A low-cost and high-performance virus scanning engine using a binary CAM emulator and an MPU

Authors:
Hiroki Nakahara;Tsutomu Sasao;Munehiro Matsuura
Affiliations:
Kagoshima University, Japan;Kyushu Institute of Technology, Japan;Kyushu Institute of Technology, Japan
Venue:
ARC'12 Proceedings of the 8th international conference on Reconfigurable Computing: architectures, tools and applications
Year:
2012

Citing 10
Cited 0

Switching and Finite Automata Theory: Computer Science Series

Switching and Finite Automata Theory: Computer Science Series
A Dynamically Reconfigurable FPGA-Based Content Addressable Memory for Internet Protocol Characterization

FPL '00 Proceedings of the The Roadmap to Reconfigurable Computing, 10th International Workshop on Field-Programmable Logic and Applications
Gigabit Rate Packet Pattern-Matching Using TCAM

ICNP '04 Proceedings of the 12th IEEE International Conference on Network Protocols
An Efficient Content-Addressable Memory Implementation Using Dynamic Routing

FCCM '01 Proceedings of the the 9th Annual IEEE Symposium on Field-Programmable Custom Computing Machines
A High Throughput String Matching Architecture for Intrusion Detection and Prevention

Proceedings of the 32nd annual international symposium on Computer Architecture
An Implementation of an Address Generator Using Hash Memories

DSD '07 Proceedings of the 10th Euromicro Conference on Digital System Design Architectures, Methods and Tools
Curing regular expressions matching algorithms from insomnia, amnesia, and acalculia

Proceedings of the 3rd ACM/IEEE Symposium on Architecture for networking and communications systems
PERG-Rx: a hardware pattern-matching engine supporting limited regular expressions

Proceedings of the ACM/SIGDA international symposium on Field programmable gate arrays
The Parallel Sieve Method for a Virus Scanning Engine

DSD '09 Proceedings of the 2009 12th Euromicro Conference on Digital System Design, Architectures, Methods and Tools
Memory-Based Logic Synthesis

Memory-Based Logic Synthesis

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper shows a virus scanning engine using two-stage matching. In the first stage, a binary CAM emulator quickly detects a part of the virus pattern, while in the second stage, the MPU detects the full length of the virus pattern. The binary CAM emulator is realized by four index generation units (IGUs). The proposed system uses four off chip SRAMs and a small FPGA. Thus, the cost and the power consumption are lower than the TCAM-based system. The system loaded 1,290,617 ClamAV virus patterns. As for the area and throughput, this system outperforms existing FPGA-based implementations.