A signature matching optimization policy for anti-virus programs

Abstract

Virus signature library is key factor for performance of anti-virus programs considering accuracy and scanning speed. To ensure coverage of various emerging viruses, the scale of signature library grows larger and the consequence is lower efficiency because of the need of matching against more signatures. This paper's target is to decrease the signature mapping cost by optimizing signature library. Taking advantage of common conduct characteristics of viruses such as self replica and seasoning, this paper proposed optimization policy against this scalable issue with help of data mining. The data simulation shows significant potential performance improvement using the proposed optimization policy.