Malfoyle - A Robust Implementation of Hash-Based Cryptographic Detection Systems and Yara Rule Integration
G. Vivekananda
Computer Science and Engineering
(Cyber Security)
Institute of Aeronautical Engineering
Dundigal, Hyderabad
21951a6262@iare.ac.in
Dr. P Ramadevi
Associate Professor
Computer Science and Engineering
(Cyber Security)
Institute of Aeronautical Engineering
Dundigal, Hyderabad
p.ramadevi@iare.ac.in
Morupoju Akshith Kumar
Computer Science and Engineering
(Cyber Security)
Institute of Aeronautical Engineering
Dundigal, Hyderabad
21951a6201@iare.ac.in
P. Hiranmayee
Computer Science and Engineering
(Cyber Security)
Institute of Aeronautical Engineering
Dundigal, Hyderabad
21951a6212@iare.ac.in
ABSTRACT
Malware remains a significant cybersecurity threat, highlighting the need for innovative detection methods to address limitations of existing approaches [7]. As organizations face devastating consequences due to sophisticated malware attacks and lack of effective fallback mechanisms [7], the development of robust detection tools becomes critical. The evolving nature of malware, driven by obfuscations, mutations, and modifications, dynamically alters feature distributions and renders static detection methods ineffective, necessitating adaptive approaches to combat these challenges [2]. MalFoyle is an open-source Command Line Interface (CLI) instrument formulated in Python that utilizes a hash-based malware detection paradigm. By computing the SHA256 hash of files and inquiring within a prominent malware repository, MalFoyle furnishes users with invaluable insights, encompassing vendor judgments and Yet Another Ridiculous Acronym (YARA) regulations, facilitating swift identification and alleviation of potential threats. While recognizing limitations such as database veracity, detection of polymorphic malware, and possible false positives or negatives, MalFoyle offers a pragmatic resolution for expeditious malware evaluation. The tool illustrates substantial potential for incorporation into extensive security architectures, including automated workflows, threat intelligence platforms, endpoint
safeguarding, and incident response contexts, thereby all the augmenting overall malware detection competencies. MalFoyle contributes to the ongoing progression of malware detection methodologies and emphasizes the significance of open-source instruments in addressing the evolving challenges of cybersecurity.
Keywords: Malware detection, hash-based detection, command-line interface(CLI), malware database, YARA(Yet Another Ridiculous Acronym) rules, limitations, threat intelligence, endpoint security, incident response,SHA-256 Algorithm,MD-5 Algorithm. security pipelines, threat platforms, endpoints.
