1. Researcher : Chatsiri Ratana
Master’s degree in computer engineering.
Optimizing Clam-Antivirus for GPU
Kasetsart University, Faculty of Computer Engineering.
2. Agenda
• Introduction
• What Clam Antivirus & GPU?
• Why optimized Clam Antivirus for GPU?
• Related Work
• Understanding antivirus
• Kindling of String Matching Algorithms for support Clam
Antivirus.
• Hybrid Parallel Signature Scanning methods.
• Kindling optimized for supporting GPU
3. What Clam Antivirus & GPU?
• Clam AntiVirus( Clam AV)
• Antivirus signature database.
• Signature types are hexadecimal ,MD5 and regular expression signatures
by third of major types for scanning.
• Available with e-mail proxies and file servers.
• ClamAV uses an optimized version of the Boyer-Moore and Aho-Corasick
• Bayer-Moore algorithm to detect non-polymorphic viruses using simple fixed
string signature.
• Aho-Corasick algorithm to detect polymorphic viruses.
• GPU( Graphics Processing Unit )
• Flexible stream processors operating on SIMD( Single Instruction Multiple
Data).
• Specialized for computationally-intensive and highly parallel operation.
• Fast shared memory is managed explicitly by the programmer among
thread block.
4. Why optimized Clam Antivirus for GPU?
• ClamAV using string matching concepts.
• Boyer-Moore
• Aho-Corasick
• GPU( Graphics Processing Unit )
• Supporting Parallel operations(CUDA, OpenCL).
• Higher data transfer bandwidth.
• Supporting Library programming.
• Multiprocessor consists in eight stream processors, operating on a SIMD
fashion.
• Why use GPU instead CPU?
5. Understanding antivirus
• Signature Bases
• Type of signature base
• Hexadecimal
• MD5
• Regular expression.
• Algorithms
• Bayer-Moore algorithm
• Aho-Corasick algorithm
6. Structure of Clam AV
Filtering Verification
File File Buffer
Offset Verification Module
GPU
Full viruses Signature
7. Kindling of String Matching Algorithms for
support Clam Antivirus.
• Algorithms
• Bayer-Moore algorithm
• Aho-Corasick algorithm
8. Bayer-Moore Algorithm
- - - - A MA N - - - - - - -
A N P A N MA N - - - - - - -
- A N P A N MA N - - - - - -
- - A N P A N MA N - - - - -
- - - A N P A N MA N - - - -
- - - - A N P A N MA N - - -
- - - - - A N P A N MA N - -
- - - - - - A N P A N MA N
Bayer-Moore Algorithm, wikipeida.org
