GrAVity: A Massively Parallel Antivirus Engine

Vasiliadis, Giorgos; Ioannidis, Sotiris

doi:10.1007/978-3-642-15512-3_5

Cited by 47 publications

(32 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…ClamAV engine is used in the works of Cha et al [7] and Oberheide et al [21] to provide antivirus as in-cloud network service. Vasiliadis and Ioannidis [6] modify ClamAV engine to execute string match using GPU.…”

Section: The Clamav Programmentioning

confidence: 99%

“…Vasiliadis and Ionnidis [6] propose a massively parallel antivirus engine named GrAVity. Their work shows a modification of the ClamAV's string search mechanism using DFA.…”

Section: Clamav Speedupmentioning

confidence: 99%

“…The DFA represents prefixes of the string signatures, an approach similar to [7]. Vasiliadis and Ionnidis [6] evaluate their proposal on a GPU device. Because of the prefix match, there are possible occurrences of false positives with the method proposed in [7,30] and [6].…”

Section: Clamav Speedupmentioning

confidence: 99%

“…Server based antiviruses are not supposed to detect malware inserted either via removable media (USB flash drives and external hard drives) or through wireless access not controlled by network administrators before it reaches the target system. Furthermore, there is not a known antivirus that can detect an encrypted virus in files, and this approach has been used lately by attackers [1,2,6].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Endpoint Security in Networks: An OpenMP Approach for Increasing Malware Detection Speed

et al. 2017

View full text Add to dashboard Cite

Increasingly sophisticated antivirus (AV) software and the growing amount and complexity of malware demand more processing power from personal computers, specifically from the central processor unit (CPU). This paper conducted performance tests with Clam AntiVirus (ClamAV) and improved its performance through parallel processing on multiple cores using the Open Multi-Processing (OpenMP) library. All the tests used the same dataset constituted of 1.33 GB of data distributed among 2766 files of different sizes. The new parallel version of ClamAV implemented in our work achieved an execution time around 62% lower than the original software version, reaching a speedup of 2.6 times faster. The main contribution of this work is to propose and implement a new version of the ClamAV antivirus using parallel processing with OpenMP, easily portable to a variety of hardware platforms and operating systems.

show abstract

Section: The Clamav Programmentioning

confidence: 99%

“…Vasiliadis and Ionnidis [6] propose a massively parallel antivirus engine named GrAVity. Their work shows a modification of the ClamAV's string search mechanism using DFA.…”

Section: Clamav Speedupmentioning

confidence: 99%

Section: Clamav Speedupmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Endpoint Security in Networks: An OpenMP Approach for Increasing Malware Detection Speed

et al. 2017

View full text Add to dashboard Cite

show abstract

“…One kind of the data parallel approaches [12]- [15] aim to parallelize the AC algorithm, which is referred to as the data-parallel AC (DPAC) approach. The key point of DPAC approach is to divide an input stream into multiple chunks and allocates each chunk an individual thread to perform the AC algorithm separately.…”

Section: Data Parallel Ac Algorithm Implemented On Gpusmentioning

confidence: 99%

A STT-Partition-Based Parallel Algorithm for Pattern Matching on GPU and CPU

Li¹,

Liu²,

Li³

et al. 2015

IJCCE

View full text Add to dashboard Cite

Pattern matching is an important process in various applications such as information and network security, bioinformatics, image processing, etc. Aho-Corasick (AC) is one of the most representative algorithms for multiple pattern matching. As the data becomes extraordinarily large, GPUs have been adopted to accelerate pattern matching because of their great power for parallel computing. However, if the automata of AC algorithm contains more than hundreds of thousands of nodes, its State Transition Table (STT) takes up quite large storage space which is beyond GPU memory. In this paper, we present an improved AC algorithm named as STT-partition-based parallel AC (SPAC) to reduce the storage space for GPU by separating the original STT into two parts, one is kept in GPU and the other is stored in CPU. GPU is in charge for the major filtering task in the first step and then the relatively small-scale filtered results are further processed on CPU. Experiments are carried out on three different datasets and results show that our method reduces the storage space by 45%~50% compared with state-of-the-art algorithms with comparable matching speed.

show abstract

CloudEyes: Cloud‐based malware detection with reversible sketch for resource‐constrained internet of things (IoT) devices

et al. 2016

View full text Add to dashboard Cite

Summary Because of the rapid increasing of malware attacks on the Internet of Things in recent years, it is critical for resource‐constrained devices to guard against potential risks. The traditional host‐based security solution becomes puffy and inapplicable with the development of malware attacks. Moreover, it is hard for the cloud‐based security solution to achieve both the high performance detection and the data privacy protection simultaneously. This paper proposes a cloud‐based anti‐malware system, called CloudEyes, which provides efficient and trusted security services for resource‐constrained devices. For the cloud server, CloudEyes presents suspicious bucket cross‐filtering, a novel signature detection mechanism based on the reversible sketch structure, which provides retrospective and accurate orientations of malicious signature fragments. For the client, CloudEyes implements a lightweight scanning agent which utilizes the digest of signature fragments to dramatically reduce the range of accurate matching. Furthermore, by transmitting sketch coordinates and the modular hashing, CloudEyes guarantees both the data privacy and low‐cost communications. Finally, we evaluate the performance of CloudEyes by utilizing both the campus suspicious traffic and normal files. The results demonstrate that the mechanisms in CloudEyes are effective and practical, and our system can outperform other existing systems with less time and communication consumption. Copyright © 2016 John Wiley & Sons, Ltd.

show abstract

GrAVity: A Massively Parallel Antivirus Engine

Cited by 47 publications

References 27 publications

Endpoint Security in Networks: An OpenMP Approach for Increasing Malware Detection Speed

Endpoint Security in Networks: An OpenMP Approach for Increasing Malware Detection Speed

A STT-Partition-Based Parallel Algorithm for Pattern Matching on GPU and CPU

CloudEyes: Cloud‐based malware detection with reversible sketch for resource‐constrained internet of things (IoT) devices

Contact Info

Product

Resources

About