Hash-AV: Fast Virus Signature Scanning by Cache-Resident Filters
Ozgun Erdogan and Pei Cao
Abstract
Fast virus scanning is becoming increasingly important in today's Internet.
While Moore's law continues to double CPU cycle speed, virus scanning
applications fail to ride on the performance wave due to their frequent
random memory accesses.
This paper proposes Hash-AV, a virus scanning ``booster'' technique that
aims to take advantage of improvements in CPU performance.
Using a set of hash functions and a bloom filter array that fits
in CPU second-level (L2) caches, Hash-AV determines the majority of
``no-match'' cases without accesses to main memory.
Experiments show that Hash-AV improves the performance of
the open-source virus scanner Clam-AV by a factor of 2 to 10.
The key to Hash-AV's success lies in a set of ``bad but cheap'' hash functions
that are used as initial hashes.
The speed of Hash-AV makes it well suited for ``on-access'' virus scanning,
providing greater protections to the user.
Through intercepting system calls and wrapping glibc libraries,
we have implemented an ``on-access'' version for Hash-AV+Clam-AV.
The on-access scanner can examine input data at a throughput of
over 200Mb/s, making it suitable for network-based virus scanning.
The paper in PDF is here.
The PowerPoint presentation will be online soon.