Hello, I just reviewed few multi-pattern string scanning algorithms. And there are many variants for multi-pattern for Boyer-Moore. I am curious if the one implemented in Clamav is Boyer-Moore-Horspool or the one taken from authors of GLIMPSE or Set-wise Boyer-Moore? or AC_BM proposed by Silicon Defence? Any hints?
> You can't get a BMOnly, because some signatures *require* the AC > matcher, such as any signature containing wildcards. OK, all signatures without wildcards(static signatures) are used by BM multi-pattern. The one with wildcards are used by AC. Is that rule? Or there are other factors as well? How much BM slow down scanner with signatures with wildcards? Did someone perform such analysis? Best Regards, Thanks in advance for answer, Tom _______________________________________________ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
