 an afflicted network. "As is the case with the spread of a contagious disease like SARS, the number of infected computers will grow exponentially unless contained," says Lockwood. "The speed of today's computers and vast reach of the Internet, however, make a computer virus or Internet worm spread much faster than human diseases. In the case of SoBigF, over 1 million computers were infected within the first 24 hours and over 200 million computers were infected within a week." Most Internet worms and viruses aren't detected until after they reach a user's PC. As a result, it's difficult for enterprises to maintain network-wide security. "Placing the burden of detection on the end user isn't efficient or trustworthy because individuals tend to ignore warnings about installing new protection software and the latest security updates," notes Lockwood. "New vulnerabilities are discovered daily, but not all users take the time to down- load new patches the moment they are posted. It can take weeks for an IT department to eradicate old versions of vulnerable software running on end- system computers." The FPX's high speed is possible because its logic is implemented as field programmable gate array (FPGA) circuits. The circuits are used in parallel to scan and to filter Internet traffic for worms and viruses. Lockwood's group has developed and implemented FPGA circuits that process the Internet proto- col (IP) packets directly in hardware. This group has also developed several circuits that rapidly scan streams of data for strings or regular expressions in PUTTING A LID ON SPAM order to find the signatures of malware carried within the payload of Internet packets. "On the FPX, the reconfigurable hardware can be dynamically recon- figured over the network to search for new attack patterns," says Lockwood. "Should a new Internet worm or virus be detected, multiple FPX devices can be immediately programmed to search for their signatures. Each FPX device then filters traffic passing over the network SO that it can immediate