Signature - technical definition

In anti-virus software and intrusion detection systems (IDS), a pattern that the system looks for when scanning files or network traffic. This term should not be confused with a digital signature. Virus or worm signatures are increasingly hard to determine because malicious code has begun to use code-morphing techniques—such that each propagated new signature version looks somewhat different from that of the previous generation.

See Also: Anti-Virus Software; Intrusion Detection Systems (IDS); Polymorphic Virus; Virus; Worm.

Graham, R. Hacking Lexicon. [Online, 2001.] Robert Graham Website. http://www.linuxsecurity.com/resource_files/documentation/hacking-dict.html.

See Signature in Computer


(1) See digital signature.

(2) A pattern used for matching. Also called a "fingerprint" or "definition." For example, antivirus companies maintain a database that contains the virus code (the signature) of each of the known viruses. To detect a virus, the antivirus program looks for these code strings in executable programs. Spyware blockers that look for spyware and adware also use signature patterns.

An intrusion detection system also uses signatures, which are patterns that suggest an attack. For example, excessive logins that failed or the execution of certain programs.

(3) A unique number built into hardware or software for identification.

(4) A group of printed pages used in the construction of a book or booklet. Typically comprising 16 or 32 pages, signatures may also be 8, 12, 24, 48 or 64 pages long. The signature is printed on one large sheet of paper in a certain "imposition" order that, when cut and folded, results in the correct page sequence. The signatures are then bound together to make the final product.



Learn more about Signature

link/cite print suggestion box