GPU-Based Parallel Signature Scanning and Hash Generation

Today, nearly every user of electronic devices is affected by threats. Computer viruses infect harmless programs and change the function of that program. One means against these threats is a virus scanner, searching for signatures of known viruses within code and/or data. In this work, we present a novel approach to on-line virus scanning and hash calculation with the help of GPUs (graphics processing units). The main idea is to speed up the search by not searching for signatures on the hard-drive but to scan parts of the main memory and concurrently generate hash values on the code to detect changes. This is appealing and obvious, as the pattern matching has to look at most characters in the text. The first experiments showed that the CPU needs much more time for the execution of shift-like operations and testing for equivalence than the GPU, demonstrating that pattern matching algorithms and hash functions can be efficiently computed on GPUs. As a basis, we use the SHA-1 (160 bit) algorithm. The algorithm uses text properties for the initialization of the hash value and partial sums and/or path properties for the constants in each round. A fundamental part of future research will therefore be the testing if such an initialization can help to detect concatenated extensions like h(m)=h(m·x), where m and x are messages of arbitrary length, furthermore, if the independent calculation of hash results in each round will increase or reduce collision resistance.