Conference Paper

The Parallel Sieve Method for a Virus Scanning Engine

Kyushu Inst. of Technol., Japan
DOI: 10.1109/DSD.2009.208 Conference: Digital System Design, Architectures, Methods and Tools, 2009. DSD '09. 12th Euromicro Conference on
Source: IEEE Xplore

ABSTRACT This paper shows a new architecture for a virus scanning system, which is different from that of an intrusion detection system. The proposed method uses two-stage matching: In the first stage, a hardware filter quickly scans the text to find partial matches, and in the second stage, the MPU scans the text to find a total match in the ClamAV 514,287 virus pattern set. To make the hardware filter simple, we use a finite-input memory machine (FIMM). To reduce the memory size of the FIMM, we introduce the parallel sieve method. The proposed method is memorybased, so it is quickly reconfigurable and dissipates lower power than a TCAM-based method. The system is implemented on the Stratix III FPGA with three off-chip SRAMs and an SDRAM, where all ClamAV 514,287 virus patterns are stored. Compared with existing methods, our method achieves 1.41-31.36 times more efficient area-throughput ratio.


Available from: Hiroki Nakahara, Jul 03, 2014
  • [Show abstract] [Hide abstract]
    ABSTRACT: This paper shows a virus scanning engine using two-stage matching. In the first stage, a binary CAM emulator quickly detects a part of the virus pattern, while in the second stage, the MPU detects the full length of the virus pattern. The binary CAM emulator is realized by four index generation units (IGUs). The proposed system uses four off chip SRAMs and a small FPGA. Thus, the cost and the power consumption are lower than the TCAM-based system. The system loaded 1,290,617 ClamAV virus patterns. As for the area and throughput, this system outperforms existing FPGA-based implementations.
    Proceedings of the 8th international conference on Reconfigurable Computing: architectures, tools and applications; 03/2012
  • Source
    [Show abstract] [Hide abstract]
    ABSTRACT: This survey first introduces index generation func- tions, which are useful for pattern matching in communication circuits. Then, it shows various methods to realize index gener- ation functions using memories. A linear transformation is used to reduce the number of variables and thus memory size. An extension to the multiple-valued case is also presented. I. INDEX GENERATION FUNCTION This paper surveys recent results on index generation func- tions. Applications of index generation functions include: IP address table lookup, packet filtering, terminal access con- trollers, memory patch circuits, virus scan circuits, fault maps for memory, and pattern matching. In addition, this paper introduces an index generation unit that efficiently realizes an index generation function by a linear circuit and a pair of smaller memories. Due to space limitations, definitions of standard terminology used in switching circuit theory (11) are omitted.
    Proceedings of The International Symposium on Multiple-Valued Logic 01/2011; DOI:10.1109/ISMVL.2011.17
  • Source
    [Show abstract] [Hide abstract]
    ABSTRACT: This paper considers a method to realize index generation functions. The parallel sieve method developed by the authors efficiently implements an index generation function. Unfortunately, it requires many Index Generation Units (IGUs) with different sizes. This paper shows a design method that requires only four IGUs with the same size. The presented architecture can be used as a low-power content addressable memory (CAM).