Search papers, labs, and topics across Lattice.
This paper introduces Aray, a deterministic-first YARA interpreter designed to synthesize benign artifacts for validating YARA rules without relying on actual malware samples. By evaluating 416 public-rule entries, Aray achieved a remarkable 97.6% success rate in generating valid fixtures that matched their original rules, demonstrating its effectiveness in ensuring reproducible scanner validation. The method not only streamlines the validation process but also addresses critical challenges in malware sample distribution and storage, making it a significant advancement in YARA rule validation practices.
Aray synthesizes benign artifacts for YARA validation with a 97.6% success rate, eliminating the need for actual malware samples.
A YARA rule is easy to distribute, but the malware sample used to demonstrate a positive match is not. This complicates storage, continuous integration, disaster-recovery exercises, and reproducible scanner validation. Constructing a replacement fixture requires more than embedding literals: YARA conditions can combine alternatives, counts, offsets, integer reads, and executable-container constraints, while the resulting file should not reproduce malware behavior. Positive validation is existential: it requires one file-level member of a rule's match set, not reconstruction of the originating sample. We present Aray, a deterministic-first YARA interpreter and positive-fixture synthesizer. Models may propose constructive normalizations or typed extraction fallbacks, but never backend source or binary structure. Conventional code validates normalized rules, derives string and integer witnesses, and performs extraction, routing, collision-checked layout, and ELF, PE, or generic serialization. Only residual normalization semantics reach a bounded model judge. We evaluated Aray over 416 public-rule entries. Normalization accepted 182 entries without model assistance and 234 after model normalization. Constructibility preflight admitted 406 entries, and every admitted fixture matched its upstream original rule. This yields 406/416 (97.6%) overall and 406/406 among constructible rules, with ten expected preflight dispositions and no scanner mismatches or construction failures. An unreachable endpoint confirmed zero model invocations during realization. The original-rule oracle validates generated fixtures against their source rules; proving implication for all possible files is a separate, stronger objective. Two anchored-regex failures were repaired before the final run, so these are post-fix systems results, not a held-out estimate.
