AutoPYara is a Python framework for automated YARA rule generation from collections of malware samples. It combines:
- Variational Bayesian Gaussian Mixture Models (VBGMM)
- Augmented DBSCAN with centroid refinement
- Malicious/benign Bloom filter isolation
- Byte-level n-gram feature extraction
The result: cluster-aware, precision-engineered YARA signatures with minimal manual effort.
This site is a work in progress
This documentation is intentionally basic for now — installation, a quick start, and the full API reference. More material (including the accompanying paper, once published) will land here over time.
AutoPYara is live on PyPI — pip install autopyara to get started.
How it works¶
flowchart TD
A[Malware Samples] --> B[Byte n-gram Extraction]
B --> C["Bloom Filter Isolation<br/>(benign removal + malicious focus)"]
C --> D["Clustering Engine<br/>(VBGMM or Augmented DBSCAN)"]
D --> E[Cluster-Specific Signature Construction]
E --> F[High-Quality YARA Rules]Features¶
Automated clustering¶
Group similar malware samples together automatically to create concise, targeted rules.
Two core presets¶
The standard AutoYara (VBGMM) approach, or the enhanced AutoPYara (Augmented DBSCAN) pipeline.
Built-in Bloom filters¶
Ships with pre-trained EMBER and AutoPYara filters to efficiently filter out benign n-grams.
Multiple output formats¶
Raw strings, compiled yara-python objects, or yaramod parsed objects.
Custom training¶
Train your own Bloom filters on proprietary datasets.
Where to go next¶
- Installation — requirements and how to install AutoPYara.
- Quick Start — generate your first YARA rule.
- API Reference — presets, advanced usage, and the full
generate()parameter table. - Architecture — how the Python frontend and the separate Java backend fit together.
- Development & Releasing — running the tests and how releases are published.
Project links¶
| PyPI | pypi.org/project/autopyara |
| Python frontend | Botacin-s-Lab/AutoPYaraPyPI |
| Java backend | Botacin-s-Lab/AutoPYaraBackend — separate repository, builds the embedded AutoYara.jar |
| Issues | Report a bug |