  Yara rules are a ubiquitous tool among cybersecurity practitioners and
analysts. Developing high-quality Yara rules to detect a malware family of
interest can be labor- and time-intensive, even for expert users. Few tools
exist and relatively little work has been done on how to automate the
generation of Yara rules for specific families. In this paper, we leverage
large n-grams ($n \geq 8$) combined with a new biclustering algorithm to
construct simple Yara rules more effectively than currently available software.
Our method, AutoYara, is fast, allowing for deployment on low-resource
equipment for teams that deploy to remote networks. Our results demonstrate
that AutoYara can help reduce analyst workload by producing rules with useful
true-positive rates while maintaining low false-positive rates, sometimes
matching or even outperforming human analysts. In addition, real-world testing
by malware analysts indicates AutoYara could reduce analyst time spent
constructing Yara rules by 44-86%, allowing them to spend their time on the
more advanced malware that current tools can't handle. Code will be made
available at https://github.com/NeuromorphicComputationResearchProgram .
