A Virus Scanning Engine Using an MPU and an IGU Based on Row-Shift Decomposition

Hiroki NAKAHARA  Tsutomu SASAO  Munehiro MATSUURA  

IEICE TRANSACTIONS on Information and Systems   Vol.E96-D   No.8   pp.1667-1675
Publication Date: 2013/08/01
Online ISSN: 1745-1361
DOI: 10.1587/transinf.E96.D.1667
Print ISSN: 0916-8532
Type of Manuscript: Special Section PAPER (Special Section on Reconfigurable Systems)
Category: Application
pattern matching,  virus scanning,  index generation function,  CAM,  

Full Text: PDF>>
Buy this Article

This paper shows a virus scanning engine using two-stage matching. In the first stage, a binary CAM emulator quickly detects a part of the virus pattern, while in the second stage, the MPU detects the full length of the virus pattern. The binary CAM emulator is realized by an index generation unit (IGU) based on row-shift decomposition. The proposed system uses two off-chip SRAMs and a small FPGA. Thus, the cost and the power consumption are lower than the TCAM-based system. The system loaded 1,290,617 ClamAV virus patterns. As for the area and throughput, this system outperforms existing two-stage matching systems using FPGAs.