AVs use signatures to identify malware which are often strings of bytes or regular expressions thought to be unique to that malware. Do reverse engineers select these signatures by hand or do they use an automated method? How do AV vendors know the signature they select won't result in false positives?


From what I know, both methods are used.

Signatures can be generated by automated programs that are fed malicious samples, and from there, extract strings, data, attributes, etc. that can be used to create automatically create a signature.

Also, researchers will often analyse new, unknown samples in order to search for unique strings, data, attributes, that can be used in order to create a signature. You can't really automatically release a signature for a brand new strain of malware if you have no idea of what it is first. However, since most malware share similar caracteristics, automated processes can be used to detect new samples.

You might want to take a look at Intezer, it does just that.


I'm sure that many Antivirus companies also have similar "in-house" products for this.

As for your other question, usually, signatures goes through QA before being released in production, specially if they're new signatures that have been built from scratch. Though from time to time, it is possible that a bad signature gets pushed via an update, and it can result in the deletion of legitimate file (ie: system files). It happened before, it still happens today and will most likely still happen in the future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.