SplitScreen: Enabling efficient, distributed malware detection

We present the design and implementation of a novel anti-malware system called SplitScreen. SplitScreen performs an additional screening step prior to the signature matching phase found in existing approaches. The screening step filters out most non-infected files (90%) and also identifies malware s...

Full description

Saved in:
Bibliographic Details
Published inJournal of communications and networks Vol. 13; no. 2; pp. 187 - 200
Main Authors Sang Kil Cha, Moraru, Iulian, Jiyong Jang, Truelove, John, Brumley, David, Andersen, David G.
Format Journal Article
LanguageEnglish
Korean
Published Séoul Editorial Department of Journal of Communications and Networks 01.04.2011
Korean Institute of Communication Sciences
한국통신학회
Subjects
Anti-malware
Applied sciences
bloom filter
Computers
Exact sciences and technology
Malware
Memory management
Operation, maintenance, reliability of teleprocessing networks
Pattern matching
Servers
signature matching
Telecommunications
Telecommunications and information theory
Teleprocessing networks. Isdn
Vectors
전자/정보통신공학
Performance evaluation
signature matching
bloom filter
Malware
Computer security
Implementation
Anti-malware
Computer attack
Online AccessGet full text

Cover

More Information
Summary:We present the design and implementation of a novel anti-malware system called SplitScreen. SplitScreen performs an additional screening step prior to the signature matching phase found in existing approaches. The screening step filters out most non-infected files (90%) and also identifies malware signatures that are not of interest (99%). The screening step significantly improves end-to-end performance because safe files are quickly identified and are not processed further, and malware files can subsequently be scanned using only the signatures that are necessary. Our approach naturally leads to a network-based anti-malware solution in which clients only receive signatures they needed, not every malware signature ever created as with current approaches. We have implemented SplitScreen as an extension to ClamAV, the most popular open source anti-malware software. For the current number of signatures, our implementation is 2x faster and requires 2x less memory than the original ClamAV. These gaps widen as the number of signatures grows.
Bibliography:KISTI1.1003/JNL.JAKO201121537469183
G704-000784.2011.13.2.003
ISSN:1229-2370
1976-5541
DOI:10.1109/JCN.2011.6157418