Next: Threads
Up: Technicals
Previous: Security
Scan engine
New versions of Clam AntiVirus are using a mutation of Aho-Corasic
pattern matching algorithm. This algorithm uses a finite state pattern
matching automaton [1]. The algorithm itself is a generalization of
the Knuth-Morris-Pratt algorithm. Please look at matcher.h for data
type definitions. The automaton is represented by the trie. Trie is
a rooted tree with some specific properties [2]. Each node
of the trie represents some state of the automaton. In the implementation,
the node is defined as following:
struct node {
int islast;
struct patt *list;
int maxpatlen;
struct node *next[NUM_CHILDS], *trans[NUM_CHILDS], *fail;
};
[To be continued...]
Tomasz Kojm
2002-10-09