Aho-Corasick-Malware-Scanner - GitLite

KO | EN

gitlite — search

#rag #data-science #awesome #react-native #pytorch #generative-ai #c #markdown #http #cli

Aho-Corasick-Malware-Scanner

(★ 31)

This example implements an optimized antivirus scanner in Python using the Aho-Corasick automaton. It combines signature matching with a Tkinter interface, extension-based filtering, and progress reporting, scanning the header and footer of files for efficiency. The implementation is part of the 127 algorithms collection.

파일 탐색기

ZIP 다운로드

- anti-malware.png
- book-figure.png
- screen-shot.png
- scut-antivirus.png
- scut-av-logo.png
- -
- High speed - Malware scanner.py
- main.db
LICENSE
README.md

# CDN으로 사용하기

jsDelivr

jsDelivr는 공개 GitHub 리포지토리를 별도 설정 없이 CDN으로 즉시 서빙합니다. 버전과 파일을 고르면 웹페이지에 바로 붙일 수 있는 링크와 예시 코드가 만들어집니다.

버전

파일

링크

예시

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Ex. (49) - <strong>Optimized Malware Scanner with extension filters and specific content search</strong> is presented here in Python. This version of the hex-signature scanner integrates the Aho-Corasick multi-pattern matcher with an interactive graphical interface, extension-based filtering, and progress reporting, making the scan process both efficient and user-friendly. This code sample is one entry in a suite of 127 algorithms set out in <i><a href="https://github.com/Gagniuc/Antivirus-Engines">Antivirus Engines: From Methods to Innovations, Design, and Applications</a></i> (Elsevier Syngress, 2024).

***

The <code>main.db</code> signature file can be extended with new entries extracted manually using the <i><a href="https://github.com/Gagniuc/Hexadecimal-Signature-Extractor-for-Aho-Corasick">Hexadecimal Signature Extractor</a></i>. This utility quickly retrieves the first bytes of files and converts them into aligned hexadecimal format, ready to be added directly into the signature database used by the Aho-Corasick algorithm.

***

> **Note:** This project is closely related to other applications in the same suite.  
> You may also want to check out:  
> - [Aho-Corasick Native Malware Scanner](https://github.com/Gagniuc/Aho-Corasick-Native-Malware-Scanner)  
> - [Hexadecimal Signature Extractor for Aho-Corasick](https://github.com/Gagniuc/Hexadecimal-Signature-Extractor-for-Aho-Corasick)

In this version of the hex-signature scanner, the implementation uses the Aho-Corasick automaton (<i>ahocorasick</i>) to load and match malware signatures efficiently. The <i>l</i> function builds the automaton from a signature file and returns both the matcher and the total count of loaded signatures, which is shown immediately in the GUI (“Total Signatures Loaded: <i>c</i>”). Scanning has been refined to examine only the first and last 1024 bytes of each file (header and footer), where malicious code is often embedded; the <i>q</i> function reports a match as soon as a signature is detected. The graphical interface (Tkinter) now includes a progress bar, a live results pane, a summary label, and an editable entry where users specify the file extensions to include (e.g., “.exe,.dll,.docx”). The “Browse Folder and Scan” action remains disabled until a signature set is loaded (i.e. main.db, ~30k of malware signatures), and message boxes guide the workflow (e.g., prompting to load signatures or enter extensions). After scanning, a concise summary reports the number of infected and clean files, providing immediate, user-friendly feedback while improving overall scanning performance.

## Implementation in Python

```python
import os
import ahocorasick
import tkinter as t
from tkinter import filedialog as f, scrolledtext as s, ttk as k, messagebox as m

def l(sf):
    a = ahocorasick.Automaton()
    c = 0
    with open(sf, 'r') as x:
        for y in x:
            p = y.strip().split('=')
            if len(p) == 2:
                c += 1
                n, h = p
                a.add_word(h, (n,))
    a.make_automaton()
    return a, c

def q(fp, a):
    try:
        with open(fp, 'rb') as x:
            d = x.read()
            h = d[:1024].hex()
            ftr = d[-1024:].hex()
            for z in [h, ftr]:
                for j, sgn in a.iter(z):
                    return True, f"File: {fp}\nMalicious! ^\nSignature found: {sgn}\n"
            return False, f"File: {fp}\nAppears to be clean!\n"
    except Exception as e:
        return False, f"File: {fp}\nStatus: Error processing file - {e}\n"

def r():
    a = None
    c = 0

R = t.Tk()
    R.title('A HEX Signature Scanner (Gagniuc - Scut AV)')

def L():
        nonlocal a, c
        sf = f.askopenfilename(
            title="Select Signature File",
            filetypes=(("Text files", "*.db"), ("All files", "*.*"))
        )
        if sf:
            a, c = l(sf)
            B2.config(state=t.NORMAL)  # Schimbat aici!
            D.config(text=f"Total Signatures Loaded: {c}")

def Q():
        nonlocal a
        if not a:
            m.showinfo("Information", "Load a signature file before scanning.")
            return

x = {z.strip() for z in G.get().split(',')}
        if not x:
            m.showinfo("Information", "Enter file extensions to scan.")
            return

y = f.askdirectory()
        if y:
            H.delete(1.0, t.END)
            F = []
            for X, _, Y in os.walk(y):
                F.extend(os.path.join(X, z) for z in Y if any(z.endswith(e) for e in x))
            I['maximum'] = len(F)
            ic = 0
            cc = 0
            for fp in F:
                inf, res = q(fp, a)
                H.insert(t.END, f"{res}\n")
                H.update_idletasks()
                I['value'] += 1
                I.update_idletasks()
                if inf:
                    ic += 1
                else:
                    cc += 1
            J.config(text=f"Scan Summary: {ic} Infected, {cc} Clean")

B = t.Button(R, text="Load Signature", command=L)
    B.pack(pady=10)

D = t.Label(R, text="Total Signatures Loaded: 0")
    D.pack(pady=10)

G = t.Entry(R)
    G.pack(pady=10)
    G.insert(0, ".exe,.dll,.docx")

B2 = t.Button(R,
                  text="Browse Folder and Scan",
                  command=Q,
                  state=t.DISABLED)
    B2.pack(pady=10)

I = k.Progressbar(R,
                     orient="horizontal",
                     length=300,
                     mode="determinate")
    I.pack(pady=10)

J = t.Label(R, text="Scan Summary: Not started")
    J.pack(pady=10)

H = s.ScrolledText(R,
                      wrap=t.WORD,
                      width=80,
                      height=20)
    H.pack(pady=10, padx=10)

R.mainloop()

if __name__ == "__main__":
    r()
```

```text
Output:

File: C:/Users/Paul/Desktop/C\BRAVOS.exe
Appears to be clean!

File: C:/Users/Paul/Desktop/C\de_ce_nu.dll
Appears to be clean!

File: C:/Users/Paul/Desktop/C\LaboratorATMClar.exe
Appears to be clean!

File: C:/Users/Paul/Desktop/C\LaboratorATMCript.exe
Appears to be clean!

File: C:/Users/Paul/Desktop/C\test 1.exe
Appears to be clean!

File: C:/Users/Paul/Desktop/C\test2.exe
Appears to be clean!

File: C:/Users/Paul/Desktop/C\test3.exe
Appears to be clean!
```

<div align="center">
    <a href="https://github.com/Gagniuc/Antivirus-Engines">
      <kbd>
        <img src="https://github.com/Gagniuc/Aho-Corasick-Malware-Scanner/blob/main/img/screen-shot.png" alt="Malware scanner | Hexadecimal signatures">
      </kbd>
    </a>
</div>

<hr>

<details>
 <summary>Original book demonstration [+]</summary>
    <div align="center">
        <a href="https://github.com/Gagniuc/Antivirus-Engines">
          <kbd>
            <img src="https://github.com/Gagniuc/Aho-Corasick-Malware-Scanner/blob/main/img/book-figure.png" width="600" alt="Malware scanner | Hexadecimal signatures">
          </kbd>
        </a>
    </div>
</details>

## References

- <i>Paul A. Gagniuc. Antivirus Engines: From Methods to Innovations, Design, and Applications. Cambridge, MA: Elsevier Syngress, 2024. pp. 1-656.</i>

***

<img src="https://github.com/Gagniuc/Aho-Corasick-Malware-Scanner/blob/main/img/anti-malware.png" alt="Gagniuc | Scut Antivirus">