Assessing the discriminative power of YARA rules for nation-state malware attribution
Αξιολόγηση της διακριτικής ικανότητας των κανόνων YARA για την απόδοση κακόβουλου λογισμικού σε κρατικούς δρώντες
View/
Keywords
APT attribution ; YARA rules ; malware clustering ; hierarchical clustering ; nation-state malware ; απόδοση APT ; κανόνες YARA ; ομαδοποίηση κακόβουλου λογισμικού ; ιεραρχική ομαδοποίηση ; κρατικό κακόβουλο λογισμικόAbstract
Attributing malware to the Advanced Persistent Threat (APT) group or nation-state behind
it is a challenging but invaluable task, complicated by the deliberate camouflage and
false-flag techniques these actors employ. Most existing attribution approaches rely on
dynamic analysis or machine-learning models that are costly to run and examine samples
in isolation, without revealing the shared tooling that links families together. This thesis
investigates a lightweight, purely static alternative: representing each APT family by its
YARA-rule match profile, the set of publicly available rules its samples trigger,
and examines whether these profiles carry a discriminative signal about the family's country of
origin and its relationships to other families. We assembled a dataset of 14,938 verified
Windows PE/DLL samples spanning 78 APT families across 12 countries, scanned them with a
large corpus of public YARA rules filtered to exclude attribution-encoding and non-technical
rules, and clustered the families with agglomerative hierarchical clustering, evaluating the
results with chance-corrected metrics and permutation-based significance tests. We find that YARA profiles carry only a weak signal about a family's country of origin. A per-country analysis further shows that this faint same-country tendency comes almost entirely from North Korea, whose families cluster tightly together, whereas no other country, including the most heavily represented ones, shows comparable cohesion. The profiles are far more useful; however, for uncovering relationships between individual families: pairs that MITRE ATT&CK records as the same actor or as related tend to cluster closer than chance. Static YARA signals are therefore of
limited use for country-level attribution but genuinely captures shared tooling between
individual families.
Department
Σχολή Τεχνολογιών Πληροφορικής και Επικοινωνιών. Τμήμα ΠληροφορικήςNumber of pages
52Language
EnglishCollections
Except where otherwise noted, this item's license is described as
Αναφορά Δημιουργού-Μη Εμπορική Χρήση-Όχι Παράγωγα Έργα 3.0 Ελλάδα
Αναφορά Δημιουργού-Μη Εμπορική Χρήση-Όχι Παράγωγα Έργα 3.0 Ελλάδα