2

I have thought of creating simple anti-virus. I have read some article and they said that the there is a two way of detection.

The virus dictionary signature searching is the one method. So I have chosen this method for the simple implementation.

From this, I have understood that we have to search the virus signature with the file.

What is the difference between file signature and virus signature?

If I have saved a virus file where the virus signature will be stored in the file.

How to match the virus signature pattern with the file signature?

If there is any sample code to explain, would be better for me to understand.

Some virus signatures links. How to write code for this signatures? http://www.nlnetlabs.nl/downloads/antivirus/antivirus/virussignatures.strings

http://codes-sources.commentcamarche.net/source/21418-antivirus-2004

http://www.clamav.net/

Improve this question

1 Answer 1

Reset to default
3

There is no such thing as a virus signature stored in the file. Creating the signature of a virus is a process which is using various properties of the malicious file to get the signature value. In the easiest case this might just be some hash like MD5 of the file. But one can also have more intelligent signatures which for example skip parts of the file which are irrelevant for the functionality of the virus or include structured information of the PE header or similar into the signature. How the signature of a virus file gets computed depends on the intelligence on the AV engine and is usually proprietary information.

As for the file signature: There are various forms of file signatures but in the context of AV it is probably computing the signature of an unknown file the same way as computing the signature of a malicious file and then checking if the file signature matches any of the known signatures for malicious files. If this is the case the unknown file is probably malicious too. But how certain this information is depends on how the signature was computed.

Improve this answer
6
  • Thanks for the info. I have updated some virus signature with my question. I can understand in theoretical level. When comes to implementation, I don't know how to start.. Here where i stuck is i don't know how to do that is you mentioned "probably computing the signature of an unknown file the same way as computing the signature of a malicious file and then checking if the file signature matches any of the known signatures for malicious files".
    – Jeeva Jsb
    Mar 16, 2017 at 17:19
  • 1
    @JeevaJsb: There is no such thing as a universal virus signature. As I said the simplest case is just use a hash which helps you to find the exact same malware file. More advanced signatures need way more understanding of how malware works, format of executable files etc. To explain all of this here would be too broad. Since ClamAV is open source: just take a look at how it works to have one possible implementation.
    – Steffen Ullrich
    Mar 16, 2017 at 17:37
  • Thanks you so much. Then based on your comment I understood that each antivirus will have different signature database based on their need.
    – Jeeva Jsb
    Mar 17, 2017 at 5:39
  • 1
    @JeevaJsb: exactly that's the case. The signatures usually can not be exchanged between different AV engines.
    – Steffen Ullrich
    Mar 17, 2017 at 5:45
  • 1
    @JeevaJsb: collecting the known malware would be a start only. You have to understand what really makes up the malicious part of a malware so that you can not only find known malware in their exact form but modifications of it. And you have to do research how potentially malicious files behave and look like and how to distinguish these from benign files. Not an easy task and again, far too broad to answer it here fully. Again, look at existing AV engines like ClamAV which is open source to learn more.
    – Steffen Ullrich
    Mar 17, 2017 at 5:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .