AutoPYara is a Python framework for automated YARA rule generation from collections of malware samples. It combines:
- Variational Bayesian Gaussian Mixture Models (VBGMM)
- Augmented DBSCAN with centroid refinement
- Malicious/benign Bloom filter isolation
- Byte-level n-gram feature extraction
The result: cluster-aware, precision-engineered YARA signatures with minimal manual effort.
Accepted at ACSAC 2026
The AutoPYara paper will appear at the Annual Computer Security Applications Conference (ACSAC), 2026. Read the paper →
AutoPYara is live on PyPI — pip install autopyara to get started.
How it works¶
flowchart TD
A[Malware Samples] --> B[Byte n-gram Extraction]
B --> C["Bloom Filter Isolation<br/>(benign removal + malicious focus)"]
C --> D["Clustering Engine<br/>(VBGMM or Augmented DBSCAN)"]
D --> E[Cluster-Specific Signature Construction]
E --> F[High-Quality YARA Rules]Features¶
Automated clustering¶
Group similar malware samples together automatically to create concise, targeted rules.
Two core presets¶
The standard AutoYara (VBGMM) approach, or the enhanced AutoPYara (Augmented DBSCAN) pipeline.
Built-in Bloom filters¶
Ships with pre-trained EMBER and AutoPYara filters to efficiently filter out benign n-grams.
Multiple output formats¶
Raw strings, compiled yara-python objects, or yaramod parsed objects.
Custom training¶
Train your own Bloom filters on proprietary datasets.
Where to go next¶
- Installation — requirements and how to install AutoPYara.
- Quick Start — generate your first YARA rule.
- API Reference — presets, advanced usage, and the full
generate()parameter table. - Architecture — how the Python frontend and the separate Java backend fit together.
- Paper & Resources — the ACSAC 2026 paper (PDF), abstract, citation, and artifacts.
- Development & Releasing — running the tests and how releases are published.
Project links¶
| ACSAC permanent artifact | Zenodo — zenodo.org/records/23107801 |
| ACSAC artifact source | GitHub — Botacin-s-Lab/AutoPYara |
| API documentation | GitHub Pages — botacin-s-lab.github.io/AutoPYaraPyPI |
| PyPI source repository | GitHub — Botacin-s-Lab/AutoPYaraPyPI |
| Java backend engine | GitHub — Botacin-s-Lab/AutoPYaraBackend |
| YARA rules & benchmark data | Zenodo — zenodo.org/records/22665898 |
Python package (pip install autopyara) |
PyPI — pypi.org/project/autopyara |
| Paper (PDF) | AutoPYara_ACSAC2026.pdf |
| Issues | Report a bug |
Citation¶
If you use AutoPYara in academic work, please cite the ACSAC 2026 paper (PDF). Recommended citation:
Mabon Ninan*, Nhat Minh Nguyen*, Soumyajyoti Dutta, Sidharth Anil, and Marcus Botacin. "AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering." Annual Computer Security Applications Conference (ACSAC), 2026. *Equal contribution. Texas A&M University — {ninanmm, nmnguy29, soumyajyoti1998, sid.anil, botacin}@tamu.edu
@inproceedings{autopyara2026,
title = {AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering},
author = {Ninan, Mabon and Nguyen, Nhat Minh and Dutta, Soumyajyoti and Anil, Sidharth and Botacin, Marcus},
booktitle = {Annual Computer Security Applications Conference (ACSAC)},
year = {2026}
}
AutoPYara's Python frontend was also the subject of a related thesis:
Nhat Minh Nguyen. "AutoPYara: A Python/Java Framework for Automatic YARA Rule Generation Using Semi-Supervised Clustering." M.S. Thesis, Texas A&M University, Spring 2025.
The AutoYara preset builds on the original AutoYara project — please also cite its paper; see Architecture → Credits.