6

Are virus signatures different between antiviruses?

For example, can a virus signature in Kaspersky differ from the signature associated to the same virus in Avast?

Improve this question

3 Answers 3

Reset to default
3

Yes, signatures vary as they are developed by the antivirus vendors independently of one another. One vendor's product may catch malware that another misses, or get a false positive that another would not find.

You may end up with multiple vendors having identical signatures for the same piece of malware because of malware's traits have few, or one signature options, but they are arrived at independently.

Improve this answer
4
  • thanks, Database are vary , but signature for virus A in one antivirus differ from another?
    – Saja
    Commented Jan 20, 2016 at 8:52
  • They might do. Say the malware included the string Saja evil virus lkjhgfvcd. Manufacturer A might match on Saja evil, and manufacturer B might match on lkjhgfvcd. If there was another virus including the string Saja evil virus xcvbnm, A would pick it up, but B would miss it. Picking the right string is the hard bit!
    – Matthew
    Commented Jan 20, 2016 at 9:02
  • That's a good question @Saja, please see my edit.
    – GdD
    Commented Jan 20, 2016 at 9:16
  • you mean malware A in vendor A has hash (0009d99691e8eed99c7dd1500e07cda336d54260) and same malware may has another hash in another vendor for example it's hash in vendor B (00113d9802cca3deba19cf9daa17f1c2269de2b8)?
    – Saja
    Commented Jan 20, 2016 at 9:24
3

Some AV vendors reuse the signatures of anothers. For example Kaspersky Lab inserted the signatures of some non-malicious files into its bases to detect the reuses and after some time they have observed them falsely detected by some another companies' AVs as malicious.

Improve this answer
1

Signatures are generally non-interoperable.

There is some licensing going on, but generally, I'd say AV-vendors all have their own engines, and these engines may not be even able to understand the signatures/rulesets of other engines.

Having people on staff (maybe even around the clock) that can extract useful signatures from a set/family of malware is expensive. So the individual signatures are prized intellectual property.

It's for the same reason, that the actual on-disk-format of how a signature is constructed is something that is generally kept secret for commercial AV-software. (Correct me if I'm wrong.)

On the other hand, there are documented several Open-Source approaches for AV-signatures. One of the more known ones are "YARA" rules. (Article archived here.)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .