I just reviewed few multi-pattern string scanning algorithms.
And there are many variants for multi-pattern for Boyer-Moore.
I am curious if the one implemented in Clamav is Boyer-Moore-Horspool
or the one taken from authors of GLIMPSE or Set-wise Boyer-Moore? or
AC_BM proposed by Silicon Defence?
Any hints?

> You can't get a BMOnly, because some signatures *require* the AC
> matcher, such as any signature containing wildcards.
OK, all signatures without wildcards(static signatures) are used by BM
The one with wildcards are used by AC. Is that rule? Or there are
other factors as well?

How much BM slow down scanner with signatures with wildcards? Did
someone perform such analysis?

Best Regards,
Thanks in advance for answer,
Please submit your patches to our Bugzilla: http://bugs.clamav.net

Reply via email to