PERG-Rx: a hardware pattern-matching engine supporting limited regular expressions

PERG is a pattern matching engine designed for locating predefined byte string patterns (rules) from the ClamAV virus signature database in a data stream. This paper presents PERGRx, an extension of PERG that adds limited regular expression support for wildcard patterns used by rules that represent polymorphic viruses. To reduce the amount of state needed to track so many regular expressions, PERG-Rx employs a lossy scheme which increases the rate of false positives detected as the required state grows. The scalability and dynamic updatability of the PERG-Rx architecture to database updates are also evaluated. Categories and Subject Descriptors B.6.0 [Logic Design]: General – FPGA, pattern-matching engine General Terms: Algorithms, Performance, Design, Security Keywords FPGA, Pattern Matching, Antivirus, Regular Expression

• Type: Conference
• Year: 2009
• Where: FPGA
• Authors: Johnny Tsung Lin Ho, Guy G. Lemieux
• Keywords: FPGA 2009, Hardware, Pattern Matching, Pattern Matching Engine, Regular Expression