Sophie is a daemon which uses 'libsavi' library from Sophos anti-virus vendor . On startup, Sophie initializes SAPI , loads virus patterns into memory, opens local UNIX domain socket, and waits for someone to connect and instructs it which path to scan. Since the database is loaded in RAM, scanning is very fast.