Antivirus & Antispam Engines#

EFA-NG employs a hybrid multi-layer inspection stack to eliminate false negatives while minimizing false positives.

---

1. ClamAV 1.4+ with Unofficial Signatures#

ClamAV provides streaming signature inspection for zero-hour malware detection.

In addition to official Cisco Talos signatures, EFA-NG incorporates clamav-unofficial-sigs including:

SaneSecurity: Macro scripts, scam heuristics, PDF exploits.

Foxhole: Malicious Windows executables and disguised scripts.

YARA rules: Custom zero-day pattern detection.

To test ClamAV signature database updates:

bash

freshclam -v

---

SpamAssassin leverages rulesets, Bayesian probability engines, and distributed reputation networks.

Pyzor: Collaborative spam digest database.

Vipul's Razor 2: Collaborative hash-sharing network.

DCC (Distributed Checksum Clearinghouse): High-volume bulk mail detection.

bash

spamassassin -D --lint