BASS - BASS Automated Signature Synthesizer
Summary: Cisco Talos released BASS, an open source framework that automatically generates ClamAV antivirus signatures from previously clustered malware samples, announced at REcon 2017 in Montreal. Talos cites ClamAV's database growing by about 560,000 signatures between February and April 2017, roughly 9,500 daily, most of them hash-based signatures that each match only a single file.
Bottom line: At 9,500 new signatures a day, a signature database that only matches one file per hash drives memory footprint and analyst workload up with every sample; BASS aims to shift that volume toward pattern-based signatures that cover whole clusters, though Talos notes it does not work well on file infectors or backdoors.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026