Fast proxyless stream-based anti-virus for Network Function Virtualization

Network anti-virus (AV) solutions are the first line of defense against malicious software. Traditional proxy-based network anti-virus solutions with store-scan-forward techniques decrease network performance and consume massive amounts of memory. Therefore, traditional solutions are not easily adaptable for Network Function Virtualization (NFV). This paper details the work on a novel virus scanning solution for NFV, called StreamAV. It does not require a proxy and maintains high network performance with less memory usage. StreamAV conducts policy matching on streams, rather than on complete files. This eliminates buffering, thereby accelerating traffic and requiring far less memory than solutions that scan complete files. The prototype was 40 times faster than its closest open source competitor, while its memory consumption was only a fraction of that of this competitor. Coverage was 100% with random test samples.