Conference Paper

The Parallel Sieve Method for a Virus Scanning Engine

Kyushu Inst. of Technol., Japan
DOI: 10.1109/DSD.2009.208 Conference: Digital System Design, Architectures, Methods and Tools, 2009. DSD '09. 12th Euromicro Conference on
Source: IEEE Xplore


This paper shows a new architecture for a virus scanning system, which is different from that of an intrusion detection system. The proposed method uses two-stage matching: In the first stage, a hardware filter quickly scans the text to find partial matches, and in the second stage, the MPU scans the text to find a total match in the ClamAV 514,287 virus pattern set. To make the hardware filter simple, we use a finite-input memory machine (FIMM). To reduce the memory size of the FIMM, we introduce the parallel sieve method. The proposed method is memorybased, so it is quickly reconfigurable and dissipates lower power than a TCAM-based method. The system is implemented on the Stratix III FPGA with three off-chip SRAMs and an SDRAM, where all ClamAV 514,287 virus patterns are stored. Compared with existing methods, our method achieves 1.41-31.36 times more efficient area-throughput ratio.

Download full-text


Available from: Hiroki Nakahara, Jul 03, 2014
  • Source
    • "This paper surveys new methods to design memory-based pattern matching circuits [1], [3], [4], [5], [6]. Due to the page limitation, all the proofs are omitted. "
    [Show abstract] [Hide abstract]
    ABSTRACT: This survey first introduces index generation functions, which are useful for pattern matching in the communication circuit. Then, it shows various methods to realize index generation functions by using LUTs and memories. These methods are useful to design FPGAs with embedded memories.
    Communications and Information Technologies (ISCIT), 2010 International Symposium on; 11/2010
  • Source
    • "By increasing the number of IGU's, we have the parallel sieve method shown in Fig. 5.3. This method is especially useful when the number of the registered vectors is very large [5]. "
    [Show abstract] [Hide abstract]
    ABSTRACT: This paper considers a method to realize index generation functions. The parallel sieve method developed by the authors efficiently implements an index generation function. Unfortunately, it requires many Index Generation Units (IGUs) with different sizes. This paper shows a design method that requires only four IGUs with the same size. The presented architecture can be used as a low-power content addressable memory (CAM).
  • Source
    [Show abstract] [Hide abstract]
    ABSTRACT: This paper shows a method to reduce the number of input variables to represent incompletely specified index generation functions. A compound variable is generated by EXORing the original input variables. By using both original and compound variables, incompletely specified index generation functions can be represented by fewer variables. As a means to select variables, a heuristic method using information gains is presented. We compare representing random functions using 1. only original variables, and 2. both original and compound variables. Experimental results show that the use of compound variables effectively reduces the number of input variables.
    Digital System Design, Architectures, Methods and Tools, 2009. DSD '09. 12th Euromicro Conference on; 09/2009
Show more