I've only ever read about human analysts creating signatures, but it seems like automated signature derivation would be less time-consuming and I'm surprised that I'm not seeing more about automated signature derivation. Is automated signature derivation used or do we still rely primarily on human analysts to do this?


Disclosure: I'm working for an anti-malware vendor.

First, there is no anti-malware vendor which operates exclusively on signatures. Even free ClamAV is using more than signatures. So I'll address this question as related to "automated detection measures".

Several vendors I worked for in past use automated means to create malware detection rules. According to hearsay, this also seem to be the case at all other major security vendors.

The reason for that is the sheer volume of new malware. AV-TEST Institute, a reputable independent testing organization, states: "Every day, the AV-TEST Institute registers over 350,000 new malicious programs (malware) and potentially unwanted applications (PUA)." While those numbers include all malware, including polymorphic and metamorphic, the number of new detection rules needed in a day generally exceeds the number of minutes in a day. Thus for most vendors it is fully automated task.

Human effort however is still used to:

  • Create generic detectors - the rules which can detect polymorphic/metamorphic/obfuscated/encrypted content. A "dumb" signature cannot detect those, so there are different code pieces doing that.

  • Create proactive detectors. Those are targeting certain traits in malware which are unlikely to change fast enough (such as certain hardcoded strings, certain way functions are called, some unique libraries used). Using those as a base, it is possible to proactively detect new malware from the same author/group before it is even released.

  • Creating the disinfection routines. Those cannot be generated automatically, code needs to be written, tested and so on.

Of course maintaining the automatic detection systems is also where lots of effort goes.

  • Thanks for the informative answer! Do you know any public resources on this particular topic I could refer to?
    – chillsauce
    Jul 5 '19 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.