Hardware-Accelerated Rule Search Engine for Line-Rate Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software-based malware detection schemes in network security face bottlenecks as network data rates increase, leading to performance constraints, especially in high-throughput enterprise networks, due to the inability to execute malware detection at line-rate speeds.
Innovation Solution
A network security device employing a hardware-accelerated rule search engine that parses malware signatures into finite state machines, utilizing content-addressable memory for rapid string-match determination, enabling line-rate malware detection by segmenting rules into fixed-pattern and variable-character expressions, and dynamically allocating state machines for parallel processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If software-based malware detection schemes are used, then detection accuracy can be maintained, but execution speed deteriorates and creates detection bottlenecks in high-throughput networks
Solution Approach 1:
The patent replaces software-based detection mechanisms with a hardware-accelerated rule search engine that uses content-addressable memory (CAM) and finite state machines (FSM). This hardware substitution enables line-rate malware detection by performing parallel pattern matching in dedicated circuitry rather than through sequential software processing, thereby resolving the contradiction between detection accuracy and execution speed.
Solution Approach 2:
The patent segments malware detection rules into fixed-pattern character sequences and variable-character expressions, with each segment corresponding to a state-to-state transition in a finite state machine. This segmentation allows the hardware engine to process different rule components in parallel through dedicated state machines, achieving both high accuracy in pattern matching and high speed in detection execution.
2Adaptability or versatility
If software-based detection schemes are used, then implementation flexibility is maintained, but network performance deteriorates due to detection bottlenecks
Solution Approach 1:
The patent implements dynamic rule updates and state machine allocation that allow the hardware engine to adapt to new malware threats in real-time. The system can dynamically allocate state machines to handle varying detection loads and update detection rules without requiring system restart, thereby maintaining flexibility while operating at full network throughput capacity.
3Device complexity
If conventional software-based approaches are used, then system complexity remains manageable, but detection capability deteriorates at line-rate speeds
Solution Approach 1:
The patent introduces a rule parsing engine as an intermediary that translates high-level malware detection rules into finite state machine representations suitable for hardware execution. This intermediary layer simplifies the overall system architecture by providing a clear separation between rule management (software) and pattern matching execution (hardware), enabling reliable line-rate detection without excessive system complexity.
Data Source
AI summary
Upon receiving malware detection rules that are to be identified with respect to an input traffic stream, a sequence of state definitions are generated for each of the rules. The state definitions for each rule correspond to respective segments of the rule and specify conditions under which a state machine is to transition between search states corresponding to those segments, at least one of the segments corresponding to multiple characters within the input traffic stream. A state machine transitions between search states corresponding to one or more of the rules in accordance with contents of the input traffic stream and the conditions specified by the sequence of state definitions.