Training with sa-learn for viruses?

[Tilman Schmidt]

On 31.05.2017 16:56, Nikolaos Milas wrote:
> On 31/5/2017 1:28 μμ, Dominic Raferd wrote:
> 
>> For this you need an antivirus tool. Clamav in its standard form is
>> pretty useless IMHO but it is rather more effective with the
>> sanesecurity addon signatures.
> 
> I do have sanesecurity addon signatures. Would you happen to know if/how
> we can train clamav based on our actual messages?

ClamAV cannot be trained in the sense of the word. It is not Bayes or
neural network based.

You can create your own signatures. This is however not a trivial task.
A better approach would be to submit false negative and false positive
samples to ClamAV for inclusion in the next signature database update.

HTH
Tilman