Skip to main content
Commonmark migration
Source Link

#Signatures are generally non-interoperable.

Signatures are generally non-interoperable.

There is some licensing going on, but generally, I'd say AV-vendors all have their own engines, and these engines may not be even able to understand the signatures/rulesets of other engines.

Having people on staff (maybe even around the clock) that can extract useful signatures from a set/family of malware is expensive. So the individual signatures are prized intellectual property.

It's for the same reason, that the actual on-disk-format of how a signature is constructed is something that is generally kept secret for commercial AV-software. (Correct me if I'm wrong.)

On the other hand, there are documented several Open-Source approaches for AV-signatures. One of the more known ones are "YARA" rules. (Article archived here.)

#Signatures are generally non-interoperable.

There is some licensing going on, but generally, I'd say AV-vendors all have their own engines, and these engines may not be even able to understand the signatures/rulesets of other engines.

Having people on staff (maybe even around the clock) that can extract useful signatures from a set/family of malware is expensive. So the individual signatures are prized intellectual property.

It's for the same reason, that the actual on-disk-format of how a signature is constructed is something that is generally kept secret for commercial AV-software. (Correct me if I'm wrong.)

On the other hand, there are documented several Open-Source approaches for AV-signatures. One of the more known ones are "YARA" rules. (Article archived here.)

Signatures are generally non-interoperable.

There is some licensing going on, but generally, I'd say AV-vendors all have their own engines, and these engines may not be even able to understand the signatures/rulesets of other engines.

Having people on staff (maybe even around the clock) that can extract useful signatures from a set/family of malware is expensive. So the individual signatures are prized intellectual property.

It's for the same reason, that the actual on-disk-format of how a signature is constructed is something that is generally kept secret for commercial AV-software. (Correct me if I'm wrong.)

On the other hand, there are documented several Open-Source approaches for AV-signatures. One of the more known ones are "YARA" rules. (Article archived here.)

Source Link
StackzOfZtuff
  • 18.2k
  • 1
  • 54
  • 86

#Signatures are generally non-interoperable.

There is some licensing going on, but generally, I'd say AV-vendors all have their own engines, and these engines may not be even able to understand the signatures/rulesets of other engines.

Having people on staff (maybe even around the clock) that can extract useful signatures from a set/family of malware is expensive. So the individual signatures are prized intellectual property.

It's for the same reason, that the actual on-disk-format of how a signature is constructed is something that is generally kept secret for commercial AV-software. (Correct me if I'm wrong.)

On the other hand, there are documented several Open-Source approaches for AV-signatures. One of the more known ones are "YARA" rules. (Article archived here.)