Apparatus and method for performing real-time network antivirus function

1. An apparatus for performing a real-time network antivirus function, comprising:

one or more computer-executable units being configured and executed by a processor using algorithms associated with at least one non-transitory storage device, the algorithms, when executed, causing the processor to execute the one or more computer-executable units, the one or more computer-executable units comprising,

in response to receipt of packet flows, a packet processing unit for parsing the packet flows and outputting a transmission data stream;

in response to determination of the transmission data stream not being registered in a blacklist, a caching unit for transferring the transmission data stream recombined by the packet processing unit to a packet-based checksum calculation unit, and the packet-based checksum calculation unit for performing a signature generation task on a packet basis based on the transmission data stream, and

in response to detection of a last packet of the transmission data being input, the packet-based checksum calculation unit for generating a final signature corresponding to the last packet included in the transmission data stream;

in response to receipt of the final signature, a virus scanning unit for performing virus scanning by using the final signature transferred from the packet-based checksum calculation unit;

a detection and blocking unit for blocking the packet flows or transmitting the packet flows to a destination, based on a result output from the virus scanning unit;

wherein the detection and blocking unit is configured to, if the result output from the virus scanning unit indicates a malicious result, block the packet flows, and if the result indicates a normal result, forward the packet flows; and

the caching unit for updating the blacklist, based on a result output from the detection and blocking unit; wherein the caching unit is configured to automatically generate a detection rule for an Internet Protocol (IP) address or a Uniform Resource Locator (URL), which provides a transmission data stream of a malicious file, based on the result output from the detection and blocking unit, and to input the generated detection rule to the blacklist.

2. The apparatus of claim 1 , wherein the packet-based checksum calculation unit generates the signature by dividing the transmission data stream into N data blocks and consecutively performing a hash digest operation on the N data blocks.

3. The apparatus of claim 1 , wherein the virus scanning unit compares a virus database (DB) with the signature in an in-memory-based or Graphics Processing Unit (GPU)-based manner.

4. The apparatus of claim 3 , wherein the virus scanning unit utilizes a data structure and algorithms, in which a search time and a DB storage space are taken into consideration, upon performing the virus scanning.

5. The apparatus of claim 4 , wherein the data structure is one of a self-balancing binary search tree, a hash table, a one-dimensional array, and a bloom filter.

6. A computer-implemented method for performing a real-time network antivirus function, comprising:

in response to receipt of packet flows, parsing, by a processor packet flows and outputting a transmission data stream;

in response to determination of the transmission data stream not being registered in a blacklist, transferring the transmission data stream recombined by packet processing unit to a packet-based checksum calculation unit, and performing a signature generation task on a packet basis based on the transmission data stream, and

in response to detection of a last packet of the transmission data being input, generating a final signature corresponding to the last packet included in the transmission data stream;

in response to receipt of the final signature, performing virus scanning by using the final signature;

blocking the packet flows or transmitting, by the detection and blocking unit, the packet flows to a destination, based on a result of virus scanning;

wherein blocking the packet flows, or transmitting the packet to the destination comprises: if the result of the virus scanning indicates a malicious result, blocking the packet flows; and if the result indicates a normal result, forwarding the packet flows; and

updating a blacklist based on a result of blocking the packet flows or transmitting the packet flows to the destination;

wherein updating the blacklist comprises: automatically generating a detection rule for an Internet Protocol (IP) address or a Uniform Resource Locator (URL), which provides a transmission data stream of a malicious file, based on the result of blocking the packet flows or transmitting the packet flows to the destination; and inputting the generated detection rule to the blacklist.

7. The method of claim 6 , wherein outputting the signature comprises generating the signature by dividing the transmission data stream into N data blocks and consecutively performing a hash digest operation on the N data blocks.

8. The method of claim 6 , wherein performing the virus scanning comprises comparing a virus database (DB) with the signature in an in-memory-based or Graphics Processing Unit (GPU)-based manner.

9. The method of claim 8 , wherein performing the virus scanning comprises utilizing a data structure and an algorithm, in which a search time and a DB storage space are taken into consideration, upon performing the virus scanning.

10. The method of claim 9 , wherein the data structure is one of a self-balancing binary search tree, a hash table, a one-dimensional array, and a bloom filter.