• malware
• honeypot
• yara
• regular expressions
• binary files

The aim of the thesis project is to create an automatic tool for generating YARA rules on the basis of evidence collected from a honeypot. The honeypot is a tool from which to draw to detect samples of attacks or attack attempts, from which, through YARA and regular expressions, it is possible to extract the constituent elements, such as IP addresses or URLs. The honeypot files, as defined, serve as useful tools to study the behavior of attackers and, with this implementation, it will be possible to automatically collect a lot of information, so that it can be exploited by YARA for file analysis in the future.