Package: genrex-py
GenRex 🦖GenRex is a tool that generates regular expressions from strings such as artifacts dynamically generated by samples.For more information, check out:Blog postWikiCitationFor citing, please use the following entry for theoriginal paper:@misc{genrex-2023,
  doi = {10.1109/TrustCom60117.2023.00123},
  url = {...},
  author = {Regeciova, Dominika and Kolar, Dusan},
  title = {GenRex: Leveraging Regular Expressions for Dynamic Malware Detection},
  publisher = {IEEE},
  year = {2023}
}:snake: Minimal supported version of Python is3.10.Installationpipinstall-Ugenrex-pyHow to Useimportgenrex# pre-process the input from cuckoo_format reports (default: False)cuckoo_format=False# When True, GenRex will store the original strings as well,# when False, GenRex will store the processed strings onlystore_original_strings=Trueresults=genrex.generate(cuckoo_format=cuckoo_format,store_original_strings=store_original_strings,directory="samples")print("Results:")forresultinresults:print(result)"""Results:Regex: hello[0-9a-f]                               # regular expressionNgram: hell                                        # common part of strings in clusterUnique: 6                                          # how many unique strings are in clusterMin: 3                                             # minimal number of occurrences in samplesMax: 3                                             # maximal number of occurrences in samplesAverage: 3.0                                       # average number of occurrences in samplesResources: ['hello1', 'hello2', ..., 'helloc']     # list of preprocessed strings from clusterOriginals: []                                      # list of original strings from cluster# (if store_original_strings is True)Input type: ''                                     # input types (if defined)Hashes: ['source1', 'source2']                     # list of sources['input_type', 'ngram', 'original_regexes', 'originals', 'regex', 'similar_regex', 'similars', 'unique']"""importgenrexcuckoo_format=True# When True, GenRex will store the original strings as well,# when False, GenRex will store the processed strings onlystore_original_strings=Falseresults=genrex.generate(cuckoo_format=cuckoo_format,store_original_strings=store_original_strings,input_type=genrex.InputType.MUTEX,source={"source1":["helloa","hellob","helloc"],"source2":["hello1","hello2","hello3"],})print("Results:")forresultinresults:res=result.return_printable_dict()print("Regex:",res["regex"])# regular expressionprint("Ngram:",res["ngram"])# common part of strings in clusterprint("Unique:",res["unique"])# how many unique strings are in clusterprint("Min:",res["min"])# minimal number of occurrences in samplesprint("Max:",res["max"])# maximal number of occurrences in samplesprint("Avg:",res["average"])# average number of occurrences in samplesprint("Resources:",res["resources"])# list of preprocessed strings from clusterprint("Type:",res["input_type"])# input types (if defined)print("Hashes:",res["hashes"])# list of sources"""Results:Regex: (^|\\)hello[0-9a-f]$Ngram: hellUnique: 6Min: 3Max: 3Avg: 3.0Type: 'mutex'Resources: ['helloc', 'hellob', 'hello3', 'hello1', 'helloa', 'hello2']Hashes: ['source1', 'source2']"""How to developInstall GenRex in development mode with all necessary dependencies.makesetupTestsYou can run tests with the following command:maketestsLicenseCopyright (c) 2023 Avast Software, licensed under the MIT license. See theLICENSEfile for more
details.