Use multiple AntiVirus engine

Question

I’ve found some codes and AntiViruses which use multiple Antivirus’s engines in their products. Like https://github.com/joxeankoret/multiav and some other code or products.

How?

and What about License?

Answer 1

There is typically no reason for programs not to interact when the programs offer some sort of API - in the case of the linked product, it answers your

how?

In the readme:

It uses, with the only exception of ClamAV, the command line AV scanners and extracts the malware names from the output of the command line tools (for ClamAV it uses the https://code.google.com/p/pyclamd/ extension).

As you asked for an actual example: let’s say a anti virus solution has a CLI that works like this:

av file returns either ok or bad.

A program can now call av file, for example via a system call and read the output of that CLI, then decide with a string matching on ok or bad to decide what to present to the user for this particular file for this anti virus.

This can be repeated for as much CLIs as supported.

As to the licensing: of course the supported AV solutions must be present and functional on the machine, leaving this to the user.

In an attempt to make this on-topic, I will highlight why it is useful to use different AV products on files.

As some examples on virus total show, individual anti virus solutions have vastly different results in identifying malicious files.

This for example comes from:

• different paces and update cycles of different vendors due to different office hours and analysis priorities
• different approaches to heuristics and sandboxing.
• different niches, one might find windows malware, one might find Mac malware.