I’ve found some codes and AntiViruses which use multiple Antivirus’s engines in their products. Like https://github.com/joxeankoret/multiav and some other code or products.
How?
and What about License?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityI’ve found some codes and AntiViruses which use multiple Antivirus’s engines in their products. Like https://github.com/joxeankoret/multiav and some other code or products.
How?
and What about License?
There is typically no reason for programs not to interact when the programs offer some sort of API - in the case of the linked product, it answers your
how?
In the readme:
It uses, with the only exception of ClamAV, the command line AV scanners and extracts the malware names from the output of the command line tools (for ClamAV it uses the https://code.google.com/p/pyclamd/ extension).
As you asked for an actual example: let’s say a anti virus solution has a CLI that works like this:
av file
returns either ok
or bad
.
A program can now call av file
, for example via a system
call and read the output of that CLI, then decide with a string matching on ok
or bad
to decide what to present to the user for this particular file for this anti virus.
This can be repeated for as much CLIs as supported.
As to the licensing: of course the supported AV solutions must be present and functional on the machine, leaving this to the user.
In an attempt to make this on-topic, I will highlight why it is useful to use different AV products on files.
As some examples on virus total show, individual anti virus solutions have vastly different results in identifying malicious files.
This for example comes from: