On Mon, Nov 12, 2012 at 3:05 AM, zahra tabari <free_kab_b...@yahoo.com>wrote:
> Dear Member List, > > I have faced with an anti virus project which uses Clam signatures. It > uses Aho-Corasick algorithm for signature matching. I want to apply a > replacement for Aho-Corasick algorithm, which has a better performance and > preferably covers all kinds of signatures (especially .ndb ones). > I would be very grateful if you let me know about your suggestions. > > Best Regards > _______________________________________________ > Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net > http://www.clamav.net/support/ml > I don't have a replacement algorithm suggestion for you, but I do have some advice. You will find some good reading material and a few ideas in the history of the mailing list, and more of it in the clamav-devel list. Some prior discussions about the algorithms on the devel list: http://www.gossamer-threads.com/lists/clamav/devel/41961 http://www.gossamer-threads.com/lists/clamav/devel/47923 http://www.gossamer-threads.com/lists/clamav/devel/55386 My last piece of advice: get to know your performance metrics and your sample datasets. Good luck with your project. Dave R. -- --- Dave Raynor Sourcefire Vulnerability Research Team dray...@sourcefire.com _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
