MRSI: A Fast Pattern Matching Algorithm for Anti-virus Applications

Anti-virus applications play an important role in today's Internet communication security. Virus scanning is usually performed on email, Web and file transfer traffic flows at intranet security gateways. The performance of popular anti-virus applications relies on the pattern matching algorithms implemented in these security devices. The growth of network bandwidth and the increase of virus signatures call for high speed and scalable pattern matching algorithms. Motivated by several observations of a real-life virus signature database from Clam-AV, a popular antivirus application, a fast pattern matching algorithm named MRSI is proposed in this paper. Compared to the current algorithm implemented in Clam-AV, MRSI achieved an 80%~100% faster virus scanning speed without excessive memory usages.