5 ms·

How We Built a Scalable Malware Detector

22 points by mxpxrocks10 11y ago

mxpxrocks10 11y ago
does anyone recommend any other clamav signature packs or different tools that could also be run (either free or commercial) that you'd recommend? A simple google search brings up some random stuff and I'm wondering if anyone's used anything they really like.
red0point 11y ago
>At first, we looked at services like VirusTotal and a few other open source options. But there was nothing that would run independent and download the file and scan quickly. VirusTotal is actually downloading the file from a URL independently and (from my experience) near - instantly scanning it. So why reinvent the wheel? (Plus, VirusTotal uses many scan engines to determine a result...)
- orf 11y ago
  Also I'm sceptical as to how good ClamAV is, I can't find any hard numbers (which isn't a good sign).
  - mxpxrocks10 11y ago
    Yeah. One interesting thing could be for us to run some numbers and post them. It would be relatively trivial with this setup. Can you recommend or point out other engines? Thanks for the response.
- mxpxrocks10 11y ago
  Good points. I think unless you use their API you can only upload. I think there might be a file size limit too. One thing I didn't realize is it looks like google owns or sponsors the site. I think the samples they collect are interesting and valuable. If you have any other ideas or thoughts keep this thread going and I'll respond. Thanks for the feedback.
SirFatty 11y ago
yeah, but it's an awesome name. It can be used to eliminate STDs in women.
- dang 11y ago
  Please don't post unsubstantive comments to Hacker News. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html We detached this comment from https://news.ycombinator.com/item?id=10280685 https://news.ycombinator.com/item?id=10280685 and marked it off-topic.
- deleted 11y ago
  [deleted]
codeinchaos 11y ago
very cool, proud to be hosting your API on The Mashape Marketplace :)

22 points by mxpxrocks10 11y ago

does anyone recommend any other clamav signature packs or different tools that could also be run (either free or commercial) that you'd recommend? A simple google search brings up some random stuff and I'm wondering if anyone's used anything they really like.

red0point 11y ago

>At first, we looked at services like VirusTotal and a few other open source options. But there was nothing that would run independent and download the file and scan quickly. VirusTotal is actually downloading the file from a URL independently and (from my experience) near - instantly scanning it. So why reinvent the wheel? (Plus, VirusTotal uses many scan engines to determine a result...)

orf 11y ago
Also I'm sceptical as to how good ClamAV is, I can't find any hard numbers (which isn't a good sign).
- mxpxrocks10 11y ago
  Yeah. One interesting thing could be for us to run some numbers and post them. It would be relatively trivial with this setup. Can you recommend or point out other engines? Thanks for the response.
mxpxrocks10 11y ago
Good points. I think unless you use their API you can only upload. I think there might be a file size limit too. One thing I didn't realize is it looks like google owns or sponsors the site. I think the samples they collect are interesting and valuable. If you have any other ideas or thoughts keep this thread going and I'll respond. Thanks for the feedback.

SirFatty 11y ago

yeah, but it's an awesome name. It can be used to eliminate STDs in women.

dang 11y ago
Please don't post unsubstantive comments to Hacker News. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html We detached this comment from https://news.ycombinator.com/item?id=10280685 https://news.ycombinator.com/item?id=10280685 and marked it off-topic.
deleted 11y ago
[deleted]

codeinchaos 11y ago

very cool, proud to be hosting your API on The Mashape Marketplace :)