I'm far from an expert but "these samples cluster around this rule or this subset of rules" is far from machine learning. There's no learning there at all.
We have used YARA to extract out features from various documents (specifically things like RTF where you can easily count the number of different tags, their relative position, etc) and then used those features to train a ML model. It can be done, and can work well but YARA may not be the best tool in most cases. Just labeling a cluster based upon a set of rules that match is not machine learning. That is just labeling. -- WXS > On Jan 11, 2021, at 4:51 AM, raghvendra mishra <raghvendrami...@gmail.com> > wrote: > > Hi Arun, > What about using Yara rule pattern(s) as a feature, think about it. In this > way you can have clusters based upon family etc. > > Cheers, > --Raghvendra Mishra > Principal Threat Researcher > SonicWall Inc. > Cell:- +91-8867404241 > > > On Thu, Jan 7, 2021 at 11:28 PM arun rawat <rarun3...@gmail.com > <mailto:rarun3...@gmail.com>> wrote: > Hi Everyone, > > I am a college student working on a malware detection project. > > Someone told me that "Yara rules can also be used to convert a big data set > in the form of clusters in machine learning " and it has a different use at > different platforms. > > I am a bit confused, Is it true or not. > > Your advice can help a student to complete his Project. > > Thank you in advance. > > -- > You received this message because you are subscribed to the Google Groups > "YARA" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to yara-project+unsubscr...@googlegroups.com > <mailto:yara-project+unsubscr...@googlegroups.com>. > To view this discussion on the web visit > https://groups.google.com/d/msgid/yara-project/53e7b170-00e0-4f6d-ab1a-72c3920baa3an%40googlegroups.com > > <https://groups.google.com/d/msgid/yara-project/53e7b170-00e0-4f6d-ab1a-72c3920baa3an%40googlegroups.com?utm_medium=email&utm_source=footer>. > > -- > You received this message because you are subscribed to the Google Groups > "YARA" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to yara-project+unsubscr...@googlegroups.com > <mailto:yara-project+unsubscr...@googlegroups.com>. > To view this discussion on the web visit > https://groups.google.com/d/msgid/yara-project/CACAQ8EBighB6m%2Bk_EYabwqin5fVJRgHb83L3xicZ5XXAY8eHYg%40mail.gmail.com > > <https://groups.google.com/d/msgid/yara-project/CACAQ8EBighB6m%2Bk_EYabwqin5fVJRgHb83L3xicZ5XXAY8eHYg%40mail.gmail.com?utm_medium=email&utm_source=footer>. -- You received this message because you are subscribed to the Google Groups "YARA" group. To unsubscribe from this group and stop receiving emails from it, send an email to yara-project+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/yara-project/BF164FD0-9374-4F7F-B7E6-B2983FB5094E%40gmail.com.
