sigforge: Signature Intelligence for Malware Defense
Self-contained HTML deck. Arrow keys, click, or swipe to navigate. A theme toggle lives in the top-right corner of the deck.
Overview
Every malware scanner is only as good as its signatures, and signatures are only as good as the pipeline that produces them. sigforge is that pipeline for Linux Malware Detect: nine stages that take raw samples from FTP feeds, MalwareBazaar, and URLhaus all the way to versioned signature packs on the CDN, with dedup, classification, format generation, and validation in between.
The interesting parts are the judgment calls. Classification is a six-stage cascade, first match wins: exact hash, ClamAV batch, YARA batch, fuzzy hash, heuristics, and finally LLM triage as the cost-tracked backstop for samples nothing else can name. Naming follows a strict platform.type.family taxonomy so a signature tells you what it caught before you open the file. And nothing ships until it passes four gates, ending with a scan of 142,000 known-benign files (WordPress, Joomla, Drupal core) where a single hit fails the release.
Distribution is the last mile: a canary/stable channel split with a percentage gate and per-IP pin overrides, so a bad signature burns a controlled slice of the fleet instead of all of it. The second half of the deck walks how LMD 2.x consumes the output: the 6-hour update cycle, the seven signature formats, and the benchmark numbers against ClamAV on a 6,002-sample corpus.
Key Takeaways
- Signature generation is a pipeline problem, not an authoring problem. Nine stages with atomic writes and O(1) dedup replace ad-hoc scripts and tribal knowledge.
- Classification cascades should be ordered by confidence and cost. Exact hash first, LLM triage last, and every result carries a confidence score into the taxonomy.
- A false-positive gate is non-negotiable. 142K benign core files from the CMSes the fleet actually runs, zero hits required, every release.
- One pipeline, seven output formats. hex, MD5, SHA-256, compound signatures, ClamAV NDB/HDB, and YARA all regenerate from the same classified corpus in a single pass.
- Staged rollout applies to signatures the same as code. Canary to stable with a percentage gate and per-IP pins turns a bad signature from an incident into a non-event.
- The payoff is measurable: 2.1x higher detection than ClamAV on the real-world corpus, from signatures sourced off production network-edge telemetry.