Please enumerate an example of an attack that cannot be detected by a Snort rule, even though you try to write a new rule. Why can it not be detected by a rule? ClamAV claims a very large signature...

Please enumerate an example of an attack that cannot be detected by a Snort rule, even though you try to write a new rule. Why can it not be detected by a rule?

ClamAV claims a very large signature set (larger than 500,000). Are there really so many viruses in the wild, i.e., on the Internet? What are possible reasons that so many signatures are needed?