On Wednesday, October 27, 2004, 10:07:59 AM, Jorge wrote: >>This will continue to grow I'm afraid --- though later versions will >>deal with the file directly at some point. All of the rules that are >>included in the rulebase file are live patterns that have seen recent >>activity. The system automatically removes anything below your rule >>strength threshold so that there are no inert rules in the system. >>This mechanism is one of the critical things we do with reported log >>files. >> >> JA> Just an idea. How about doing what AV do? I mean, you only get new JA> rulebases downloaded... Instad of downloading the whole 14mb, download JA> just the updates, which probably are a couple of hundred K. And once a JA> week or every two weebs, a whole rulebase can be downloaded that unifies JA> everything.
We will be moving toward this model eventually. Peers will also send updates to each other in response to collaborative detection mechanisms. One of the challenges here is that a significant amount of computing power is required to compile the folded token matrix that makes the engine fast. If only new rules are sent then the MTA would have to refold the matrix to compile the changes into the rulebase. Since MTAs are already heavily loaded in most cases this is not a trivial problem - it will require that the Message Sniffer daemon balance the work load of recompiling the rulebase without compromising the performance of the MTA. This can be done, but several things must happen first: * Message Sniffer must operate in a native daemon/service mode. This is slated for version 3.x stages of development. * Security mechanisms associated with peering and modularized updates must be tested and deployed. * The rulebase management system software must be re-written to impose versioning data on the rule base derivation engine. * A modular rulebase compiler engine and load tuning system must be created and tested to accept, compile, and test the incremental updates. --- All of these things are on the to-do list. It's all about resources. The faster we grow the faster we will be able to deploy the new features. Best, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
