next up previous
Next: Threads Up: Technicals Previous: Security


Scan engine

New versions of Clam AntiVirus are using a mutation of Aho-Corasic pattern matching algorithm. This algorithm uses a finite state pattern matching automaton [1]. The algorithm itself is a generalization of the Knuth-Morris-Pratt algorithm. Please look at matcher.h for data type definitions. The automaton is represented by the trie. Trie is a rooted tree with some specific properties [2]. Each node of the trie represents some state of the automaton. In the implementation, the node is defined as following:
	struct node {
	    int islast;
	    struct patt *list;
	    int maxpatlen;
	    struct node *next[NUM_CHILDS], *trans[NUM_CHILDS], *fail;
	};
[To be continued...]



Tomasz Kojm 2002-11-21