What is antivirus signature database?

Question

Anti-virus databases hold the data needed for a signature-based scanner to find and remove malicious code. The databases contain a series of virus signatures (or definitions), unique sequences of bytes specific to each piece of malicious code.

How do antivirus signatures work?

Antivirus products use signature-based detection in conjunction with a database. When scanning a computer, they'll search for footprints matching those of known malware. These malware footprints are stored in a database. Antivirus products essentially search for the footprints of known malware.

What a virus signature looks like?

A virus signature is a continuous sequence of bytes that is common for a certain malware sample. That means it's contained within the malware or the infected file and not in unaffected files. Nowadays, signatures are far from sufficient to detect malicious files.

What is database malware?

Malware infecting a database server can be a serious problem. The result may be loss of data, loss of access to the database, or loss of control of the database server's hardware. Protection against malware is typically provided by “virus protection” software running on firewalls and the servers themselves.

What does it mean to locate viruses via signature based methods?

This type of detection involves your antivirus having a predefined repository of static signatures (fingerprints) that represent known network threats. These threats are different from one another because of their unique coding.

Expert · Answer