Aray: Deterministic-First Synthesis of Benign Artifacts for YARA Validation

What it is

Aray's paper (arXiv:2608.19387, presented at Black Hat USA 2026 Arsenal) with the details behind the 97.6% headline. The tool synthesizes benign files whose bytes satisfy a YARA rule so you can test scanner ingestion pipelines (S3 upload→scan→quarantine→alert, DR rehearsals, CI) without storing live malware. The summary gives the top-line result; the page gives the fragment it actually supports, what it refuses, and how honest the metric is.

How the number breaks down

The 406/416 is staged, not a single-pass score:

• 182 rules normalized with no model assistance; 234 required model normalization.
• Constructibility preflight admitted 406; the other 10 were "expected preflight dispositions" (unsupported/infeasible/unsatisfiable), not silent failures.
• Every admitted fixture matched — zero yara_mismatch and zero construction failures — so 406/406 among constructible rules.

Validation is done by scanning the generated file with the upstream original rule, independent of the normalized derivative. That tests the concrete witness b, it does not prove the specialization implies the source rule for all files.

What it supports vs refuses

The sound deterministic fragment: fixed text/hex strings with encoding/case/word-boundary modifiers; direct refs, simple set quantifiers, literal offsets/ranges, occurrence lower bounds; 16- and 32-bit unsigned reads (either endianness), literal comparisons, and nested expressions off a little-endian uint32 pointer.

Out of scope — do not expect these to construct: imported module semantics, general arithmetic/Boolean conditions, arbitrary loops, percentage counts, prescribed whole-file cryptographic hashes, and signed (int16) witness selection (parsed but incomplete). The lexical capability detector is not complete, so an unrecognized form may over-constrain or proceed on incomplete evidence.

Construction internals worth knowing: ELF via a GNU linker-script identity; PE via two-pass low-alignment construction with post-build verification.

flowchart TD
  R[Selected rule] --> C{regex / hex wildcard / disjunction / N-of?}
  C -->|no, fast path| P[Constructibility preflight]
  C -->|yes| M[Model proposes specialization]
  M --> V[Deterministic canonicalize + validate + residual judge]
  V --> P
  P --> B[ELF / PE / generic writer]
  B --> O[Scan with UPSTREAM ORIGINAL rule]

Caveats the paper states

• Figures are post-fix: two anchored-regex failures were found on this corpus and repaired before the final run, so 97.6% is not a held-out estimate of normalization generalization.
• The specialization r' may match fewer files than r; general YARA implication is neither decided nor claimed.
• Model authority is narrowed inside Aray, but the authors explicitly say this is not a substitute for isolating the wider test environment — and the current graph still initializes model clients even on the "zero-inference" path.
• "Benign" denotes design intent (no persistence/C2/payload logic), not a proof that arbitrary matched content is harmless.
• Batch normalization keeps only passed candidates; the regular graph currently proceeds on uncertain — the evaluation used the stricter batch policy.