Re: VirusHammer data structure

"Gaurav  Tanna" wrote:

> I am a Graduate student in Northeastern University doing research on
> opensource antivirus programs.  ...

What, of value, is there to research?

To date, the products that loosely fall into that set are pretty much 
locked in the more-than-a-decade-obsolete "virus scanning is a 
glorified binary grep" view of things...

> ...  While studying the VirusHammer program I
> could find by profiling that the hotspot in the program is creation of
> a linklist which is a Trie tree (radix tree) which does a bit by bit
> comparision of the virus signatures rather than doing a byte by byte
> comparision as in many other programs. So my query is that what is the
> advantage of such implementation. Is it for faster execution or
> something ?? It would be great if anyone could please put some light on
> this. 

Without having looked at the code myself, this is pretty much a 
guess...

The detection patterns that OAV (and descendants) often steal from 
commercial virus scanners can include wildcarded bytes, nibbles and 
bits (depending on the detection engine), so I imagine doing bit-for-
bit operations allows sensitivity to (and possibly replication of?) 
such functionality in OAV.


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click