As mentioned in a previous blog entry, we at Avira are not only trying to offer you outstanding detection rates, we are also putting effort into providing that protection in a way that does not slow your system down more than absolutely necessary. This blog entry will give some numbers to a few of the improvements we recently implemented.

The first scenario is scanning a usual Windows XP install directory, containing around 55.000 typical windows files. The second is a dedicated testbed we use for benchmarking parts of our scanner which contains executables, archives, websites, office files, PDFs, pictures and many other different file types.

Note that most of the optimizations we’ve done are absolutely not specific to these scenarios, although of course the choice of a testbed can seriously skew the results into different directions.

So, let us compare three different versions of the Avira AntiVir Engine:

• 7.6.0.84 : one of the last versions of the old AV7 Engine architecture, released in early April 2008
• 8.1.0.35 : one of the first releases of the new AV8 Engine architecture, released in late April
• 8.2.0.7 : at the time of this writing, the most up-to-date engine

Scantime in an On-Demand Scan

Our first illustration shows the scantime of two on-demand scans performed on both of the mentioned testbeds. Each was scanned multiple times to avoid random influences to skew the result. Also note that the files did reside in the file system cache, so the numbers may seem low to you. The scans were performed on a Intel Core2Duo with 2,66GHz and 4GB of RAM.

File IO Requests when scanning the Windows XP directory (reads and writes, measured with Microsofts Filemon tool)

The second illustration shows the effect our optimizations had on general file IO requests. If you look at the numbers, the load for the Windows IO subsystem has changed considerably between the three versions. This also means less work for your physical harddisk. Of course this is not due to the removal of features or detection but instead by improving our own engine IO management, caching and file access approach. In fact, the later versions have added detection and processing of several formats which were not covered by AV7.

So, as you can see, we are not resting on the laurels of our good detection results. Staying ahead of the pack in terms of speed and system impact is also important.

Marcus Matten
Engine Core R&D