Overview / Usage

I am using PFAC code from https://github.com/pfac-lib/PFAC and modified it to use GPU for pattern detection. PFAC creates a pattern state buffer where each character represents certain state number. If there is a match, you get a non 0xFFFFFFFF value and keep on proceeding untill you keep on getting a valid value. Once complete pattern is matched, you get pattern ID (an integer).

I took pattern database from ClamAV database, extracted 30,000 patterns from it.

At run time, I convert these patterns from ASCII-HEX to binary, allocate a buffer (10MB/100MB or even bigger) and inject patterns into it.

In the detection side, I send pattern state buffer and input buffer to GPU where detection is performed and for every valid match, pattern ID is written into output buffer. I parse the output buffer and check if the detected pattern ID matches with injected pattern ID.

I had written it earlier in DirectCompute and then moved it to OpenCL. Now the same has been ported to OneAPI

Methodology / Approach

Detecting patterns using CPU can be very time consuming. The same can be offloaded to GPU. This project offloads the pattern detection work to GPU.

Original PFAC code is taken from: https://github.com/pfac-lib/PFAC

Patterns are taken from ClamAV database

Technologies Used

PFAC algorithm

OneAPI

C