Memory-efficient signature matching for ClamAV on FPGA

Signature matching is a crucial task of various security applications such as antiviruses, intrusion detections, and firewalls. The growth in quantity and complexity of signatures made matching task more challenge especially on general purpose processor. In this paper, we proposed an efficient architecture for matching Clam Antivirus (ClamAV) signatures on FPGA. We utilize Bloom filter technique for filtering input data and Bloomier filter technique for one round check suspect data. Our matching engine support up to 256 byte length signature and can handle both basic and regular expression signatures. Compare to previous approaches, our architecture is better memory utilization with 14%-64% less than previous works. Experiences on low-cost Altera Cyclone II show that our system can fit signature set with more than 43K characters size and is capable of 1 gigabit per second throughput.