Malware detection via a graphics processing unit

Authors

• Nicholas Kovach, Air Force Institute of Technology
• Barry E. Mullins, Air Force Institute of Technology

Document Type

Conference Proceeding

Publication Date

4-8-2010

Abstract

Malware analysis involves processing large amounts of storage to look for suspicious files. This is time consuming and requires a large amount of processing power, often affecting other applications running on a personal computer. By using hardware included in most personal computers, a performance increase can be seen. The processing of files can be done on a graphics processing unit (GPU), contained in common video cards. A GPU is perfect for this because of its strong similarities to a central processing unit (CPU). Since the GPU has multiple processing units (32-128) it has an advantage over a CPU (1-8 processing units). This allows a single data stream to be processed using different metrics in parallel, while consuming minimal clock cycles from the CPU. A GPU also has its own memory, separated from the CPU, but also has the ability to share part of the CPU's memory. By using the GPU on a personal computer, other applications and the file processing for malware do not experience performance decreases by fighting over CPU usage. Using a GPU for file processing can also be applied to network intrusion detection systems (NIDS) and firewall based applications in addition to anti-malware applications. This research in progress investigates the use of GPUs for monitoring/detecting malicious activity. Specifically, we are processing files for malicious activity using different file sizes as well as malicious and non-malicious files which allows the performance and feasibility of using GPUs to be determined. We anticipate faster anti-malware products, faster NIDS response times, faster firewall applications, and a decrease in the time required to analyze files to generate signatures and understand exactly what the file is doing.

Comments

Copyright © Academic Conferences International Limited Apr 2010

Current AFIT students, faculty and staff may access the full conference paper through ProQuest, by clicking here.

Source Publication

5th International Conference on Information Warfare and Security

Recommended Citation

Kovach, N., & Mullins, B. E. (2010). Malware detection via a graphics processing unit. 5th International Conference on Information Warfare and Security, 212–215. ProQuest (869617237).