A scalable high-performance virus detection processor against a large pattern set for embedded network security

Chieh Jen Cheng*, Chao Ching Wang, Wei Chun Ku, Tien-Fu Chen, Jinn Shyan Wang

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

7 Scopus citations

Abstract

Contemporary network security applications generally require the ability to perform powerful pattern matching to protect against attacks such as viruses and spam. Traditional hardware solutions are intended for firewall routers. However, the solutions in the literature for firewalls are not scalable, and they do not address the difficulty of an antivirus with an ever-larger pattern set. The goal of this work is to provide a systematic virus detection hardware solution for network security for embedded systems. Instead of placing entire matching patterns on a chip, our solution is a two-phase dictionary-based antivirus processor that works by condensing as much of the important filtering information as possible onto a chip and infrequently accessing off-chip data to make the matching mechanism scalable to large pattern sets. In the first stage, the filtering engine can filter out more than 93.1% of data as safe, using a merged shift table. Only 6.9% or less of potentially unsafe data must be precisely checked in the second stage by the exact-matching engine from off-chip memory. To reduce the impact of the memory gap, we also propose three enhancement algorithms to improve performance: 1) a skipping algorithm; 2) a cache method; and 3) a prefetching mechanism.

Original languageEnglish
Article number5740396
Pages (from-to)841-854
Number of pages14
JournalIEEE Transactions on Very Large Scale Integration (VLSI) Systems
Volume20
Issue number5
DOIs
StatePublished - 1 May 2012

Keywords

  • Algorithmic attacks
  • embedded system
  • memory gap
  • network security
  • virus detection

Fingerprint Dive into the research topics of 'A scalable high-performance virus detection processor against a large pattern set for embedded network security'. Together they form a unique fingerprint.

Cite this