{"repo":"Gagniuc/Aho-Corasick-Native-Malware-Scanner","free":true,"listed":false,"github":"https://github.com/Gagniuc/Aho-Corasick-Native-Malware-Scanner","clone":"git clone https://github.com/Gagniuc/Aho-Corasick-Native-Malware-Scanner.git","description":"This example presents a native antivirus scanner in Python with a self-contained Aho-Corasick implementation. It removes external dependencies, adds visual position markers for detected signatures, and measures scan performance through a Tkinter interface. The implementation is part of the 127 algorithms collection.","language":"Python","stars":13,"topics":["aho-corasick","antivirus","database","hexadecimal","malware","native","scanner","signature","bat","cmd"],"license":"MIT","category":"databases-storage","readme_excerpt":"Aho-Corasick Malware Scanner (native) Ex. (52) - Native antivirus scanner with visual position markers and speed measurement appears here in Python. This implementation replaces external libraries with a self-contained version of the Aho-Corasick algorithm, adds position indicators for detected signatures, and measures scan performance. This code sample is one entry in a suite of 127 algorithms set out in Antivirus Engines: From Methods to Innovations, Design, and Applications (Elsevier Syngress, 2024). The main.db signature file can be extended with new entries extracted manually using the Hexadecimal Signature Extractor . This utility quickly retrieves the first bytes of files and converts them into aligned hexadecimal format, ready to be added directly into the signature database used by the Aho-Corasick algorithm. Note: This project is part of a complementary toolkit. You may also want to check out: - Optimized HEX Signature Scanner - Hexadecimal Signature Extractor for Aho–Corasick This version of the hex signature scanner introduces a complete native implementation of the Aho-Corasick algorithm, eliminating the dependency on external libraries. The core elements include the N class, which defines trie nodes for storing child links, outputs, and failure links, and the associated functions for building the trie, establishing failure links, and performing the actual pattern matching. The e function loads the malware signatures (i.e. main.db; 30k of malware signatures), con","default_branch":null,"files":null,"tree":[],"storefront":"/r/Gagniuc","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/Gagniuc/Aho-Corasick-Native-Malware-Scanner/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}