Security Management White Papers

Hash-AV: Fast Virus Signature Scanning by Cache-Resident Filters

• Tags:
• security management,
• virus,
• memory,
• scanning

Overview Fast virus scanning is becoming increasingly important in today's Internet. While Moore's law continues to double CPU cycle speed, virus scanning applications fail to ride on the performance wave due to their frequent random memory accesses. This paper proposes Hash-AV, a virus scanning "Booster" technique that aims to take advantage of improvements in CPU performance. Using a set of hash functions and a bloom filter array that fits in CPU second-Level (L2) caches, Hash-AV determines the majority of "No-match" cases without accesses to main memory. The on-access scanner can examine input data at a throughput of over 200Mb/s, making it suitable for network-based virus scanning.

• 
• Did you find this white paper useful? 1 out of 2 users found this white paper useful

• Subscribe to the IT White Papers Newsletter
• White Paper RSS