Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 18 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@

Automatically discover malware families and generate high-quality, tightly scoped YARA rules using probabilistic clustering and Bloom-filtered n-gram analysis.

[**Documentation**](https://botacin-s-lab.github.io/AutoPYaraPyPI/) · [PyPI](https://pypi.org/project/autopyara/) · [Report a Bug](https://github.com/Botacin-s-Lab/AutoPYaraPyPI/issues) · [Changelog](CHANGELOG.md) · [Releasing](RELEASING.md)
[**Documentation**](https://botacin-s-lab.github.io/AutoPYaraPyPI/) · [Paper](docs/paper/AutoPYara_ACSAC2026.pdf) · [PyPI](https://pypi.org/project/autopyara/) · [Report a Bug](https://github.com/Botacin-s-Lab/AutoPYaraPyPI/issues) · [Changelog](CHANGELOG.md) · [Releasing](RELEASING.md)

</div>

Expand Down Expand Up @@ -207,7 +207,7 @@ tool.train(

## 📖 Documentation

Full documentation lives at **[botacin-s-lab.github.io/AutoPYaraPyPI](https://botacin-s-lab.github.io/AutoPYaraPyPI/)**. It's intentionally basic for now — installation, quick start, and the API reference — with more material (including the accompanying paper, once published) landing there over time.
Full documentation lives at **[botacin-s-lab.github.io/AutoPYaraPyPI](https://botacin-s-lab.github.io/AutoPYaraPyPI/)** — installation, quick start, the API reference, and the [ACSAC 2026 paper page](https://botacin-s-lab.github.io/AutoPYaraPyPI/paper/).

## 🧪 Development

Expand All @@ -226,22 +226,33 @@ We're accepting contributions — if you run into an issue or have a fix, fork t

## 📄 Citation

If you use AutoPYara in academic work, please cite:
**AutoPYara has been accepted at ACSAC 2026.** [Read the paper (PDF)](docs/paper/AutoPYara_ACSAC2026.pdf). If you use AutoPYara in academic work, please cite:

> Mabon Ninan\*, Nhat Minh Nguyen\*, Soumyajyoti Dutta, Sidharth Anil, and Marcus Botacin.
> **"AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering."** *Annual Computer Security Applications Conference (ACSAC 2026)*, to appear.
> **"AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering."** *Annual Computer Security Applications Conference (ACSAC)*, 2026.
> \*Equal contribution. Texas A&M University — {ninanmm, nmnguy29, soumyajyoti1998, sid.anil, botacin}@tamu.edu

```bibtex
@inproceedings{autopyara2026,
title = {AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering},
author = {Ninan, Mabon and Nguyen, Nhat Minh and Dutta, Soumyajyoti and Anil, Sidharth and Botacin, Marcus},
booktitle = {Proceedings of the Annual Computer Security Applications Conference (ACSAC)},
year = {2026},
note = {To appear}
booktitle = {Annual Computer Security Applications Conference (ACSAC)},
year = {2026}
}
```

### Artifacts and resources

| Resource | Link |
|---|---|
| ACSAC permanent artifact (Zenodo) | https://zenodo.org/records/23107801 |
| ACSAC artifact source (GitHub) | https://github.com/Botacin-s-Lab/AutoPYara/ |
| API documentation (GitHub Pages) | https://botacin-s-lab.github.io/AutoPYaraPyPI/ |
| PyPI source repository (GitHub) | https://github.com/Botacin-s-Lab/AutoPYaraPyPI |
| Java backend engine (GitHub) | https://github.com/Botacin-s-Lab/AutoPYaraBackend |
| YARA rules & benchmark data (Zenodo) | https://zenodo.org/records/22665898 |
| Python package, `pip install autopyara` (PyPI) | https://pypi.org/project/autopyara/ |

The `AutoYara` preset builds on the original [AutoYara](https://github.com/FutureComputing4AI/AutoYara) project (Apache 2.0); if you use it, please also cite:

> Edward Raff, Richard Zak, Gary Lopez Munoz, William Fleming, Hyrum S. Anderson, Bobby Filar, Charles Nicholas, and James Holt.
Expand Down
2 changes: 1 addition & 1 deletion docs/architecture.md
Original file line number Diff line number Diff line change
Expand Up @@ -194,4 +194,4 @@ This project was also the subject of a related thesis:

> Nhat Minh Nguyen. **"AutoPYara: A Python/Java Framework for Automatic YARA Rule Generation Using Semi-Supervised Clustering."** M.S. Thesis, Texas A&M University, Spring 2025.

See the [homepage's Citation section](index.md#citation) for how to cite the AutoPYara paper itself.
See the [Paper & Resources](paper.md) page for the ACSAC 2026 paper and how to cite it.
25 changes: 15 additions & 10 deletions docs/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,8 @@ AutoPYara is a Python framework for automated YARA rule generation from collecti

The result: cluster-aware, precision-engineered YARA signatures with minimal manual effort.

!!! info "This site is a work in progress"
This documentation is intentionally basic for now — installation, a quick start, and the full API reference. More material (including the accompanying paper, once published) will land here over time.
!!! success "Accepted at ACSAC 2026"
The AutoPYara paper will appear at the *Annual Computer Security Applications Conference (ACSAC), 2026*. [Read the paper →](paper.md)

AutoPYara is [live on PyPI](https://pypi.org/project/autopyara/) — `pip install autopyara` to get started.

Expand Down Expand Up @@ -81,32 +81,37 @@ Train your own Bloom filters on proprietary datasets.
- [Quick Start](quickstart.md) — generate your first YARA rule.
- [API Reference](api.md) — presets, advanced usage, and the full `generate()` parameter table.
- [Architecture](architecture.md) — how the Python frontend and the separate Java backend fit together.
- [Paper & Resources](paper.md) — the ACSAC 2026 paper (PDF), abstract, citation, and artifacts.
- [Development & Releasing](development.md) — running the tests and how releases are published.

## Project links

| | |
|---|---|
| :fontawesome-brands-python: **PyPI** | [pypi.org/project/autopyara](https://pypi.org/project/autopyara/) |
| :fontawesome-brands-github: **Python frontend** | [Botacin-s-Lab/AutoPYaraPyPI](https://github.com/Botacin-s-Lab/AutoPYaraPyPI) |
| :fontawesome-brands-java: **Java backend** | [Botacin-s-Lab/AutoPYaraBackend](https://github.com/Botacin-s-Lab/AutoPYaraBackend) — separate repository, builds the embedded `AutoYara.jar` |
| :material-archive: **ACSAC permanent artifact** | [Zenodo — zenodo.org/records/23107801](https://zenodo.org/records/23107801) |
| :fontawesome-brands-github: **ACSAC artifact source** | [GitHub — Botacin-s-Lab/AutoPYara](https://github.com/Botacin-s-Lab/AutoPYara/) |
| :material-book-open-variant: **API documentation** | [GitHub Pages — botacin-s-lab.github.io/AutoPYaraPyPI](https://botacin-s-lab.github.io/AutoPYaraPyPI/) |
| :fontawesome-brands-github: **PyPI source repository** | [GitHub — Botacin-s-Lab/AutoPYaraPyPI](https://github.com/Botacin-s-Lab/AutoPYaraPyPI) |
| :fontawesome-brands-java: **Java backend engine** | [GitHub — Botacin-s-Lab/AutoPYaraBackend](https://github.com/Botacin-s-Lab/AutoPYaraBackend) |
| :material-database: **YARA rules & benchmark data** | [Zenodo — zenodo.org/records/22665898](https://zenodo.org/records/22665898) |
| :fontawesome-brands-python: **Python package** (`pip install autopyara`) | [PyPI — pypi.org/project/autopyara](https://pypi.org/project/autopyara/) |
| :material-file-pdf-box: **Paper (PDF)** | [AutoPYara_ACSAC2026.pdf](paper/AutoPYara_ACSAC2026.pdf) |
| :material-bug: **Issues** | [Report a bug](https://github.com/Botacin-s-Lab/AutoPYaraPyPI/issues) |

## Citation

If you use AutoPYara in academic work, please cite:
If you use AutoPYara in academic work, please cite the ACSAC 2026 paper ([PDF](paper/AutoPYara_ACSAC2026.pdf)). Recommended citation:

> Mabon Ninan\*, Nhat Minh Nguyen\*, Soumyajyoti Dutta, Sidharth Anil, and Marcus Botacin.
> **"AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering."** *Annual Computer Security Applications Conference (ACSAC 2026)*, to appear.
> **"AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering."** *Annual Computer Security Applications Conference (ACSAC)*, 2026.
> \*Equal contribution. Texas A&M University — {ninanmm, nmnguy29, soumyajyoti1998, sid.anil, botacin}@tamu.edu

```bibtex
@inproceedings{autopyara2026,
title = {AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering},
author = {Ninan, Mabon and Nguyen, Nhat Minh and Dutta, Soumyajyoti and Anil, Sidharth and Botacin, Marcus},
booktitle = {Proceedings of the Annual Computer Security Applications Conference (ACSAC)},
year = {2026},
note = {To appear}
booktitle = {Annual Computer Security Applications Conference (ACSAC)},
year = {2026}
}
```

Expand Down
44 changes: 44 additions & 0 deletions docs/paper.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
---
title: Paper & Resources — AutoPYara
---

# Paper & Resources

!!! success "Accepted at ACSAC 2026"
**AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering** will appear at the *Annual Computer Security Applications Conference (ACSAC), 2026*.

[Download the paper (PDF) :material-file-pdf-box:](paper/AutoPYara_ACSAC2026.pdf){ .md-button .md-button--primary }
[ACSAC artifact (Zenodo) :material-archive:](https://zenodo.org/records/23107801){ .md-button }

Mabon Ninan\*, Nhat Minh Nguyen\*, Soumyajyoti Dutta, Sidharth Anil, and Marcus Botacin — Texas A&M University. \*Equal contribution.

## Abstract

Millions of malware variants threaten users daily, such that clustering these samples is key for fast incident response. AutoYara is the current state-of-the-art for automatic YARA rule generation, but the task remains challenging on realistic datasets, where intra-family diversity and noisy clustering can degrade rule quality. We present AutoPYara, a solution armored with: (1) precise cluster centroid selection based on similarity hashing, and (2) an improved heuristic for estimating subclusters within a malware family using historical VirusTotal data. We implement AutoPYara as an open-source Python package, `pip install autopyara`, to support reproducibility and practical use. We show that AutoPYara, (1) increases rule coverage by 14 percentage points; (2) reduces variance by 7.1 percentage points, comparing the average variance AutoPYara exhibits to that of AutoYara; and (3) improves threat-hunting accuracy by 10%. AutoPYara produces robust and effective YARA rules than prior automatic approaches in practical settings.

## Citation

Recommended citation:

> M. Ninan, N. M. Nguyen, S. Dutta, S. Anil, and M. Botacin, "AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering," *Annual Computer Security Applications Conference (ACSAC)*, 2026.

```bibtex
@inproceedings{autopyara2026,
title = {AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering},
author = {Ninan, Mabon and Nguyen, Nhat Minh and Dutta, Soumyajyoti and Anil, Sidharth and Botacin, Marcus},
booktitle = {Annual Computer Security Applications Conference (ACSAC)},
year = {2026}
}
```

## Artifacts and resources

| Resource | Host | Link |
|---|---|---|
| :material-archive: **ACSAC permanent artifact** | Zenodo | [zenodo.org/records/23107801](https://zenodo.org/records/23107801) |
| :fontawesome-brands-github: **ACSAC artifact source** | GitHub | [Botacin-s-Lab/AutoPYara](https://github.com/Botacin-s-Lab/AutoPYara/) |
| :material-book-open-variant: **API documentation** | GitHub Pages | [botacin-s-lab.github.io/AutoPYaraPyPI](https://botacin-s-lab.github.io/AutoPYaraPyPI/) |
| :fontawesome-brands-github: **PyPI source repository** | GitHub | [Botacin-s-Lab/AutoPYaraPyPI](https://github.com/Botacin-s-Lab/AutoPYaraPyPI) |
| :fontawesome-brands-java: **Java backend engine** | GitHub | [Botacin-s-Lab/AutoPYaraBackend](https://github.com/Botacin-s-Lab/AutoPYaraBackend) |
| :material-database: **YARA rules & benchmark data** | Zenodo | [zenodo.org/records/22665898](https://zenodo.org/records/22665898) |
| :fontawesome-brands-python: **Python package** (`pip install autopyara`) | PyPI | [pypi.org/project/autopyara](https://pypi.org/project/autopyara/) |
Binary file added docs/paper/AutoPYara_ACSAC2026.pdf
Binary file not shown.
5 changes: 5 additions & 0 deletions mkdocs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ nav:
- Quick Start: quickstart.md
- API Reference: api.md
- Architecture: architecture.md
- Paper: paper.md
- Development & Releasing: development.md

theme:
Expand Down Expand Up @@ -83,3 +84,7 @@ extra:
link: https://github.com/Botacin-s-Lab/AutoPYaraPyPI
- icon: fontawesome/brands/python
link: https://pypi.org/project/autopyara/
- icon: material/file-document
link: https://botacin-s-lab.github.io/AutoPYaraPyPI/paper/
- icon: material/archive
link: https://zenodo.org/records/23107801
Loading