防病毒软件的字符串/签名比较
基于签名的防病毒软件是否将每个当前扫描的文件与数据库中存在的所有字符串/签名进行匹配？是否需要遍历所有签名才能将它们与文件进行比较？比较是从“数据库到文件”而不是从“文件到数据库”进行的，是这样吗？
第二个问题：是否可以先通过AV引擎从文件中提取字符串/签名（不是整个文件的哈希值），然后查看该字符串是否在数据库中？有已知的 AV 这样做吗？
Does signature-based AntiVirus software match each currently-scanned file with all strings/signatures that exist in the database? Does it need to pass through all signatures in order to compare them with a file? The comparison is done from the "database to the file" not from the "file to the database", is that true ?
The second question: Is it possible to extract the string/signature (NOT Hash for whole file) by AV engine from a file first, and then see whether that string is in the database or not? Is there any known AV does this way?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
通常，这是如何完成的，已知病毒签名的数据库用于构建状态机（通常与 Aho-Corasick 字符串搜索算法）。然后，每个要检查的文件都通过状态机运行。事实证明，速度快得惊人，因为只需一次浏览文件就可以找到所有匹配的病毒签名。
Typically how this is done is that the database of known virus signatures is used to build a state machine (often something very similar to the Aho-Corasick string search algorithm). Then, each file that is to be checked is run through the state machine. This turns out to be surprisingly fast, as all matching virus signatures can be found with a single pass through the file.