BASS Automated Signature Synthesizer: BASS

ID N0WHERE:171772
Type n0where
Reporter N0where
Modified 2017-06-23T00:45:50


BASS Automated Signature Synthesizer

BASS (pronounced “bæs”) is a framework designed to automatically generate antivirus signatures from samples belonging to previously generated malware clusters. It is meant to reduce resource usage of ClamAV by producing more pattern-based signatures as opposed to hash-based signatures, and to alleviate the workload of analysts who write pattern-based signatures. The framework is easily scalable thanks to Docker.

Please note that this framework is still considered in the Alpha stage and as a result, it will have some rough edges. As this tool is open source and actively maintained by us, we gladly welcome any feedback from the community on improving the functionality of BASS.



You need Docker ( installation instructions ) and docker-compose ( installation instructions ) installed. Even if your distribution has packages for those, we recommend you to install them as described in the installation instructions to have the newest versions available. Parts of our software might not work with old versions of docker and docker-compose.

Further, the client to speak to the docker cluster needs the python _ requests _ package installed. This can for example be done with pip install requests if you use python’s pip package manager.

Finally, you need docker-ida to build a container for IDA Pro. On *nix, you can get and build docker-ida with the following commands:

IDA_BINARY=... #Make this variable point to your IDA Pro installation binary
IDA_PASSWORD=... #Set this variable to your IDA Pro installation password
git clone
cp ${IDA_BINARY} docker-ida/ida/
docker build -t ida docker-ida/ida/

You have to set the two variables at the beginning, and you need to tag the resulting docker container with “ida”.

Building the containers

Normally it should be enough to run docker-compose build in the repository root directory to build BASS’ containers.

Running BASS

If you have a VirusTotal key, export it in the shell where you run the docker (e.g., export VIRUSTOTAL_API_KEY=xxx in bash). Run docker-compose up in the project’s root directory to start BASS. Then use the client in client/ to submit samples and get the resulting signature.

For example, run python ./client/ sample1 sample2 sample3 to generate a signature for the cluster consisting of binaries _ sample1 _ , _ sample2 _ and _ sample3 _ .


The job object has an _ exception _ and _ exception_trace _ property which contain information about a raised exception if the job finished with an error status. Debug logs may be found in the docker volume mounted to _ /tmp/bass_logs _ . In particular it might be helpful to track progress in the most recent log file via tail -f $( ls /tmp/bass_logs/*.log | tail -n 1 ) .


The client is contained in _ client/ _ .

The folders _ bass/ _ , _ bindiff/ _ and _ kamino/ _ contain the docker containers for the specific tools.

Python APIs for the REST interface of kamino and bindiff are in _ ./bass/python/cisco/bass/docker/ _ .

The k-LCS algorithm is implemented as a C library (source in _ ./bass/python/src/_lcs.cpp _ ) which is interfaced with ctypes.

If you are looking for a starting point to the signature generation process, have a look at _ ./bass/python/cisco/bass/ _ .

BASS Automated Signature Synthesizer: BASS