[zorp] About Virus Filtering Module

Hi there, I'm working on my graduate paper which is on enabling AAA in Linux box using the netfilter framework. So I'm very interested in Zorp's virus filtering. As I'm taking a look at the patch tree (which is from the official unofficial site), I'm wondering if I can write my own virus filtering module. Did any of you guys tried to do this before? I am curious in the performance when we 'trickle' the application protocols. -- Best regards, Zihui