VirusHammer data structure

"Gaurav Tanna" <[email protected]> 22 Mar 2004 22:28:51 -0000
Newsgroups gmane.comp.security.virus.openantivirus.devel
Message-ID <[email protected]>
 This is a multipart mime message


--Next_1079994528---0-202.54.124.151-1316
Content-type: text/html;
	charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<P>=0AHello all,<BR>=0AI am a Graduate student in Northeastern University d=
oing research on opensource antivirus programs.<BR>=0AWhile studying the Vi=
rusHammer program I could find by profiling that the hotspot in the program=
 is creation of a linklist which is a Trie tree (radix tree) which does a b=
it by bit comparision of the virus signatures rather than doing a byte by b=
yte comparision as in many other programs.<BR>=0ASo my query is that what i=
s the advantage of such implementation. Is it for faster execution or somet=
hing ??<BR>=0AIt would be great if anyone could please put some light on th=
is.<BR>=0A<BR>=0AThanking you.<BR>=0A<BR>=0ASincerely,<BR>=0A<BR>=0AGaurav =
Tanna<BR>=0AGraduate Student<BR>=0AECE Department<BR>=0ANortheastern Univer=
sity=0A</P>=0A=0A=0A<br><br>=0A<A target=3D"_blank" HREF=3D"http://clients.=
rediff.com/signature/track_sig.asp"><IMG SRC=3D"http://ads.rediff.com/RealM=
edia/ads/adstream_nx.cgi/www.rediffmail.com/[email protected]" BORDER=3D0 VS=
PACE=3D0 HSPACE=3D0 HEIGHT=3D74 WIDTH=3D496></a>=0A
--Next_1079994528---0-202.54.124.151-1316
Content-type: text/plain;
	charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hello all,=0AI am a Graduate student in Northeastern University doing resea=
rch on opensource antivirus programs.=0AWhile studying the VirusHammer prog=
ram I could find by profiling that the hotspot in the program is creation o=
f a linklist which is a Trie tree (radix tree) which does a bit by bit comp=
arision of the virus signatures rather than doing a byte by byte comparisio=
n as in many other programs.=0ASo my query is that what is the advantage of=
 such implementation. Is it for faster execution or something ??=0AIt would=
 be great if anyone could please put some light on this.=0A=0AThanking you.=
=0A=0ASincerely,=0A=0AGaurav Tanna=0AGraduate Student=0AECE Department=0ANo=
rtheastern University=0A=0A
--Next_1079994528---0-202.54.124.151-1316--



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click