Anti-malware system and operating method thereof

1. A method of an anti-malware processor, the method comprising:

filtering by a first logic unit of the processor, input data based on a rule; and

scanning by a second logic unit of the processor, for malware in the data, the filtering and the scanning being performed at a same time,

wherein the input data is packet data, the method further comprising determining whether the packet data contains data to be scanned for malware,

wherein the scanning is performed only if it is determined that the packet data contains data to be scanned for malware,

wherein, if the packet data does not match the rule as a result of the filtering and if it is determined that the packet data does not contain the malware as a result of the scanning, the packet data is transmitted to an external device or an application unit,

wherein, if the packet data does not match the rule as a result of the filtering, but if it is determined that the packet data contains the malware as a result of the scanning, the packet data is not transmitted to an external device or an application unit, and

wherein the method further comprises:

if it is determined that the packet data does not match the rule in the filtering, storing the packet data in a standby buffer; and

if it is determined that the packet data not matching the rule contains the data to be scanned for malware in the determining, copying the packet data to an auxiliary buffer and storing the packet data in the auxiliary buffer.

2. The method of claim 1 , wherein the filtering overlaps with the scanning in time.

3. The method of claim 2 , wherein the scanning starts before the filtering is completed.

4. The method of claim 1 , wherein the processor is a system-on-chip (SOC).

5. The method as claimed in claim 1 , wherein the input data is packet data and the method further comprising converting the packet data to be scanned for malware into data of a format for the scanning,

wherein the scanning scans the converted packet data.

6. The method as claimed in claim 1 , further comprising, if it is determined that the packet data contains the data to be scanned for malware in the determining, determining a type of the data to be scanned for malware.

7. The method as claimed in claim 1 , wherein the input data is packet data and the filtering comprises:

first matching the packet data and a rule pattern; and

determining whether to allow or block the packet data according to a result of the first matching,

wherein the scanning comprises:

second matching the packet data and a predetermined malware pattern; and

determining whether the packet data contains the malware according to a result of the second matching.

8. An anti-malware device comprising:

a processor comprising:

a firewall engine which comprises first logic units that filter input data based on a rule, and determines whether the input data contains data to be scanned for malware; and

an anti-malware engine which comprises second logic units that scan for malware in the input data, if the firewall engine determines that the input data contains the data to be scanned for malware,

wherein the firewall engine filters and the anti-malware engine scans at a same time

wherein the input data is packet data, the firewall engine determines whether the packet data contains data to be scanned for malware, and the second logic units scan for the malware only if the firewall engine determines that the packet data contains the data to be scanned for malware,

wherein the anti-malware device further comprises a standby buffer and an auxiliary buffer,

wherein the firewall engine stores the data in the standby buffer if it is determined that the packet data does not match the rule, and stores the data in the auxiliary buffer if the packet data not matching the rule contains the data to be scanned for malware.

9. The anti-malware device of claim 8 , wherein the firewall engine filters during a first period of time and the anti-malware engine scans during a second period of time, wherein the first and second periods of time overlap.

10. The anti-malware device of claim 8 : wherein the anti-malware engine starts to scan before the firewall engine completes filtering.

11. The anti-malware device as claimed in claim 8 , wherein the firewall engine determines whether the data contains the data to be scanned for malware, only if the data does not match the rule.

12. The anti-malware device as claimed in claim 8 , further comprising an anti-malware manager which converts the data to be scanned for malware into data of a format for the anti-malware engine,

wherein the anti-malware engine scans the converted data.