StringSifter Ranks Strings for Malware Triage
FireEye open-sourced StringSifter on September 7, 2019, a machine-learning utility that ranks strings extracted from binaries by their relevance to malware analysis. The tool is meant to push useful clues higher in a noisy Strings output, helping analysts triage suspicious files more efficiently before deeper investigation.
FireEye open-sourced StringSifter on September 7, 2019, as a utility for prioritizing strings found during malware analysis. The release came from FireEye Data Science and FireEye Labs Advanced Reverse Engineering, now associated with Mandiant's public tooling history.
StringSifter takes the output of a strings extractor and returns the same strings ranked by predicted relevance to an analyst. That matters because a binary can yield thousands of printable strings, while only a small subset may point to behavior, configuration, infrastructure, or other leads worth investigating. The project is designed to help analysts focus their first review on the most promising entries rather than treat the ranking as a verdict about a file.
How the ranking was developed
FireEye's technical description framed the task as learning to rank. The team reported training on Strings output from more than 25,000 malware binaries and more than 18 million strings. It used gradient-boosted decision trees with a learning-to-rank objective, with weak-supervision labels representing increasing relevance.
The public repository documents command-line tools for extracting and ranking strings, including flarestrings and rank_strings. It also describes using StringSifter with FLOSS output, which can surface some obfuscated strings before they are ranked. Those pipelines can prioritize review work, but analysts still need to validate any indicators and conclusions against the sample and the rest of their evidence.
Practical context
This is an archive item about a 2019 open-source release, not a newly disclosed threat or a current Mandiant product announcement. Its durable practitioner value is the workflow idea: use a relevance ranking to make an initial static-analysis pass more manageable, then corroborate the resulting leads with additional analysis.
Key Points
- 1FireEye announced the open-source release of StringSifter on September 7, 2019.
- 2The tool ranks extracted binary strings by predicted relevance for malware analysis rather than declaring a file malicious.
- 3Its repository documents use alongside string extraction and FLOSS output for triage workflows.
Scoring Rationale
A documented open-source malware-analysis utility with durable practitioner value, presented as an archive release rather than current threat news.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
