ACCELERATING VIRUS SCANNING WITH GPU Project by: Sinthuja K. Thipakar S. Computer Engineering Department, University of Peradeniya
3c6f626a d22 2f2f2f2f2f2f2f2f2f2f2f2f676f20746f c696e6b c6f Virus database Results Same Instructions
CPU vs GPU SIMD Architecture Can use for general purpose calculations Number of cores is higher than CPU Number of threads is higher than CPU
3c6f626a d222f2f2f 2f2f2f2f2f2f2f2f2f676f20746f c696e6b c6f f f f756e e c f f f66696 c c6c c e f756e c W32.Hybris.C:4000?????????????????? ????????83??????75f2e9????ffff daa0343df8ff683f730fec39 :Dialer-85
Non-polymorphic Virus pattern daa0343df8ff683f730fec39 Boyer-Moore Algorithm Fast string searching Algorithm MD5 Algorithm
Method1: Parallelism with number of inputs in1 inN in2 ….. Virus pattern MD5 ….. Method2: Parallelism with number of inputs + divided pattern sets in1 inN in2 ….. Virus pattern set2 MD5 ….. in1 inN in2 ….. Virus pattern set1 MD5 ….. in1 inN in2 ….. Virus pattern set-n MD5 ….. - Thread MD5 - MD5 Calculation
Polymorphic Virus pattern 4000?????????????????????????? 83??????75f2e9????ffff Aho-Corasick algorithm PFAC Library Aho-Corasick algorithm implemented for GPU Normally how PFAC works:
ED Q PEB
Implemented Boyer-Moore & MD5 algorithm in CPU & GPU Changed PFAC implementation from perfect pattern matching to approximate pattern matching Performance analysis for both algorithms is in progress