4 ms·

I don't believe they use regular expressions.

• pmalynin 5y ago
  Why not? I.e. is that from experience on working on anti malware remediation systems?
  • eurasiantiger 5y ago
    What would it match against? ASCII strings? Add a whitelisted string and make your malware pass. The heuristics are much more complex than that, cf. spamassassin rules.
    • pwdisswordfish8 5y ago
      Opcode sequences. Regular expressions may be applied to any formal language, not just ones based on human-readable alphabets.
      • eurasiantiger 5y ago
        That kinda makes sense, thanks. However, wouldn’t this kind of heuristic be extremely simple to counter by obfuscating the machine code, e.g. by inserting complex noops and using threaded subroutines which individually look innocuous? Or, are this kind of techniques looking at known syscall patterns or something like that, and ignoring the general program flow? To me, regex doesn’t seem applicable to static analysis of machine code, but what do I know :)
        • dannyw 5y ago
          antiviruses are composed of multiple systems and techniques. Regexp is just one.
          • eurasiantiger 5y ago
            That also makes sense. Got any further reading?