Hardware-Accelerated Malware Detection via Traffic Compression
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional software-based malware detection schemes in network security face bottlenecks as network data rates increase, particularly in high-throughput enterprise networks, leading to performance constraints.
Innovation Solution
A hardware-accelerated network security appliance that compresses network traffic and uses a content-addressable memory (CAM)-based rule search engine for real-time malware detection, enabling massively parallel compression-code lookup and signature search operations at line rate, thus avoiding software-based detection bottlenecks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If software-based malware detection schemes are used, then tractability is improved, but execution speed deteriorates
Solution Approach 1:
The patent replaces software-based detection mechanisms with hardware-based detection using content-addressable memory (CAM) and field-programmable gate array (FPGA) technology. This substitution enables real-time malware detection at line rate by leveraging hardware's inherent parallel processing capabilities and fast access times, directly resolving the speed limitation of software-based approaches while maintaining detection functionality.
Solution Approach 2:
The patent changes the operational parameters of the detection system by implementing parallel search operations across multiple CAM banks and using pipelined architecture. This allows the system to process multiple packets simultaneously and maintain line-rate detection performance, fundamentally altering the speed parameter from sequential software processing to parallel hardware processing.
2Productivity
If network data rates are increased, then network throughput is improved, but detection bottleneck worsens
Solution Approach 1:
The patent divides the detection system into multiple parallel CAM banks (e.g., 32 banks) that can simultaneously search for malware signatures. Each bank handles a portion of the detection workload, allowing the system to scale with increasing network data rates without creating a bottleneck. This segmentation enables the detection capacity to match the network throughput.
Solution Approach 2:
The patent transitions from single-dimensional sequential detection to multi-dimensional parallel detection by implementing both spatial parallelism (multiple CAM banks processing different signature sets) and temporal parallelism (pipelined packet processing). This dimensional expansion allows the system to handle increased network throughput without proportionally increasing detection complexity.
3Speed
If hardware-accelerated detection is implemented, then execution speed is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal detection architecture using FPGA technology that can be configured to handle multiple malware detection algorithms and signature types within a single hardware platform. This multi-functionality reduces the need for multiple specialized hardware components while maintaining high-speed detection capabilities across different threat types.
Solution Approach 2:
The patent combines multiple detection functions including CAM-based signature matching, compression code lookup, and packet processing into a single integrated hardware pipeline. By merging these functions into one cohesive system rather than using separate hardware components for each function, the overall device complexity is reduced while maintaining execution speed.
Data Source
AI summary
Upon receiving malware detection rules that are to be identified with respect to an input traffic stream, a rule database that requires less storage capacity than the malware detection rules is generated by substituting tokens for selected symbol strings within the malware detection rules. A compressed traffic stream is generated by substituting the tokens for instances of the selected symbol strings within the input traffic stream, and then compared with the rule database to determine whether the input traffic stream contains one or more symbol sequences that correspond to any of the malware detection rules.