineered YARA signatures with minimal manual effort. -!!! info "This site is a work in progress" - This documentation is intentionally basic for now — installation, a quick start, and the full API reference. More material (including the accompanying paper, once published) will land here over time. +!!! success "Accepted at ACSAC 2026" + The AutoPYara paper will appear at the *Annual Computer Security Applications Conference (ACSAC), 2026*. [Read the paper →](paper.md) AutoPYara is [live on PyPI](https://pypi.org/project/autopyara/) — `pip install autopyara` to get started. @@ -81,32 +81,37 @@ Train your own Bloom filters on proprietary datasets. - [Quick Start](quickstart.md) — generate your first YARA rule. - [API Reference](api.md) — presets, advanced usage, and the full `generate()` parameter table. - [Architecture](architecture.md) — how the Python frontend and the separate Java backend fit together. +- [Paper & Resources](paper.md) — the ACSAC 2026 paper (PDF), abstract, citation, and artifacts. - [Development & Releasing](development.md) — running the tests and how releases are published. ## Project links | | | |---|---| -| :fontawesome-brands-python: **PyPI** | [pypi.org/project/autopyara](https://pypi.org/project/autopyara/) | -| :fontawesome-brands-github: **Python frontend** | [Botacin-s-Lab/AutoPYaraPyPI](https://github.com/Botacin-s-Lab/AutoPYaraPyPI) | -| :fontawesome-brands-java: **Java backend** | [Botacin-s-Lab/AutoPYaraBackend](https://github.com/Botacin-s-Lab/AutoPYaraBackend) — separate repository, builds the embedded `AutoYara.jar` | +| :material-archive: **ACSAC permanent artifact** | [Zenodo — zenodo.org/records/23107801](https://zenodo.org/records/23107801) | +| :fontawesome-brands-github: **ACSAC artifact source** | [GitHub — Botacin-s-Lab/AutoPYara](https://github.com/Botacin-s-Lab/AutoPYara/) | +| :material-book-open-variant: **API documentation** | [GitHub Pages — botacin-s-lab.github.io/AutoPYaraPyPI](https://botacin-s-lab.github.io/AutoPYaraPyPI/) | +| :fontawesome-brands-github: **PyPI source repository** | [GitHub — Botacin-s-Lab/AutoPYaraPyPI](https://github.com/Botacin-s-Lab/AutoPYaraPyPI) | +| :fontawesome-brands-java: **Java backend engine** | [GitHub — Botacin-s-Lab/AutoPYaraBackend](https://github.com/Botacin-s-Lab/AutoPYaraBackend) | +| :material-database: **YARA rules & benchmark data** | [Zenodo — zenodo.org/records/22665898](https://zenodo.org/records/22665898) | +| :fontawesome-brands-python: **Python package** (`pip install autopyara`) | [PyPI — pypi.org/project/autopyara](https://pypi.org/project/autopyara/) | +| :material-file-pdf-box: **Paper (PDF)** | [AutoPYara_ACSAC2026.pdf](paper/AutoPYara_ACSAC2026.pdf) | | :material-bug: **Issues** | [Report a bug](https://github.com/Botacin-s-Lab/AutoPYaraPyPI/issues) | ## Citation -If you use AutoPYara in academic work, please cite: +If you use AutoPYara in academic work, please cite the ACSAC 2026 paper ([PDF](paper/AutoPYara_ACSAC2026.pdf)). Recommended citation: > Mabon Ninan\*, Nhat Minh Nguyen\*, Soumyajyoti Dutta, Sidharth Anil, and Marcus Botacin. -> **"AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering."** *Annual Computer Security Applications Conference (ACSAC 2026)*, to appear. +> **"AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering."** *Annual Computer Security Applications Conference (ACSAC)*, 2026. > \*Equal contribution. Texas A&M University — {ninanmm, nmnguy29, soumyajyoti1998, sid.anil, botacin}@tamu.edu ```bibtex @inproceedings{autopyara2026, title = {AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering}, author = {Ninan, Mabon and Nguyen, Nhat Minh and Dutta, Soumyajyoti and Anil, Sidharth and Botacin, Marcus}, - booktitle = {Proceedings of the Annual Computer Security Applications Conference (ACSAC)}, - year = {2026}, - note = {To appear} + booktitle = {Annual Computer Security Applications Conference (ACSAC)}, + year = {2026} } ``` diff --git a/docs/paper.md b/docs/paper.md new file mode 100644 index 0000000..479cdf1 --- /dev/null +++ b/docs/paper.md @@ -0,0 +1,44 @@ +--- +title: Paper & Resources — AutoPYara +--- + +# Paper & Resources + +!!! success "Accepted at ACSAC 2026" + **AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering** will appear at the *Annual Computer Security Applications Conference (ACSAC), 2026*. + +[Download the paper (PDF) :material-file-pdf-box:](paper/AutoPYara_ACSAC2026.pdf){ .md-button .md-button--primary } +[ACSAC artifact (Zenodo) :material-archive:](https://zenodo.org/records/23107801){ .md-button } + +Mabon Ninan\*, Nhat Minh Nguyen\*, Soumyajyoti Dutta, Sidharth Anil, and Marcus Botacin — Texas A&M University. \*Equal contribution. + +## Abstract + +Millions of malware variants threaten users daily, such that clustering these samples is key for fast incident response. AutoYara is the current state-of-the-art for automatic YARA rule generation, but the task remains challenging on realistic datasets, where intra-family diversity and noisy clustering can degrade rule quality. We present AutoPYara, a solution armored with: (1) precise cluster centroid selection based on similarity hashing, and (2) an improved heuristic for estimating subclusters within a malware family using historical VirusTotal data. We implement AutoPYara as an open-source Python package, `pip install autopyara`, to support reproducibility and practical use. We show that AutoPYara, (1) increases rule coverage by 14 percentage points; (2) reduces variance by 7.1 percentage points, comparing the average variance AutoPYara exhibits to that of AutoYara; and (3) improves threat-hunting accuracy by 10%. AutoPYara produces robust and effective YARA rules than prior automatic approaches in practical settings. + +## Citation + +Recommended citation: + +> M. Ninan, N. M. Nguyen, S. Dutta, S. Anil, and M. Botacin, "AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering," *Annual Computer Security Applications Conference (ACSAC)*, 2026. + +```bibtex +@inproceedings{autopyara2026, + title = {AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering}, + author = {Ninan, Mabon and Nguyen, Nhat Minh and Dutta, Soumyajyoti and Anil, Sidharth and Botacin, Marcus}, + booktitle = {Annual Computer Security Applications Conference (ACSAC)}, + year = {2026} +} +``` + +## Artifacts and resources + +| Resource | Host | Link | +|---|---|---| +| :material-archive: **ACSAC permanent artifact** | Zenodo | [zenodo.org/records/23107801](https://zenodo.org/records/23107801) | +| :fontawesome-brands-github: **ACSAC artifact source** | GitHub | [Botacin-s-Lab/AutoPYara](https://github.com/Botacin-s-Lab/AutoPYara/) | +| :material-book-open-variant: **API documentation** | GitHub Pages | [botacin-s-lab.github.io/AutoPYaraPyPI](https://botacin-s-lab.github.io/AutoPYaraPyPI/) | +| :fontawesome-brands-github: **PyPI source repository** | GitHub | [Botacin-s-Lab/AutoPYaraPyPI](https://github.com/Botacin-s-Lab/AutoPYaraPyPI) | +| :fontawesome-brands-java: **Java backend engine** | GitHub | [Botacin-s-Lab/AutoPYaraBackend](https://github.com/Botacin-s-Lab/AutoPYaraBackend) | +| :material-database: **YARA rules & benchmark data** | Zenodo | [zenodo.org/records/22665898](https://zenodo.org/records/22665898) | +| :fontawesome-brands-python: **Python package** (`pip install autopyara`) | PyPI | [pypi.org/project/autopyara](https://pypi.org/project/autopyara/) | diff --git a/docs/paper/AutoPYara_ACSAC2026.pdf b/docs/paper/AutoPYara_ACSAC2026.pdf new file mode 100644 index 0000000..093ec8c Binary files /dev/null and b/docs/paper/AutoPYara_ACSAC2026.pdf differ diff --git a/mkdocs.yml b/mkdocs.yml index ce853d1..437d0f2 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -13,6 +13,7 @@ nav: - Quick Start: quickstart.md - API Reference: api.md - Architecture: architecture.md + - Paper: paper.md - Development & Releasing: development.md theme: @@ -83,3 +84,7 @@ extra: link: https://github.com/Botacin-s-Lab/AutoPYaraPyPI - icon: fontawesome/brands/python link: https://pypi.org/project/autopyara/ + - icon: material/file-document + link: https://botacin-s-lab.github.io/AutoPYaraPyPI/paper/ + - icon: material/archive + link: https://zenodo.org/records/23107801