TCAM Regex Search Engine for Line-Rate Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional software-based malware detection schemes in high-throughput enterprise networks face bottlenecks due to escalating network data rates, constraining network performance and requiring tractability over execution speed.
Innovation Solution
A network security device employing a hardware-accelerated signature detection engine that parses malware signatures into rule segments, utilizing a ternary content addressable memory (TCAM) and a Perl-Compatible Regular-Expression (PCRE) coprocessor to perform highly-parallel, real-time malware detection by comparing input data streams with stored rule-formatted comparands, enabling line-rate malware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If software-based detection schemes are used, then tractability is improved, but execution speed deteriorates
Solution Approach 1:
The patent replaces software-based detection with a hardware-accelerated detection engine that uses specialized circuits and ternary content-addressable memory (TCAM) to perform malware signature matching. This hardware substitution enables line-rate processing of network traffic while maintaining the ability to handle complex regular expression patterns, thus resolving the contradiction between tractability and execution speed.
2Speed
If hardware-accelerated detection is implemented, then execution speed is improved, but device complexity increases
Solution Approach 1:
The detection engine is segmented into specialized functional units including a rule parsing engine, TCAM-based pattern matching unit, and PCRE coprocessor blocks. Each unit handles specific aspects of malware detection, allowing parallel processing while keeping individual components manageable in complexity. This segmentation enables hardware acceleration without overwhelming device complexity.
Solution Approach 2:
The patent introduces a rule parsing engine as an intermediary that translates complex regular expression rules into a format suitable for hardware processing. This intermediary layer simplifies the interface between software rule definitions and hardware execution, reducing the complexity burden on the hardware-accelerated detection engine.
3Productivity
If network data rates are escalated, then network performance is improved, but detection bottleneck worsens
Solution Approach 1:
The hardware-accelerated detection engine operates continuously at line rate, processing network traffic without interruption or batching. The TCAM-based architecture enables simultaneous comparison of incoming data streams against all stored malware signatures, maintaining continuous detection capability that scales with network data rates and eliminates detection bottlenecks.
Data Source
AI summary
In a malware detection device, first characters in a network traffic flow are compared with a plurality of entries within a ternary content addressable memory (TCAM), the plurality of entries including a first entry that constitutes a first segment of a malware signature. In response to an output from the first TCAM indicating that the first characters match the first entry, a variable-character expression engine determines whether second characters in the network traffic flow match a first variable-length regular expression, the variable-length regular expression corresponding to a second segment of the malware signature. A comparand value is generated that includes third characters in the network traffic flow and an expression-match value that indicates whether the second characters match the first variable-length regular expression. The TCAM compares the first comparand value with the plurality of entries therein as part of a determination whether the network traffic flow contains the malware signature.