Installation
These results should be viewed as guidelines and not performance guarantees, since there are many variables that affect performance (file set, network configurations, hardware characteristics, etc.). If throughput is important to your implementation, OPSWAT recommends site-specific benchmarking before implementing a production solution.
Environment
Using AWS environment with the specification below:
MetaDefender Core
| OS | AWS instance type | vCPU | Memory (GB) | Network bandwidth (Gbps) | Disk type | Benchmark |
|---|---|---|---|---|---|---|
| Ubuntu 24.04 | c5.4xlarge | 16 | 32 | Up to 10 | SSD | Amazon EC2 c5.4xlarge - Geekbench |
Client tool
A simple tool written in Python to collect files in a designated folder and submit requests to MetaDefender Core.
This client tool is running on CentOS 7
x
files_to_scan = list of files to scanscan_futures = [asyncio.create_task(self.scan_file(file_path)) for file_path in files_to_scan]async def scan_file(self, file_path): api_url = f'{self.core_url}/file' with open(file_path, 'rb') as file: file_content = file.read() headers = {'Content-Type': 'application/octet-stream', 'filename': file_path} max_retries = 20 # Maximum number of retry attempts retry_delay = 120 # Delay in seconds before retrying for attempt in range(max_retries + 1): try: response = requests.post(api_url, data=file_content, headers=headers) status_code = response.status_code if status_code == 200: response_json = response.json() data_id = response_json.get('data_id') return status_code, response_json, data_id if status_code == 503: print(f"Received status code {status_code}. Retrying in {retry_delay} seconds...") await asyncio.sleep(retry_delay) else: return None, None, None except requests.RequestException as e: return None, None, None return None, None, None| OS | AWS instance type | vCPU | Memory (GB) | Network bandwidth (Gbps) | Disk type |
|---|---|---|---|---|---|
| CentOS 7 | c5.4xlarge | 16 | 32 | Up to 10 | SSD |
Dataset
Detailed information of dataset below will be used for testing:
| File category | File type | Number of files | Total size (MB) | Average file size (MB) |
|---|---|---|---|---|
| Adobe | 370 | 385 MB | 1.0 MB | |
| Executable | EXE | 45 | 309.5 MB | 6.9 MB |
| MSI | 15 | 45.75 MB | 3.1 MB | |
| Image | BMP | 80 | 515 MB | 6.4 MB |
| JPG | 420 | 237.5 MB | 0.6 MB | |
| PNG | 345 | 169 MB | 0.5 MB | |
| Media | MP3 | 135 | 865 MB | 6.4 MB |
| MP4 | 50 | 500 MB | 10.0 MB | |
| Office | DOCX | 235 | 190 MB | 0.8 MB |
| DOC | 225 | 486 MB | 2.2 MB | |
| PPTX | 365 | 860 MB | 2.4 MB | |
| PPT | 355 | 1950 MB | 5.5 MB | |
| XLSX | 340 | 283.5 MB | 0.8 MB | |
| XLS | 335 | 284.5 MB | 0.8 MB | |
| Text | CSV | 100 | 236 MB | 2.4 MB |
| HTML | 1075 | 76 MB | 0.1 MB | |
| TXT | 500 | 210 MB | 0.4 MB | |
| Archive | ZIP | Compressed files: 10 Extracted files: 270 | Compressed size: 125.5 MB Extracted size: 156.5 MB | Avg compressed size: 12.6 MB Avg extracted size: 0.6 MB |
| Summary (compressed) | 5000 | 7728.5 MB | 1.55 MB average file size | |
| Summary (extracted) | 5260 | 7759.5 MB | 1.48 MB average file size |
Product Information
Product versions:
- MetaDefender Core version 5.17.0
- Engines:
- Metascan 5: Ahnlab, Bitdefender, ClamAV, ESET, K7
- Metascan 10: Metascan 5 + Avira, Varist, IKARUS, Quick Heal, TACHYON
- Metascan MAX: Metascan 10 + Lionic, CMC, CrowdStrike Falcon ML, Aurora, Trellix, NANOV, RocketCyber, Sophos, Webroot SMD, Xvirus Anti-Malware
- Deep CDR: 7.7.0
- Proactive DLP: 3.1.0
- Archive: 7.7.0
- File type analysis: 7.7.0
- File-based vulnerability assessment: 4.57-236
MetaDefender Core settings
General settings
- Turn off data retention
- Turn off engine update
Archive extraction
- Max recursion level: 99999999
- Max number of extracted files: 99999999
- Max total size of extracted files: 99999999
- Timeout: 10 minutes
- Handle archive extraction task as Failed: true
- Extracted partially: true
Metascan
- Max file size: 99999999
- Scan timeout: 10 minutes
- Per engine scan timeout: 1 minutes
Performance test results
Summary
MetaDefender Core with single engine (technology):
| Use case | Scan duration (minutes) |
Throughput (objects/hour) |
Avg. processing time (seconds/object) |
Avg./Max CPU usage (%) |
Avg./Max RAM usage (%) |
Avg. Network speed (KB/s) |
|---|---|---|---|---|---|---|
| Metascan 5 | 12.5 | 625,680 | 0.007 | 89.1/99.5 | 29.9/34.2 | 12,802 |
| Metascan 10 | 22.1 | 353,891 | 0.01 | 87.3/99.8 | 39.8/41.0 | 10,586 |
| Metascan MAX | 38.5 | 203,143 | 0.018 | 91.2/99.9 | 54.1/64.8 | 8,193 |
| Deep CDR | 19.6 | 399,031 | 0.009 | 75.1/95.0 | 47.4/55.6 | 12,905 |
| Proactive DLP | 15.9 | 491,887 | 0.007 | 72.3/93.4 | 35.0/39.1 | 9,978 |
| Vulnerability | 11.6 | 674,224 | 0.005 | 77.8/90.7 | 31.2/34.8 | 10,945 |
| Embedded Sandbox | 213.0 | 36,718 | 0.098 | 52.0/99.2 | 59.4/69.0 | 2,723 |
MetaDefender Core with common engine packages:
| Use case | Scan duration (minutes) |
Throughput (objects/hour) |
Avg. processing time (seconds/object) |
Avg./Max CPU usage (%) |
Avg./Max RAM usage (%) |
Avg. Network speed (KB/s) |
|---|---|---|---|---|---|---|
| Metascan 5 + Deep CDR |
23.8 | 328,613 | 0.011 | 81.5/98.9 | 39.1/51.4 | 9,078 |
| Metascan 5 + Deep CDR + Proactive DLP |
29.1 | 268,763 | 0.013 | 84.8/99.0 | 43.4/55.9 | 8,173 |
| Metascan 5 + Deep CDR + Proactive DLP + Vulnerability |
30.7 | 254,756 | 0.014 | 88.3/99.6 | 47.2/60.8 | 7,845 |
| Metascan 5 + Deep CDR + Proactive DLP + Vulnerability + Embedded Sandbox |
215.8 | 36,242 | 0.0993 | 54.8/99.5 | 60.4/70.1 | 2,695 |
| Metascan 10 + Deep CDR |
32.0 | 244,406 | 0.015 | 95.8/99.5 | 48.1/62.8 | 7,510 |
| Metascan 10 + Deep CDR + Proactive DLP |
35.4 | 220,932 | 0.016 | 96.5/99.7 | 51.1/59.3 | 6,564 |
| Metascan 10 + Deep CDR + Proactive DLP + Vulnerability |
37.9 | 206,359 | 0.017 | 97.0/99.4 | 51.8/62.3 | 6,297 |
| Metascan 10 + Deep CDR + Proactive DLP + Vulnerability + Embedded Sandbox |
218.7 | 35,761 | 0.1 | 55.1/99.6 | 61.3/71.8 | 2,605 |
| Metascan MAX + Deep CDR |
57.8 | 135,311 | 0.026 | 90.8/99.2 | 70.8/79.8 | 9,106 |
| Metascan MAX + Deep CDR + Proactive DLP |
59.2 | 132,111 | 0.027 | 92.0/99.7 | 74.4/81.3 | 8,983 |
| Metascan MAX + Deep CDR + Proactive DLP + Vulnerability |
60.7 | 128,847 | 0.028 | 95.6/99.9 | 78.2/87.2 | 8,333 |
| Metascan MAX + Deep CDR + Proactive DLP + Vulnerability + Embedded Sandbox |
222.4 | 35,166 | 0.102 | 57.4/99.9 | 63.0/72.5 | 2,498 |
System resource utilization charts
MetaDefender Core with Metascan 10 + Deep CDR + Proactive DLP + Vulnerability:
| Utilization charts | |
|---|---|
| CPU usage |  |
| Memory usage |  |
| Network usage |
|
| Disk usage |   |
MetaDefender Core with Metascan MAX + Deep CDR + Proactive DLP + Vulnerability:
| Utilization charts | |
|---|---|
| CPU usage |  |
| Memory usage |  |
| Network usage |
|
| Disk usage |   |
Was this page helpful?
