5

Are virus signatures different between antiviruses?

For example, can a virus signature in Kaspersky differ from the signature associated to the same virus in Avast?

3

Yes, signatures vary as they are developed by the antivirus vendors independently of one another. One vendor's product may catch malware that another misses, or get a false positive that another would not find.

You may end up with multiple vendors having identical signatures for the same piece of malware because of malware's traits have few, or one signature options, but they are arrived at independently.

  • thanks, Database are vary , but signature for virus A in one antivirus differ from another? – Saja Jan 20 '16 at 8:52
  • They might do. Say the malware included the string Saja evil virus lkjhgfvcd. Manufacturer A might match on Saja evil, and manufacturer B might match on lkjhgfvcd. If there was another virus including the string Saja evil virus xcvbnm, A would pick it up, but B would miss it. Picking the right string is the hard bit! – Matthew Jan 20 '16 at 9:02
  • That's a good question @Saja, please see my edit. – GdD Jan 20 '16 at 9:16
  • you mean malware A in vendor A has hash (0009d99691e8eed99c7dd1500e07cda336d54260) and same malware may has another hash in another vendor for example it's hash in vendor B (00113d9802cca3deba19cf9daa17f1c2269de2b8)? – Saja Jan 20 '16 at 9:24
2

Some AV vendors reuse the signatures of anothers. For example Kaspersky Lab inserted the signatures of some non-malicious files into its bases to detect the reuses and after some time they have observed them falsely detected by some another companies' AVs as malicious.

1

Signatures are generally non-interoperable.

There is some licensing going on, but generally, I'd say AV-vendors all have their own engines, and these engines may not be even able to understand the signatures/rulesets of other engines.

Having people on staff (maybe even around the clock) that can extract useful signatures from a set/family of malware is expensive. So the individual signatures are prized intellectual property.

It's for the same reason, that the actual on-disk-format of how a signature is constructed is something that is generally kept secret for commercial AV-software. (Correct me if I'm wrong.)

On the other hand, there are documented several Open-Source approaches for AV-signatures. One of the more known ones are "YARA" rules. (Article archived here.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.