1. Product Information
Product versions to be tested:
MetaDefender Kiosk 4.7.11.4940
MetaDefender Managed File Transfer 3.9.3.0
MetaDefender Core 5.16.1
Engines:
Metascan:
- 20 AV engines package + Crowdstrike when testing with CAB file
- MAX AV engines package when testing with mixed dataset
- 8 AV engines package when testing with mixed dataset
Deep CDR: 7.6.3
Proactive DLP: 3.1.0
Archive: 7.6.2
FileType: 7.6.2
File-Based Vulnerability Assessment: 4.2.416.0
2. Environment
MetaDefender Kiosk devices
Using the KIOSK devices in the local test environment. MetaDefender Core is installed on the same system as MetaDefender Kiosk.
| Model | CPU | Memory (GB) | Disk type | OS |
|---|---|---|---|---|
| Kiosk Desktop (Dell Pro 24) | Intel Core Ultra 9 285 Cores: 24 Logical processors: 24 Base speed: 2.50 GHz | 32 | SSD | Windows 10 IoT Enterprise LTSC Version: 21H2 |
| Kiosk Desktop (Dell 7420) | Intel Core i9-14900 Cores: 24 Logical processors: 32 Base speed: 2.00 GHz | 32 | SSD | Windows 10 IoT Enterprise LTSC Version: 21H2 |
| Kiosk Mobile/Mini (Dell 7230) | Intel Core i7-1260U Cores: 10 Logical processors: 12 Base speed: 1.10 GHz | 32 | SSD | Windows 10 IoT Enterprise LTSC Version: 21H2 |
| Kiosk Tower (Dell XE4) | Intel Core i9-12900 Cores: 16 Logical processors: 24 Base speed: 2.40 GHz | 32 | SSD | Windows 10 IoT Enterprise LTSC Version: 21H2 |
| Kiosk Tower (Dell XE5) | Intel Core Ultra 9 285 Cores: 24 Logical processors: 24 Base speed: 2.50 GHz | 32 | SSD | Windows 10 IoT Enterprise LTSC Version: 21H2 |
Storage Device
Using to store the dataset and connect to the Kiosk device: 128GB SanDisk USB 3.2 Gen 1
MFT Server
In case the MD Kiosk sends files to MD MFT after scanning, MD MFT is a virtual machine with the following specifications:
| OS | vCPU | Memory (GB) | Disk type | Network bandwidth (Gbps) |
|---|---|---|---|---|
| Windows Server 2022 | 8 | 16 | SSD | 10 Gb Ethernet |
Client
Using to run the Python script. The Client is a virtual machine with the following specifications:
| OS | vCPU | Memory (GB) | Disk type | Network bandwidth (Gbps) |
|---|---|---|---|---|
| CentOS Linux 7.9 | 8 | 16 | SSD | 10 Gb Ethernet |
3. Test flows
- Flow 1: MD Kiosk sends Mixed dataset to MD Core (MAX AV engines) for scanning.
- Flow 2: MD Kiosk sends Mixed dataset to MD Core (8 AV engines) for scanning.
- Flow 3: MD Kiosk sends CAB file to MD Core (21 AV engines) for scanning.
- Flow 4: MD Kiosk sends Mixed dataset to MD Core for scanning, and Allowed files are copied to MD MFT.
4. Dataset
CAB file:
- Extracted files: 849 479
- Total size of extracted files: 26.5 GB
Mixed dataset:
Summary (compressed):
- Number of files: 5000
- Total size: 7728.5 MB
- Average file size: 1.55 MB
Summary (extracted):
- Number of files: 5260
- Total size: 7759.5 MB
- Average file size: 1.48 MB
Largest file size: 24.7 MB
Smallest file size: 5 KB
| File category | File type | Number of files | Total size (MB) | Average file size (MB) |
|---|---|---|---|---|
| Adobe | 370 | 385 MB | 1.0 MB | |
| Executable | EXE | 45 | 309.5 MB | 6.9 MB |
| MSI | 15 | 45.75 MB | 3.1 MB | |
| Image | BMP | 80 | 515 MB | 6.4 MB |
| JPG | 420 | 237.5 MB | 0.6 MB | |
| PNG | 345 | 169 MB | 0.5 MB | |
| Media | MP3 | 135 | 865 MB | 6.4 MB |
| MP4 | 50 | 500 MB | 10.0 MB | |
| Office | DOCX | 235 | 190 MB | 0.8 MB |
| DOC | 225 | 486 MB | 2.2 MB | |
| PPTX | 365 | 860 MB | 2.4 MB | |
| PPT | 355 | 1950 MB | 5.5 MB | |
| XLSX | 340 | 283.5 MB | 0.8 MB | |
| XLS | 335 | 284.5 MB | 0.8 MB | |
| Text | CSV | 100 | 236 MB | 2.4 MB |
| HTML | 1075 | 76 MB | 0.1 MB | |
| TXT | 500 | 210 MB | 0.4 MB | |
| Archive | ZIP | Compressed files: 10 Extracted files: 270 | Compressed size: 125.5 MB Extracted size: 156.5 MB | Avg compressed size: 12.6 MB Avg extracted size: 0.6 MB |
5. MetaDefender Core settings
General settings
- Turn off data retention
- Turn off the engine update
- Max size:
- File scan: 9999999999999 MB
- URL file download: 9999999999999 MB
Metascan
- Enable engines depend on the testing package
- Per AV engine scan: 1 min
- Global scan: 10 mins
- File download: 5 mins
Deep CDR
- Enable engine
- 135 file types
Proactive DLP
- Enable engine
Archive Extraction
- Enable engine
- Max recursive level: 99999999
- Max number of files extracted: 99999999
- Max total size of extracted files: 99999999
- Timeout: 90 mins
Archive Compression
- Enable engine
FileType
- Enable engine
- Timeout: 5 mins
File-Based Vulnerability Assessment
- Enable engine
6. Test Summary
Flow 1: MD Kiosk sends Mixed dataset to MD Core (MAX AV engines) for scanning.
| Device | Duration | Avg. CPU Usage | Avg. Memory Usage | Avg. Disk Speed (KB/s) | Throughput (objects/hour) | Throughput (files/hour) |
|---|---|---|---|---|---|---|
| Kiosk Desktop (Dell Pro 24) | 1 hour 47 minutes | 47.6% | 77.5% | Read 6,456.6 Write 10,097.2 | 130,150 | 2,800.7 |
| Kiosk Desktop (Dell 7420) | 2 hours 48 minutes | 63.1% | 73.2% | Read 4,290.6 Write 9,063.8 | 46,624.3 | 1,791 |
| Kiosk Mobile/Mini (Dell 7230) | 3 hours 28 minutes | 60.4% | 72.8% | Read 3,493.1 Write 5,323.5 | 41,064.8 | 1,275.5 |
| Kiosk Tower (Dell 17S XE4) | 2 hours 13 minutes | 41.7% | 72.0% | Read 5,283.8 Write 7,169.6 | 58,678.4 | 2,254.2 |
| Kiosk Tower (Dell 18S XE5) | 2 hours 6 minutes | 32.9% | 77.4% | Read 4,961.2 Write 11,444.3 | 62,195.6 | 2,389.2 |
Flow 2: MD Kiosk sends Mixed dataset to MD Core (8 AV engines) for scanning.
| Device | Duration | Avg. CPU Usage | Avg. Memory Usage | Avg. Disk Speed (KB/s) | Throughput (objects/hour) | Throughput (files/hour) |
|---|---|---|---|---|---|---|
| Kiosk Desktop (Dell Pro 24) | 27 minutes | 50.7% | 47.3% | Read 13,567.8 Write 17,579.3 | 290,886.4 | 11,173.2 |
| Kiosk Desktop (Dell 7420) | 61 minutes | 52.1% | 48.4% | Read 5,852 Write 8,584.7 | 128,280.8 | 4,926.1 |
| Kiosk Mobile/Mini (Dell 7230) | 3 hours 55 minutes | 84.2% | 45.2% | Read 1,441.7 Write 3,498.2 | 33,202.8 | 1,275.5 |
| Kiosk Tower (Dell 17S XE4) | 51 minutes | 28.4% | 47.4% | Read 6,628.4 Write 9,639 | 154,497.5 | 5,934.7 |
| Kiosk Tower (Dell 18S XE5) | 53 minutes | 19.1% | 49.3% | Read 7,194.6 Write 10,277.6 | 147,710.1 | 5,672.9 |
Flow 3: MD Kiosk sends CAB file to MD Core (21 AV engines) for scanning.
| Device | Duration | Avg. CPU Usage | Avg. Memory Usage | Avg. Disk Speed (KB/s) | Throughput (objects/hour) | Throughput (files/hour) |
|---|---|---|---|---|---|---|
| Kiosk Desktop (Dell Pro 24) | 2 hours 19 minutes | 76.5% | 60.0% | Read 4,927.7 Write 24,316.9 | 367,036 | 0.4 |
| Kiosk Desktop (Dell 7420) | 4 hours 23 minutes | 77.7% | 67.0% | Read 2,368.2 Write 13,393.6 | 194,123.6 | 0.2 |
| Kiosk Mobile/Mini (Dell 7230) | 7 hours 6 minutes | 98.3% | 63.9% | Read 733.3 Write 8,951.1 | 119,509.9 | 0.1 |
| Kiosk Tower (Dell 17S XE4) | 3 hours | 83.3% | 68.0% | Read 2,941.3 Write 18,172.2 | 283,269.1 | 0.3 |
| Kiosk Tower (Dell 18S XE5) | 2 hours 17 minutes | 69.3% | 59.2% | Read 4,935.8 Write 23,847.6 | 370,929.5 | 0.4 |
Flow 4: MD Kiosk sends Mixed dataset to MD Core for scanning, and Allowed files are copied to MD MFT.
| Device | Duration | Avg. CPU Usage | Avg. Memory Usage | Avg. Disk Speed (KB/s) | Avg. Network Speed (KB/s) | Throughput (objects/hour) | Throughput (files/hour) |
|---|---|---|---|---|---|---|---|
| Kiosk Desktop (Dell Pro 24) | 39 minutes | 14.1% | 33.8% | Read 8,675.3 Write 7,063.1 | Receive 60 Send 3,721.8 | 998,655.1 | 7,758.6 |
| Kiosk Desktop (Dell 7420) | |||||||
| Kiosk Mobile/Mini (Dell 7230) | 1 hour 27 minutes | 13.3% | 33.1% | Read 4,389.7 Write 4,768.9 | Receive 30 Send 1,829.2 | 150,700.3 | 3,449.6 |
| Kiosk Tower (Dell 17S XE4) | |||||||
| Kiosk Tower (Dell 18S XE5) | 1 hour 3 minutes | 7.5% | 36.1% | Read 5,737.8 Write 7,070.9 | Receive 7,070.9 Send 2,126.5 | 157,992.7 | 4,726.9 |
