# Assessing the Effectiveness of YARA Rules for Signature-Based Malware Detection and Classification

arXiv: https://arxiv.org/abs/2111.13910 · HTML: https://mlsanity.com/paper/2111.13910/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Nov 2021.

## Built on by (most cited first, 3 of 3)

- [AutoMalDesc: Large-Scale Script Analysis for Cyber Threat Research](https://mlsanity.com/paper/2511.13333/) (2025)
- [POST: Email Archival, Processing and Flagging Stack for Incident Responders](https://mlsanity.com/paper/2407.01433/) (2024)
- [Machine Learning Transferability for Malware Detection](https://mlsanity.com/paper/2603.26632/) (2026)

## Abstract (arXiv)

Malware often uses obfuscation techniques or is modified slightly to evade signature detection from antivirus software and malware analysis tools. Traditionally, to determine if a file is malicious and identify what type of malware a sample is, a cryptographic hash of a file is calculated. A more recent and flexible solution for malware detection is YARA, which enables the creation of rules to identify and classify malware based on a file's binary patterns. In this paper, the author will critically evaluate the effectiveness of YARA rules for signature-based detection and classification of malware in comparison to alternative methods, which include cryptographic and fuzzy hashing.