Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How a new Internet-Security/Anti-Virus startup prepares its malware database? I have seen some new products that are able to detect viruses that were on the wild 10-15 years back.

share|improve this question
    
You asking for a guess or knowledge from someone of the inside? –  Saxtus Dec 30 '09 at 8:13
    
I don't see how this is relevant; it seems to be a question about running a business rather than a question about computer hardware/software. –  James Polley Dec 30 '09 at 11:05
    
Oh no. I am not an inside person. Just had a long time curiosity. –  RPK Dec 31 '09 at 9:39

1 Answer 1

up vote 1 down vote accepted

Anti-Virus companies have two aspects to handle,

  1. the signatures they need to match, and
  2. the technology used to match signatures

Signatures themselves are pretty well standardized (with quantified false-positive characteristics).
The technology would be proprietary and govern how the signatures are used.

So, a new company would pickup a standard database from some source and 'run' their custom translators to convert it to a database that will work with their implementation.
The company will take their call on a balance between easy-conversion and optimization for their implementation.

A few references for further reading,

  • SNORT rules: Sourcefire Vulnerability Research Team™ (VRT) Rules
  • Writing ClamAV Signatures. Alain Zidouemba. March 4, 2009 (PDF file)
  • PE Sig (linked from here among other things)
    • PE Sig is a tool written in Ruby that generates ClamAV® signatures for portable executable files.
      For more information on PE Sig check out Brian Caswell's write up on the VRT Blog
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.