How do AV engines search files for known signatures so efficiently?

Asked 2013-05-04T18:26:49.373

Data in the form of search strings continue to grow as new virus variants are released, which prompts my question - how do AV engines search files for known signatures so efficiently? If I download a new file, my AV scanner rapidly identifies the file as being a threat or not, based on its signatures, but how can it do this so quickly? I'm sure by this point there are hundreds of thousands of signatures.

search antivirus

Edit Report

1 Answer

I don't know how a practical AV works. but I think the question have some relative with finding words in a long text with a given dictionary.

For the above question, data structures like TRIE will make it very fast. processing a Length=N text dictionary of K words takes only O(N) time.

answered 2013-05-04T18:38:05.377

How do AV engines search files for known signatures so efficiently?

1 Answer

Your Answer