Yes, GPUs Can Save You from Malware

It’s a Staggering Challenge. The Proliferation of Malware — Malicious Software that Often Targets the Mountain of Data on Computers and Mobile Devices — Poses a Huge Problem for the Information Security World, Complicated by its Taking on New Forms and Techniques. Increasingly, Firms like Avast Software are Addressing the Problem with GPUs. The Czech Security Vendor has Built a GPU-Accelerated Database that Lets it Process and Analyze Millions of Samples Dramatically Faster than Traditional Tools, Peter Kovac, an Avast Senior Researcher Told Attendees during a Session at the GPU Technology Conference, “It allows us to do nearest-neighbor queries, rule-matching queries and classification of unknown records”, Kovac Said of the Database Dubbed, 'Medusa'. Each Day, Avast’s Sensor Network Monitors Hundreds of Millions of User Machines and Identifies Hundreds of Thousands of Potential New Malware Files. When the Network Collects What it Believes is a Suspicious File, it Sends it to the Company’s Submit Servers, which Pass it on to 'Medusa'. There, the GPUs do their Magic, Applying Queries and Classifying Files Based on the Results. 'Medusa' then Stores Records of those Files to Compare against Future Suspected Malware.


The Database Contains Nearly 40 Million Clean Files, Nearly 3 Million Recent Threats and about 2 Million Samples for which it Hasn’t Made a Determination. Kovac Said, there are “Billions of Billions” of Possible Combinations to Analyze, which Requires a Stochastic Approach. Because of the Huge, Random Nature of the Possibilities, 'Medusa' Comes Up with a Typical Representative of a Cluster that Uses 60 to 80% of its Attributes. The Goal is to Find a Workable Subset of Conditions so, Avast Can Maximize its Success in Identifying Malware in Real-Time. Without GPUs, None of this would be Possible because, of the Enormous Amount of Data in Question. “GPUs do the heavy lifting”, Kovac Said. How Heavy ? How about Rule-Matching Queries Happening 22X Faster than on a CPU, Rule Generation that’s 20X Faster and Nearest-Neighbor Queries that Happen 13X Faster ? The Results Speak for Themselves. “Hundreds of results from the rule generator are released daily”, Said Kovac. In Other Words, Millions of Users’ Computers are Spared.