Aho-Corasick-Native-Malware-Scanner

KO | EN

gitlite — search

#python #react #go #android #deep-learning #linux #nodejs #java #windows #cli #kubernetes #pytorch #security #ios

Aho-Corasick-Native-Malware-Scanner

(★ 12)

This example presents a native antivirus scanner in Python with a self-contained Aho-Corasick implementation. It removes external dependencies, adds visual position markers for detected signatures, and measures scan performance through a Tkinter interface. The implementation is part of the 127 algorithms collection.

Aho-Corasick-Native-Malware-Scanner Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Aho-Corasick Malware Scanner (native)

Ex. (52) - <strong>Native antivirus scanner with visual position markers and speed measurement</strong> appears here in Python. This implementation replaces external libraries with a self-contained version of the <i>Aho-Corasick</i> algorithm, 
adds position indicators for detected signatures, and measures scan performance. This code sample is one entry in a suite of 127 algorithms set out in <i><a href="https://github.com/Gagniuc/Antivirus-Engines">Antivirus Engines: From Methods to Innovations, Design, and Applications</a></i> (Elsevier Syngress, 2024).

***

The <code>main.db</code> signature file can be extended with new entries extracted manually using the <i><a href="https://github.com/Gagniuc/Hexadecimal-Signature-Extractor-for-Aho-Corasick">Hexadecimal Signature Extractor</a></i>. This utility quickly retrieves the first bytes of files and converts them into aligned hexadecimal format, ready to be added directly into the signature database used by the Aho-Corasick algorithm.

***

> **Note:** This project is part of a complementary toolkit.  
> You may also want to check out:  
> - [Optimized HEX Signature Scanner](https://github.com/Gagniuc/Aho-Corasick-Native-Malware-Scanner)  
> - [Hexadecimal Signature Extractor for Aho–Corasick](https://github.com/Gagniuc/Hexadecimal-Signature-Extractor-for-Aho-Corasick)

This version of the hex signature scanner introduces a complete native implementation of the <i>Aho-Corasick</i> algorithm, eliminating the dependency on external libraries. The core elements include the <code>N</code> class, which defines trie nodes for storing child links, outputs, and failure links, and the associated functions for building the trie, establishing failure links, and performing the actual pattern matching. The <code>e</code> function loads the malware signatures (i.e. main.db; ~30k of malware signatures), constructs the trie, and prepares it for scanning. The scanning process (<code>h</code>) now examines both the header and footer of each file (default 1024 bytes from each end), converting the data into hexadecimal form and searching for signatures with the native matcher. When a match is found, the scanner not only reports the file as malicious but also calculates the approximate position of the signature relative to the scanned region. This is visually represented through the <code>j</code> function, which creates a simple marker line with a <code>+</code> symbol to indicate the detected offset within the scanned block. The graphical user interface (Tkinter) provides controls for loading signature databases, entering file extensions to scan, and browsing folders. A progress bar tracks the overall scan progress, while the results panel displays file-by-file outcomes along with position markers. The scan summary reports the number of infected and clean files as well as the total elapsed time, giving both efficiency feedback and performance measurement. This implementation reflects a shift toward a self-contained and transparent pattern-matching system, where the algorithm itself is visible and modifiable within the source code. It offers deeper insight into the mechanics of signature scanning, adds interactive visual indicators, and maintains the user-friendly interface established in earlier versions.

## Native implementation in Python

```python
import os
import tkinter as t
from tkinter import filedialog as f, scrolledtext as s, ttk as k, messagebox as m
import time

class N:
    def __init__(a):
        a.c = {}
        a.o = []
        a.f = None

def b(p):
    r = N()
    for q in p:
        n = r
        for x in q:
            if x not in n.c:
                n.c[x] = N()
            n = n.c[x]
        n.o.append(q)
    return r

def a(y, r):
    z = []
    n = r
    for i, x in enumerate(y):
        while x not in n.c and n != r:
            n = n.f
        if x in n.c:
            n = n.c[x]
        for q in n.o:
            z.append((i - len(q) + 1, q))
    return z

def d(r):
    q = []
    for n in r.c.values():
        n.f = r
        q.append(n)
    while q:
        g = q.pop(0)
        for x, s in g.c.items():
            q.append(s)
            f_ = g.f
            while x not in f_.c and f_ != r:
                f_ = f_.f
            s.f = f_.c.get(x, r)

def e(sf):
    with open(sf, 'r') as u:
        p = [v.strip().split('=')[1] for v in u if '=' in v]
    r = b(p)
    d(r)
    return r, len(p)

def h(fp, r, w=1024):
    try:
        with open(fp, 'rb') as u:
            v = u.read(w)
            u.seek(-w, os.SEEK_END)
            v += u.read(w)
            y = v.hex()
            z = a(y, r)
            if z:
                f_, g_ = z[0]
                pos = f_ / (2 * len(v))
                return True, f"\nFile: {fp}\nMalicious! ^\nSignature: {g_}\nLocation:", pos
            return False, f"\nFile: {fp}\nClean file!\nLocation:", None
    except Exception as s:
        return False, f"\nFile: {fp}\nStatus: Error - {s}\n", None

def j(pos, w=40):
    if pos is None:
        return "-" * w
    q = int(w * pos)
    return "-" * q + "+" + "-" * (w - q - 1)

def l():
    A = None
    B = 0

C = t.Tk()
    C.title('Hex Signature Scanner (Gagniuc - Scut Antivirus)')

def L():
        nonlocal A, B
        sf = f.askopenfilename(
            title="Select Signature File",
            filetypes=(("Text files", "*.db"), ("All files", "*.*"))
        )
        if sf:
            A, B = e(sf)
            M.config(state=t.NORMAL)
            D.config(text=f"Total Sig: {B}")

def Q():
        nonlocal A
        if not A:
            m.showinfo("Information", "Load signature file")
            return

x = {y.strip() for y in G.get().split(',')}
        if not x:
            m.showinfo("Information", "Extensions to scan")
            return

y = f.askdirectory()
        if y:
            I.delete(1.0, t.END)
            F = []
            for R, _, S in os.walk(y):
                F.extend(
                    os.path.join(R, u)
                    for u in S
                    if any(u.endswith(z) for z in x)
                )
            H['maximum'] = len(F)
            ic = 0
            cc = 0
            start = time.time()
            for fp in F:
                inf, res, pos = h(fp, A)
                gp = j(pos)
                I.insert(t.END, f"{res} [{gp}]\n")
                I.update_idletasks()
                H['value'] += 1
                H.update_idletasks()
                if inf:
                    ic += 1
                else:
                    cc += 1
            end = time.time()
            elapsed = end - start
            J.config(
                text=f"Scan Summary: {ic} Infected, {cc} Clean. Time Elapsed: {elapsed:.2f} sec"
            )

K = t.Button(C, text="Load Signature", command=L)
    K.pack(pady=10)

D = t.Label(C, text="Total Signatures: 0")
    D.pack(pady=10)

G = t.Entry(C)
    G.pack(pady=10)
    G.insert(0, ".exe,.dll,.docx")

M = t.Button(C,
                 text="Browse Folder and Scan",
                 command=Q,
                 state=t.DISABLED)
    M.pack(pady=10)

H = k.Progressbar(C,
                     orient="horizontal",
                     length=300,
                     mode="determinate")
    H.pack(pady=10)

J = t.Label(C, text="Scan summary: Not started")
    J.pack(pady=10)

I = s.ScrolledText(C,
                       wrap=t.WORD,
                       width=80,
                       height=20)
    I.pack(pady=10, padx=10)

C.mainloop()

if __name__ == "__main__":
    l()
```

```text
Output:

File: C:/Users/Paul/Desktop/C\BRAVOS.exe
Clean file!
Location: [----------------------------------------]

File: C:/Users/Paul/Desktop/C\de_ce_nu.dll
Clean file!
Location: [----------------------------------------]

File: C:/Users/Paul/Desktop/C\LaboratorATMClar.exe
Clean file!
Location: [----------------------------------------]

File: C:/Users/Paul/Desktop/C\LaboratorATMCript.exe
Clean file!
Location: [----------------------------------------]

File: C:/Users/Paul/Desktop/C\test 1.exe
Clean file!
Location: [----------------------------------------]

File: C:/Users/Paul/Desktop/C\test2.exe
Clean file!
Location: [----------------------------------------]

File: C:/Users/Paul/Desktop/C\test3.exe
Clean file!
Location: [----------------------------------------]
```

<hr>

<details>
 <summary>Original book demonstration [+]</summary>
    <div align="center">
        <a href="https://github.com/Gagniuc/Antivirus-Engines">
          <kbd>
            <img src="https://github.com/Gagniuc/Aho-Corasick-Native-Malware-Scanner/blob/main/img/book-figure.png" width="600" alt="Malware scanner | Hexadecimal signatures">
          </kbd>
        </a>
    </div>
</details>

## References

- <i>Paul A. Gagniuc. Antivirus Engines: From Methods to Innovations, Design, and Applications. Cambridge, MA: Elsevier Syngress, 2024. pp. 1-656.</i>

***

Aho-Corasick-Native-Malware-Scanner

Aho-Corasick-Native-Malware-Scanner Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Aho-Corasick-Native-Malware-Scanner

Aho-Corasick-Native-Malware-Scanner Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README