← Back
Home › Systems › Security and identity

antivirus

signature and heuristic malware scanner

ClamAV, YARA

SystemTechniques · 9Primitives · 41 antivirus Binary delta diffcompression · medium: Bsdiff, VCDIFF and xdelta-style binary patches between file versionsGradient-boosted decision trees (GB…machine-learning · medium: Add small regression trees one at a time, each fitted to the loss gradient; histogram splits over 256 bins make it the strongest tabular default.›Linear-time regular expression matc…search-sort · medium: Match a regular expression in O(pattern x text) worst case by tracking all live parse positions at once, then cache the state sets as a lazily built DFA for speed.›Binary emulationsecurity · medium: Emulating CPU instructions in a sandbox to unpack and observe malware without running it nativelyCode signingsecurity · medium: Signing binaries/apps with certificate chains, entitlements, timestamping and notarizationProcess sandboxingsecurity · medium: Run risky work in a separate, deliberately powerless process and let a small privileged broker do the few things it needs, over a narrow pipe.›Yara rule matchingsecurity · medium: YARA-style rules: string patterns plus boolean conditions over files and memory, compiled to Aho-Corasick plus checksLZ77compression · low: Replace repeated byte strings with (distance, length) back-references into a sliding window; the parsing stage of gzip, LZ4, zstd, Brotli and xz.›Aho-Corasick multi-pattern matchingsearch-sort · low: Find all occurrences of many fixed patterns in one pass over the text, in time independent of the pattern count, using a trie with failure links.›SIMD substring searchsearch-sort · low: Find bytes or substrings by comparing 16-64 haystack positions per instruction against the needle's first and last byte, then verifying the rare candidates.›Cryptographic hashes (SHA-2, BLAKE3)security · low: Collision-resistant fingerprints of data; SHA-256 for interoperability, BLAKE3 for speed, HMAC/HKDF for keyed uses.›Executable formats elf pecompilers · low: ELF, PE and Mach-O: sections, segments, symbol tables, relocations, dynamic loadingHuffman codingcompression · low: Optimal prefix code with whole-bit codeword lengths; table-driven decoding at about one symbol per few cycles, the entropy stage of DEFLATE, JPEG and zstd literals.›Bloom filterdata-structures · low: Bit array answering "definitely not present" or "probably present" in about 10 bits per key for 1 % false positives; inserts are cheap, deletes impossible.›Fuzzy hashingsecurity · low: Similarity-preserving file hashes (ssdeep CTPH, TLSH) to find variants of known filesOs event tracingsecurity · low: OS telemetry sources for security agents: ETW, Endpoint Security, fanotify, audit, kernel callbacksDelta encodingcompression · low: Store differences between consecutive values instead of the values, turning sorted IDs, timestamps and counters into small numbers that pack into few bits.›Rolling hashdata-structures · low: Rabin-Karp polynomial rolling hashes and winnowing for substring fingerprints and document matchingSuffix arraysearch-sort · low: Sorted array of all suffix start positions of a text; finds every occurrence of any substring by binary search, at 4-5 bytes per text byte.›Quantile sketchesdata-structures · low: Mergeable quantile sketches: t-digest, DDSketch, HDR histogramsLoss functionsmachine-learning · low: The scalar a model minimizes: cross-entropy for classes and tokens, MSE or Huber for values, each with a stable form and simple gradient.›Regularizationmachine-learning · low: Techniques that trade training fit for generalization: weight decay, dropout, early stopping, label smoothing and data mixing, with the exact update rules and defaults.›Recursive-descent parsingcompilers · low: Hand-written top-down parser with one function per grammar rule; simple, fast, with full control over error messages and recovery.›+ 2 more techniques+ 25 more primitives

Similar systems

Share the most building blocks with this one.

edr 29 %anti-cheat 15 %