diff --git a/src/inc_internal/maat_expr.h b/src/inc_internal/maat_expr.h
index 81d781a..383f350 100644
--- a/src/inc_internal/maat_expr.h
+++ b/src/inc_internal/maat_expr.h
@@ -66,15 +66,26 @@ void expr_runtime_perf_stat(struct expr_runtime *flag_rt, size_t scan_len,
                             struct timespec *start, struct timespec *end, 
                             int thread_id);
 
+void expr_runtime_scan_times_inc(struct expr_runtime *expr_rt, int thread_id);
+
 long long expr_runtime_scan_times(void *expr_runtime);
 
 long long expr_runtime_scan_cpu_time(void *expr_runtime);
 
-long long expr_runtime_scan_bytes(struct expr_runtime *expr_rt);
+void expr_runtime_scan_bytes_add(struct expr_runtime *expr_rt, int thread_id,
+                                 size_t scan_len);
+
+long long expr_runtime_scan_bytes(void *expr_runtime);
+
+void expr_runtime_hit_times_inc(struct expr_runtime *expr_rt, int thread_id);
 
 long long expr_runtime_hit_times(void *expr_runtime);
 
-void expr_runtime_hit_times_inc(struct expr_runtime *expr_rt, int thread_id);
+void expr_runtime_stream_scan_times_inc(struct expr_runtime_stream *expr_rt_stream,
+                                        int thread_id);
+
+void expr_runtime_stream_scan_bytes_add(struct expr_runtime_stream *expr_rt_stream,
+                                        int thread_id, size_t scan_len);
 
 void expr_runtime_stream_hit_times_inc(struct expr_runtime_stream *expr_rt_stream,
                                        int thread_id);
diff --git a/src/inc_internal/maat_flag.h b/src/inc_internal/maat_flag.h
index b67d458..9b64064 100644
--- a/src/inc_internal/maat_flag.h
+++ b/src/inc_internal/maat_flag.h
@@ -58,14 +58,16 @@ int flag_runtime_set_scan_district(struct flag_runtime *flag_rt, const char *dis
 void flag_runtime_perf_stat(struct flag_runtime *flag_rt, struct timespec *start,
                             struct timespec *end, int thread_id);
 
+void flag_runtime_scan_times_inc(struct flag_runtime *flag_rt, int thread_id);
+
 long long flag_runtime_scan_times(void *flag_runtime);
 
 long long flag_runtime_scan_cpu_time(void *flag_runtime);
 
-long long flag_runtime_hit_times(void *flag_runtime);
-
 void flag_runtime_hit_times_inc(struct flag_runtime *flag_rt, int thread_id);
 
+long long flag_runtime_hit_times(void *flag_runtime);
+
 long long flag_runtime_hit_item_num(void *flag_runtime);
 
 long long flag_runtime_update_err_count(void *flag_runtime);
diff --git a/src/inc_internal/maat_interval.h b/src/inc_internal/maat_interval.h
index 5b86475..9cf6bb9 100644
--- a/src/inc_internal/maat_interval.h
+++ b/src/inc_internal/maat_interval.h
@@ -33,10 +33,12 @@ void *interval_runtime_new(void *interval_schema, size_t max_thread_num,
                            struct log_handle *logger);
 void interval_runtime_free(void *interval_runtime);
 
-int interval_runtime_update(void *interval_runtime, void *interval_schema, const char *table_name,
-                            const char *line, int valid_column);
+int interval_runtime_update(void *interval_runtime, void *interval_schema,
+                            const char *table_name, const char *line,
+                            int valid_column);
 
-int interval_runtime_commit(void *interval_runtime, const char *table_name, long long maat_rt_version);
+int interval_runtime_commit(void *interval_runtime, const char *table_name,
+                            long long maat_rt_version);
 
 long long interval_runtime_rule_count(void *interval_runtime);
 
@@ -49,17 +51,23 @@ long long interval_runtime_rule_count(void *interval_runtime);
 int interval_runtime_scan(struct interval_runtime *interval_rt, int thread_id, 
                           long long integer, int vtable_id, struct maat_state *state);
 
-int interval_runtime_set_scan_district(struct interval_runtime *interval_rt, const char *district, 
-                                       size_t district_len, long long *district_id);
+int interval_runtime_set_scan_district(struct interval_runtime *interval_rt,
+                                       const char *district, size_t district_len,
+                                       long long *district_id);
                                        
-void interval_runtime_perf_stat(struct interval_runtime *interval_rt, struct timespec *start,
-                                struct timespec *end, int thread_id);
+void interval_runtime_perf_stat(struct interval_runtime *interval_rt,
+                                struct timespec *start, struct timespec *end,
+                                int thread_id);
+
+void interval_runtime_scan_times_inc(struct interval_runtime *interval_rt,
+                                     int thread_id);
 
 long long interval_runtime_scan_times(void *interval_runtime);
 
 long long interval_runtime_scan_cpu_time(void *interval_runtime);
 
-void interval_runtime_hit_times_inc(struct interval_runtime *interval_rt, int thread_id);
+void interval_runtime_hit_times_inc(struct interval_runtime *interval_rt,
+                                    int thread_id);
 
 long long interval_runtime_hit_times(void *interval_runtime);
 
diff --git a/src/inc_internal/maat_ip.h b/src/inc_internal/maat_ip.h
index 726c99c..0d33594 100644
--- a/src/inc_internal/maat_ip.h
+++ b/src/inc_internal/maat_ip.h
@@ -47,6 +47,8 @@ int ip_runtime_scan(struct ip_runtime *ip_rt, int thread_id, int ip_type,
 void ip_runtime_perf_stat(struct ip_runtime *ip_rt, struct timespec *start,
                           struct timespec *end, int thread_id);
 
+void ip_runtime_scan_times_inc(struct ip_runtime *ip_rt, int thread_id);
+
 long long ip_runtime_scan_times(void *ip_runtime);
 
 long long ip_runtime_scan_cpu_time(void *ip_runtime);
diff --git a/src/inc_internal/maat_table.h b/src/inc_internal/maat_table.h
index 964c744..e8b804c 100644
--- a/src/inc_internal/maat_table.h
+++ b/src/inc_internal/maat_table.h
@@ -107,6 +107,8 @@ long long table_manager_runtime_rule_count(struct table_manager *tbl_mgr, int ta
 
 long long table_manager_runtime_scan_times(struct table_manager *tbl_mgr, int table_id);
 
+long long table_manager_runtime_scan_bytes(struct table_manager *tbl_mgr, int table_id);
+
 long long table_manager_runtime_hit_times(struct table_manager *tbl_mgr, int table_id);
 
 long long table_manager_runtime_scan_cpu_time(struct table_manager *tbl_mgr, int table_id);
diff --git a/src/inc_internal/maat_virtual.h b/src/inc_internal/maat_virtual.h
index e4a0104..2bf08dd 100644
--- a/src/inc_internal/maat_virtual.h
+++ b/src/inc_internal/maat_virtual.h
@@ -19,11 +19,41 @@ extern "C"
 #include "cJSON/cJSON.h"
 #include "maat_table.h"
 
+struct virtual_runtime;
+
 void *virtual_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
                          const char *table_name, struct log_handle *logger);
 
 void virtual_schema_free(void *virtual_schema);
 
+void *virtual_runtime_new(void *virtual_schema, size_t max_thread_num,
+                          struct maat_garbage_bin *garbage_bin,
+                          struct log_handle *logger);
+
+void virtual_runtime_free(void *virtual_runtime);
+
+void virtual_runtime_scan_times_inc(struct virtual_runtime *virt_rt,
+                                    int thread_id);
+
+void virtual_runtime_scan_bytes_add(struct virtual_runtime *virt_rt,
+                                    int thread_id, long long val);
+
+long long virtual_runtime_scan_bytes(void *virt_rt);
+
+long long virtual_runtime_scan_times(void *virtual_runtime);
+
+long long virtual_runtime_scan_cpu_time(void *virtual_runtime);
+
+void virtual_runtime_hit_times_inc(struct virtual_runtime *virt_rt,
+                                   int thread_id);
+
+long long virtual_runtime_hit_times(void *virtual_runtime);
+
+void virtual_runtime_hit_item_num_add(void *virtual_runtime, int thread_id,
+                                      long long val);
+
+long long virtual_runtime_hit_item_num(void *virtual_runtime);
+
 int vtable_get_physical_table_id(struct table_manager *tbl_mgr, int vtable_id);
 
 #ifdef __cplusplus
diff --git a/src/maat_api.c b/src/maat_api.c
index 677e351..cca6b60 100644
--- a/src/maat_api.c
+++ b/src/maat_api.c
@@ -1009,16 +1009,19 @@ int maat_bool_plugin_table_get_ex_data(struct maat *maat_inst, int table_id,
                                            ex_data_array, array_size);
 }
 
-static int flag_scan(struct table_manager *tbl_mgr, int thread_id, long long flag,
-                     int phy_table_id, int vtable_id, struct maat_state *state)
+static int
+flag_scan(struct table_manager *tbl_mgr, int thread_id, long long flag,
+          int phy_table_id, int vtable_id, struct maat_state *state)
 {
-    enum table_type table_type = table_manager_get_table_type(tbl_mgr, phy_table_id);
+    enum table_type table_type =
+        table_manager_get_table_type(tbl_mgr, phy_table_id);
     if (table_type == TABLE_TYPE_FLAG_PLUS && 
         DISTRICT_FLAG_UNSET == state->district_flag) {
         return -1;
     }
 
-    if (table_type != TABLE_TYPE_FLAG && table_type != TABLE_TYPE_FLAG_PLUS) {
+    if (table_type != TABLE_TYPE_FLAG &&
+        table_type != TABLE_TYPE_FLAG_PLUS) {
         return -1;
     }
 
@@ -1027,28 +1030,49 @@ static int flag_scan(struct table_manager *tbl_mgr, int thread_id, long long fla
         return -1;
     }
 
-    int group_hit_cnt = flag_runtime_scan((struct flag_runtime *)flag_rt, thread_id,
-                                          flag, vtable_id, state);
+    flag_runtime_scan_times_inc((struct flag_runtime *)flag_rt, thread_id);
+
+    void *virt_rt = NULL;
+    table_type = table_manager_get_table_type(tbl_mgr, vtable_id);
+    if (table_type == TABLE_TYPE_VIRTUAL) {
+        virt_rt = table_manager_get_runtime(tbl_mgr, vtable_id);
+        if (virt_rt != NULL) {
+            virtual_runtime_scan_times_inc((struct virtual_runtime *)virt_rt,
+                                            thread_id);
+        }
+    }
+
+    int group_hit_cnt = flag_runtime_scan((struct flag_runtime *)flag_rt,
+                                         thread_id, flag, vtable_id, state);
     if (group_hit_cnt <= 0) {
         return group_hit_cnt;
     }
 
+    if (virt_rt != NULL) {
+        //Note: group_hit_cnt is equivalent to item_hit_cnt
+        virtual_runtime_hit_item_num_add(virt_rt, thread_id, group_hit_cnt);
+        virtual_runtime_hit_times_inc((struct virtual_runtime *)virt_rt, thread_id);
+    }
+
     flag_runtime_hit_times_inc((struct flag_runtime *)flag_rt, thread_id);
 
     return group_hit_cnt;
 }
 
-static int interval_scan(struct table_manager *tbl_mgr, int thread_id, long long integer,
-                         int phy_table_id, int vtable_id, struct maat_state *state)
+static int
+interval_scan(struct table_manager *tbl_mgr, int thread_id, long long integer,
+              int phy_table_id, int vtable_id, struct maat_state *state)
 {
 
-    enum table_type table_type = table_manager_get_table_type(tbl_mgr, phy_table_id);
+    enum table_type table_type =
+        table_manager_get_table_type(tbl_mgr, phy_table_id);
     if (table_type == TABLE_TYPE_INTERVAL_PLUS && 
         DISTRICT_FLAG_UNSET == state->district_flag) {
         return -1;
     }
 
-    if (table_type != TABLE_TYPE_INTERVAL && table_type != TABLE_TYPE_INTERVAL_PLUS) {
+    if (table_type != TABLE_TYPE_INTERVAL &&
+        table_type != TABLE_TYPE_INTERVAL_PLUS) {
         return -1;
     }
 
@@ -1057,22 +1081,42 @@ static int interval_scan(struct table_manager *tbl_mgr, int thread_id, long long
         return -1;
     }
 
+    interval_runtime_scan_times_inc((struct interval_runtime *)interval_rt, thread_id);
+
+    void *virt_rt = NULL;
+    table_type = table_manager_get_table_type(tbl_mgr, vtable_id);
+    if (table_type == TABLE_TYPE_VIRTUAL) {
+        virt_rt = table_manager_get_runtime(tbl_mgr, vtable_id);
+        if (virt_rt != NULL) {
+            virtual_runtime_scan_times_inc((struct virtual_runtime *)virt_rt,
+                                            thread_id);
+        }
+    }
+
     int group_hit_cnt = interval_runtime_scan((struct interval_runtime *)interval_rt,
                                               thread_id, integer, vtable_id, state);
     if (group_hit_cnt <= 0) {
         return group_hit_cnt;
     }
 
+    if (virt_rt != NULL) {
+        //Note: group_hit_cnt is equivalent to item_hit_cnt
+        virtual_runtime_hit_item_num_add(virt_rt, thread_id, group_hit_cnt);
+        virtual_runtime_hit_times_inc((struct virtual_runtime *)virt_rt, thread_id);
+    }
+
     interval_runtime_hit_times_inc((struct interval_runtime *)interval_rt, thread_id);
 
     return group_hit_cnt;
 }
 
-static int ipv4_scan(struct table_manager *tbl_mgr, int thread_id, uint32_t ip_addr, int port,
-                     int phy_table_id, int vtable_id, struct maat_state *state)
+static int
+ipv4_scan(struct table_manager *tbl_mgr, int thread_id, uint32_t ip_addr,
+          int port, int phy_table_id, int vtable_id, struct maat_state *state)
 {
 
-    enum table_type table_type = table_manager_get_table_type(tbl_mgr, phy_table_id);
+    enum table_type table_type =
+        table_manager_get_table_type(tbl_mgr, phy_table_id);
     if (table_type != TABLE_TYPE_IP) {
         return -1;
     }
@@ -1082,23 +1126,42 @@ static int ipv4_scan(struct table_manager *tbl_mgr, int thread_id, uint32_t ip_a
         return -1;
     }
 
+    ip_runtime_scan_times_inc(ip_rt, thread_id);
+
+    void *virt_rt = NULL;
+    table_type = table_manager_get_table_type(tbl_mgr, vtable_id);
+    if (table_type == TABLE_TYPE_VIRTUAL) {
+        virt_rt = table_manager_get_runtime(tbl_mgr, vtable_id);
+        if (virt_rt != NULL) {
+            virtual_runtime_scan_times_inc((struct virtual_runtime *)virt_rt,
+                                            thread_id);
+        }
+    }
+
     int group_hit_cnt = ip_runtime_scan((struct ip_runtime *)ip_rt, thread_id, IPv4,
                                         (uint8_t *)&ip_addr, port, vtable_id, state);
     if (group_hit_cnt <= 0) {
         return group_hit_cnt;
     }
 
+    if (virt_rt != NULL) {
+        //Note: group_hit_cnt is equivalent to item_hit_cnt
+        virtual_runtime_hit_item_num_add(virt_rt, thread_id, group_hit_cnt);
+        virtual_runtime_hit_times_inc((struct virtual_runtime *)virt_rt, thread_id);
+    }
+
     ip_runtime_hit_times_inc((struct ip_runtime *)ip_rt, thread_id);
     
     return group_hit_cnt;
 }
 
-static int ipv6_scan(struct table_manager *tbl_mgr, int thread_id,
-                     uint8_t *ip_addr, int port, int phy_table_id, int vtable_id,
-                     struct maat_state *state)
+static int
+ipv6_scan(struct table_manager *tbl_mgr, int thread_id, uint8_t *ip_addr,
+          int port, int phy_table_id, int vtable_id, struct maat_state *state)
 {
 
-    enum table_type table_type = table_manager_get_table_type(tbl_mgr, phy_table_id);
+    enum table_type table_type =
+        table_manager_get_table_type(tbl_mgr, phy_table_id);
     if (table_type != TABLE_TYPE_IP) {
         return -1;
     }
@@ -1108,28 +1171,49 @@ static int ipv6_scan(struct table_manager *tbl_mgr, int thread_id,
         return -1;
     }
 
+    ip_runtime_scan_times_inc(ip_rt, thread_id);
+
+    void *virt_rt = NULL;
+    table_type = table_manager_get_table_type(tbl_mgr, vtable_id);
+    if (table_type == TABLE_TYPE_VIRTUAL) {
+        virt_rt = table_manager_get_runtime(tbl_mgr, vtable_id);
+        if (virt_rt != NULL) {
+            virtual_runtime_scan_times_inc((struct virtual_runtime *)virt_rt,
+                                            thread_id);
+        }
+    }
+
     int group_hit_cnt = ip_runtime_scan((struct ip_runtime *)ip_rt, thread_id, IPv6,
                                         ip_addr, port, vtable_id, state);
     if (group_hit_cnt <= 0) {
         return group_hit_cnt;
     }
 
+    if (virt_rt != NULL) {
+        //Note: group_hit_cnt is equivalent to item_hit_cnt
+        virtual_runtime_hit_item_num_add(virt_rt, thread_id, group_hit_cnt);
+        virtual_runtime_hit_times_inc((struct virtual_runtime *)virt_rt, thread_id);
+    }
+
     ip_runtime_hit_times_inc((struct ip_runtime *)ip_rt, thread_id);
     
     return group_hit_cnt;
 }
 
-static int string_scan(struct table_manager *tbl_mgr, int thread_id,
-                       const char *data, size_t data_len, int phy_table_id,
-                       int vtable_id, struct maat_state *state)
+static int
+string_scan(struct table_manager *tbl_mgr, int thread_id,
+            const char *data, size_t data_len, int phy_table_id,
+            int vtable_id, struct maat_state *state)
 {
-    enum table_type table_type = table_manager_get_table_type(tbl_mgr, phy_table_id);
+    enum table_type table_type =
+        table_manager_get_table_type(tbl_mgr, phy_table_id);
     if (table_type == TABLE_TYPE_EXPR_PLUS && 
         DISTRICT_FLAG_UNSET == state->district_flag) {
         return -1;
     }
 
-    if (table_type != TABLE_TYPE_EXPR && table_type != TABLE_TYPE_EXPR_PLUS) {
+    if (table_type != TABLE_TYPE_EXPR &&
+        table_type != TABLE_TYPE_EXPR_PLUS) {
         return -1;
     }
 
@@ -1137,6 +1221,21 @@ static int string_scan(struct table_manager *tbl_mgr, int thread_id,
     if (NULL == expr_rt) {
         return -1;
     }
+    
+    expr_runtime_scan_times_inc(expr_rt, thread_id);
+    expr_runtime_scan_bytes_add(expr_rt, thread_id, data_len);
+    
+    void *virt_rt = NULL;
+    table_type = table_manager_get_table_type(tbl_mgr, vtable_id);
+    if (table_type == TABLE_TYPE_VIRTUAL) {
+        virt_rt = table_manager_get_runtime(tbl_mgr, vtable_id);
+        if (virt_rt != NULL) {
+            virtual_runtime_scan_times_inc((struct virtual_runtime *)virt_rt,
+                                            thread_id);
+            virtual_runtime_scan_bytes_add((struct virtual_runtime *)virt_rt,
+                                            thread_id, data_len);
+        }
+    }
 
     int group_hit_cnt = expr_runtime_scan((struct expr_runtime *)expr_rt,
                                           thread_id, data, data_len,
@@ -1145,21 +1244,30 @@ static int string_scan(struct table_manager *tbl_mgr, int thread_id,
         return group_hit_cnt;
     }
 
+    if (virt_rt != NULL) {
+        //Note: group_hit_cnt is equivalent to item_hit_cnt
+        virtual_runtime_hit_item_num_add(virt_rt, thread_id, group_hit_cnt);
+        virtual_runtime_hit_times_inc((struct virtual_runtime *)virt_rt, thread_id);
+    }
+
     expr_runtime_hit_times_inc((struct expr_runtime *)expr_rt, thread_id);
 
     return group_hit_cnt;
 }
 
-static size_t group_to_compile(struct maat *maat_inst, long long *results,
-                               size_t n_result, struct maat_state *state)
+static size_t
+group_to_compile(struct maat *maat_inst, long long *results, size_t n_result,
+                 struct maat_state *state)
 {
-    int compile_table_id = table_manager_get_default_compile_table_id(maat_inst->tbl_mgr);
+    int compile_table_id =
+        table_manager_get_default_compile_table_id(maat_inst->tbl_mgr);
 
     if (state->compile_table_id > 0) {
         compile_table_id = state->compile_table_id;
     }
 
-    void *compile_rt = table_manager_get_runtime(maat_inst->tbl_mgr, compile_table_id);
+    void *compile_rt = table_manager_get_runtime(maat_inst->tbl_mgr,
+                                                 compile_table_id);
     if (NULL == compile_rt) {
         return 0;
     }
@@ -1291,7 +1399,8 @@ int maat_scan_integer(struct maat *maat_inst, int table_id,
     }
 
     table_type = table_manager_get_table_type(maat_inst->tbl_mgr, phy_table_id);
-    if (table_type != TABLE_TYPE_INTERVAL && table_type != TABLE_TYPE_INTERVAL_PLUS) {
+    if (table_type != TABLE_TYPE_INTERVAL &&
+        table_type != TABLE_TYPE_INTERVAL_PLUS) {
         maat_inst->stat->scan_err_cnt++;
         return MAAT_SCAN_ERR;
     }
@@ -1512,13 +1621,15 @@ inline int maat_scan_ipv6(struct maat *instance, int table_id, uint8_t *ip_addr,
                    long long *results, size_t n_result, size_t *n_hit_result,
                    struct maat_state *state)
 {
-    return maat_scan_ipv6_port(instance, table_id, ip_addr, PORT_IGNORED, results, n_result, n_hit_result, state);
+    return maat_scan_ipv6_port(instance, table_id, ip_addr, PORT_IGNORED,
+                               results, n_result, n_hit_result, state);
 }
 inline int maat_scan_ipv4(struct maat *instance, int table_id, uint32_t ip_addr,
                    long long *results, size_t n_result, size_t *n_hit_result,
                    struct maat_state *state)
 {
-    return maat_scan_ipv4_port(instance, table_id, ip_addr, PORT_IGNORED, results, n_result, n_hit_result, state);
+    return maat_scan_ipv4_port(instance, table_id, ip_addr, PORT_IGNORED,
+                               results, n_result, n_hit_result, state);
 }
 int maat_scan_string(struct maat *maat_inst, int table_id,
                      const char *data, size_t data_len,
@@ -1634,20 +1745,22 @@ static void maat_state_add_hit_group(struct maat_state *state, int table_id,
                          hit_items, n_hit_item);
 }
 
-static void maat_state_activate_hit_not_group(struct maat_state *state, int table_id)
+static void
+maat_state_activate_hit_not_group(struct maat_state *state, int table_id)
 {
     if (NULL == state) {
         return;
     }
 
     struct maat *maat_inst = state->maat_inst;
-    int compile_table_id = table_manager_get_default_compile_table_id(maat_inst->tbl_mgr);
+    int compile_table_id =
+        table_manager_get_default_compile_table_id(maat_inst->tbl_mgr);
     if (state->compile_table_id > 0) {
         compile_table_id = state->compile_table_id;
     }
 
-    struct compile_runtime *compile_rt = table_manager_get_runtime(maat_inst->tbl_mgr,
-                                                                   compile_table_id);
+    struct compile_runtime *compile_rt =
+        table_manager_get_runtime(maat_inst->tbl_mgr, compile_table_id);
     if (NULL == compile_rt) {
         return;
     }
@@ -1748,7 +1861,8 @@ struct maat_stream *maat_stream_new(struct maat *maat_inst, int table_id,
 
     table_type = table_manager_get_table_type(maat_inst->tbl_mgr, table_id);
     if (table_type == TABLE_TYPE_VIRTUAL) {
-        stream->phy_table_id = vtable_get_physical_table_id(maat_inst->tbl_mgr, table_id);
+        stream->phy_table_id = vtable_get_physical_table_id(maat_inst->tbl_mgr,
+                                                            table_id);
         stream->vtable_id = table_id;
     }
     
@@ -1756,8 +1870,10 @@ struct maat_stream *maat_stream_new(struct maat *maat_inst, int table_id,
         return NULL;
     }
 
-    table_type = table_manager_get_table_type(maat_inst->tbl_mgr, stream->phy_table_id);
-    if (table_type != TABLE_TYPE_EXPR && table_type != TABLE_TYPE_EXPR_PLUS) {
+    table_type = table_manager_get_table_type(maat_inst->tbl_mgr,
+                                              stream->phy_table_id);
+    if (table_type != TABLE_TYPE_EXPR &&
+        table_type != TABLE_TYPE_EXPR_PLUS) {
         return NULL;
     }
 
@@ -1800,16 +1916,39 @@ static int expr_stream_scan(struct maat_stream *stream, const char *data,
         return -1;
     }
 
-    if (table_type != TABLE_TYPE_EXPR && table_type != TABLE_TYPE_EXPR_PLUS) {
+    if (table_type != TABLE_TYPE_EXPR &&
+        table_type != TABLE_TYPE_EXPR_PLUS) {
         return -1;
     }
 
+    expr_runtime_stream_scan_times_inc(stream->expr_rt_stream, stream->thread_id);
+    expr_runtime_stream_scan_bytes_add(stream->expr_rt_stream, stream->thread_id,
+                                       data_len);
+
+    void *virt_rt = NULL;
+    table_type = table_manager_get_table_type(tbl_mgr, stream->vtable_id);
+    if (table_type == TABLE_TYPE_VIRTUAL) {
+        virt_rt = table_manager_get_runtime(tbl_mgr, stream->vtable_id);
+        if (virt_rt != NULL) {
+            virtual_runtime_scan_times_inc((struct virtual_runtime *)virt_rt,
+                                            stream->thread_id);
+            virtual_runtime_scan_bytes_add((struct virtual_runtime *)virt_rt,
+                                            stream->thread_id, data_len);
+        }
+    }
+
     int group_hit_cnt = expr_runtime_stream_scan(stream->expr_rt_stream, data,
                                                  data_len, stream->vtable_id, state);
     if (group_hit_cnt <= 0) {
         return group_hit_cnt;
     }
 
+    if (virt_rt != NULL) {
+        //Note: group_hit_cnt is equivalent to item_hit_cnt
+        virtual_runtime_hit_item_num_add(virt_rt, stream->thread_id, group_hit_cnt);
+        virtual_runtime_hit_times_inc((struct virtual_runtime *)virt_rt, stream->thread_id);
+    }
+
     expr_runtime_stream_hit_times_inc(stream->expr_rt_stream, stream->thread_id);
 
     return group_hit_cnt;
@@ -1923,7 +2062,9 @@ struct maat_state *maat_state_new(struct maat *maat_inst, int thread_id)
     state->district_id = DISTRICT_ANY;
     state->thread_id = thread_id;
 
-    //state->compile_state no need to alloc memory at this point, but alloc it after hitting items
+    /* state->compile_state no need to alloc memory at this point,
+       but alloc it after hitting items
+     */
     alignment_int64_array_add(maat_inst->stat->maat_state_cnt, thread_id, 1);
 
     return state;
@@ -2035,7 +2176,8 @@ int maat_state_set_scan_district(struct maat_state *state, int table_id,
     return 0;
 }
 
-int maat_state_set_scan_compile_table(struct maat_state *state, int compile_table_id)
+int maat_state_set_scan_compile_table(struct maat_state *state,
+                                      int compile_table_id)
 {
     if (NULL == state || compile_table_id < 0) {
         return -1;
@@ -2087,12 +2229,14 @@ int maat_state_get_hit_paths(struct maat_state *state, struct maat_hit_path *pat
         return 0;
     }
 
-    int compile_table_id = table_manager_get_default_compile_table_id(maat_inst->tbl_mgr);
+    int compile_table_id =
+        table_manager_get_default_compile_table_id(maat_inst->tbl_mgr);
     if (state->compile_table_id > 0) {
         compile_table_id = state->compile_table_id;
     }
 
-    void *compile_rt = table_manager_get_runtime(maat_inst->tbl_mgr, compile_table_id);
+    void *compile_rt = table_manager_get_runtime(maat_inst->tbl_mgr,
+                                                 compile_table_id);
     if (NULL == compile_rt) {
         return -1;
     }
@@ -2100,13 +2244,15 @@ int maat_state_get_hit_paths(struct maat_state *state, struct maat_hit_path *pat
     int g2g_table_id = table_manager_get_group2group_table_id(maat_inst->tbl_mgr);
     void *g2g_runtime = table_manager_get_runtime(maat_inst->tbl_mgr, g2g_table_id);
 
-    size_t hit_path_cnt = compile_state_get_internal_hit_paths(state->compile_state,
-                                                               (struct compile_runtime *)compile_rt,
-                                                               (struct group2group_runtime *)g2g_runtime,
-                                                               path_array, array_size);
+    size_t hit_path_cnt =
+        compile_state_get_internal_hit_paths(state->compile_state,
+                                            (struct compile_runtime *)compile_rt,
+                                            (struct group2group_runtime *)g2g_runtime,
+                                             path_array, array_size);
 
-    return compile_runtime_get_hit_paths((struct compile_runtime *)compile_rt, state->thread_id,
-                                         state->compile_state, path_array, array_size, hit_path_cnt);
+    return compile_runtime_get_hit_paths((struct compile_runtime *)compile_rt,
+                                         state->thread_id, state->compile_state,
+                                         path_array, array_size, hit_path_cnt);
 }
 
 size_t maat_state_get_scan_count(struct maat_state *state)
diff --git a/src/maat_expr.c b/src/maat_expr.c
index 55fcbe8..9b46268 100644
--- a/src/maat_expr.c
+++ b/src/maat_expr.c
@@ -1050,11 +1050,6 @@ int expr_runtime_scan(struct expr_runtime *expr_rt, int thread_id,
                                   n_hit_pattern);
     }
 
-    if (n_hit_item > 0) {
-        alignment_int64_array_add(expr_rt->hit_item_num, state->thread_id,
-                                  n_hit_item);
-    }
-
     struct maat_item hit_maat_items[n_hit_item];
     size_t real_hit_item_num = 0;
 
@@ -1076,11 +1071,15 @@ int expr_runtime_scan(struct expr_runtime *expr_rt, int thread_id,
 
             hit_maat_items[real_hit_item_num].item_id = item_id;
             hit_maat_items[real_hit_item_num].group_id = expr_item->group_id;
-            
             real_hit_item_num++;
         }
     }
 
+    if (real_hit_item_num > 0) {
+        alignment_int64_array_add(expr_rt->hit_item_num, state->thread_id,
+                                  real_hit_item_num);
+    }
+
 next:
     if (NULL == state->compile_state) {
         state->compile_state = compile_state_new();
@@ -1137,11 +1136,6 @@ int expr_runtime_stream_scan(struct expr_runtime_stream *expr_rt_stream,
                                   n_hit_pattern);
     }
 
-    if (n_hit_item > 0) {
-        alignment_int64_array_add(expr_rt->hit_item_num, state->thread_id,
-                                  n_hit_item);
-    }
-
     struct maat_item hit_maat_items[n_hit_item];
     struct expr_item *expr_item = NULL;
     size_t real_hit_item_cnt = 0;
@@ -1165,6 +1159,11 @@ int expr_runtime_stream_scan(struct expr_runtime_stream *expr_rt_stream,
         real_hit_item_cnt++;
     }
 
+    if (real_hit_item_cnt > 0) {
+        alignment_int64_array_add(expr_rt->hit_item_num, state->thread_id,
+                                  real_hit_item_cnt);
+    }
+
 next:
     if (NULL == state->compile_state) {
         state->compile_state = compile_state_new();
@@ -1199,9 +1198,6 @@ void expr_runtime_perf_stat(struct expr_runtime *expr_rt, size_t scan_len,
         return;
     }
 
-    alignment_int64_array_add(expr_rt->scan_times, thread_id, 1);
-    alignment_int64_array_add(expr_rt->scan_bytes, thread_id, scan_len);
-
     if (start != NULL && end != NULL) {
         long long consume_time = (end->tv_sec - start->tv_sec) * 1000000000 +
                                  (end->tv_nsec - start->tv_nsec);
@@ -1209,6 +1205,39 @@ void expr_runtime_perf_stat(struct expr_runtime *expr_rt, size_t scan_len,
     }
 }
 
+void expr_runtime_scan_bytes_add(struct expr_runtime *expr_rt, int thread_id,
+                                 size_t scan_len)
+{
+    if (NULL == expr_rt || thread_id < 0 || 0 == scan_len) {
+        return;
+    }
+
+    alignment_int64_array_add(expr_rt->scan_bytes, thread_id, scan_len);
+}
+
+long long expr_runtime_scan_bytes(void *expr_runtime)
+{
+    if (NULL == expr_runtime) {
+        return 0;
+    }
+
+    struct expr_runtime *expr_rt = (struct expr_runtime *)expr_runtime;
+    long long sum = alignment_int64_array_sum(expr_rt->scan_bytes, 
+                                              expr_rt->n_worker_thread);
+    alignment_int64_array_reset(expr_rt->scan_bytes, expr_rt->n_worker_thread);
+
+    return sum;
+}
+
+void expr_runtime_scan_times_inc(struct expr_runtime *expr_rt, int thread_id)
+{
+    if (NULL == expr_rt || thread_id < 0) {
+        return;
+    } 
+
+    alignment_int64_array_add(expr_rt->scan_times, thread_id, 1);
+}
+
 long long expr_runtime_scan_times(void *expr_runtime)
 {
     if (NULL == expr_runtime) {
@@ -1237,6 +1266,28 @@ long long expr_runtime_scan_cpu_time(void *expr_runtime)
     return sum;
 }
 
+void expr_runtime_stream_scan_times_inc(struct expr_runtime_stream *expr_rt_stream,
+                                        int thread_id)
+{
+    if (NULL == expr_rt_stream || thread_id < 0) {
+        return;
+    }
+
+    struct expr_runtime *expr_rt = expr_rt_stream->ref_expr_rt;
+    alignment_int64_array_add(expr_rt->scan_times, thread_id, 1);
+}
+
+void expr_runtime_stream_scan_bytes_add(struct expr_runtime_stream *expr_rt_stream,
+                                        int thread_id, size_t scan_len)
+{
+     if (NULL == expr_rt_stream || thread_id < 0) {
+        return;
+    }
+
+     struct expr_runtime *expr_rt = expr_rt_stream->ref_expr_rt;
+    alignment_int64_array_add(expr_rt->scan_bytes, thread_id, scan_len);
+}
+
 void expr_runtime_hit_times_inc(struct expr_runtime *expr_rt, int thread_id)
 {
     if (NULL == expr_rt || thread_id < 0) {
@@ -1309,17 +1360,4 @@ long long expr_runtime_update_err_count(void *expr_runtime)
 
     struct expr_runtime *expr_rt = (struct expr_runtime *)expr_runtime;
     return expr_rt->update_err_cnt;
-}
-
-long long expr_runtime_scan_bytes(struct expr_runtime *expr_rt)
-{
-    if (NULL == expr_rt) {
-        return 0;
-    }
-
-    long long sum = alignment_int64_array_sum(expr_rt->scan_bytes, 
-                                              expr_rt->n_worker_thread);
-    alignment_int64_array_reset(expr_rt->scan_bytes, expr_rt->n_worker_thread);
-
-    return sum;
 }
\ No newline at end of file
diff --git a/src/maat_flag.c b/src/maat_flag.c
index 4c6ab7d..52fe57a 100644
--- a/src/maat_flag.c
+++ b/src/maat_flag.c
@@ -567,16 +567,12 @@ int flag_runtime_scan(struct flag_runtime *flag_rt, int thread_id,
     }
 
     struct flag_result hit_results[MAX_HIT_ITEM_NUM];
-    int n_hit_item = flag_matcher_match(flag_rt->matcher, flag, hit_results, MAX_HIT_ITEM_NUM);
+    int n_hit_item = flag_matcher_match(flag_rt->matcher, flag, hit_results,
+                                        MAX_HIT_ITEM_NUM);
     if (n_hit_item < 0) {
         return -1;
     }
 
-    if (n_hit_item > 0) {
-        alignment_int64_array_add(flag_rt->hit_item_num, state->thread_id,
-                                  n_hit_item);
-    }
-    
     struct maat_item hit_maat_items[n_hit_item];
     size_t real_hit_item_cnt = 0;
 
@@ -586,11 +582,13 @@ int flag_runtime_scan(struct flag_runtime *flag_rt, int thread_id,
 
     for (int i = 0; i < n_hit_item; i++) {
         int tag_district_id = *(int *)(hit_results[i].user_tag);
-        if (tag_district_id == state->district_id || tag_district_id == DISTRICT_ANY) {
+        if (tag_district_id == state->district_id ||
+            tag_district_id == DISTRICT_ANY) {
             long long item_id = hit_results[i].rule_id;
-            struct flag_item *flag_item = (struct flag_item *)rcu_hash_find(flag_rt->item_hash, 
-                                                                            (char *)&item_id,
-                                                                            sizeof(long long));
+            struct flag_item *flag_item =
+                (struct flag_item *)rcu_hash_find(flag_rt->item_hash, 
+                                                  (char *)&item_id,
+                                                  sizeof(long long));
             if (!flag_item) {
                 // item config has been deleted
                 continue;
@@ -602,6 +600,11 @@ int flag_runtime_scan(struct flag_runtime *flag_rt, int thread_id,
         }
     }
 
+    if (real_hit_item_cnt > 0) {
+        alignment_int64_array_add(flag_rt->hit_item_num, state->thread_id,
+                                  real_hit_item_cnt);
+    }
+
 next:
     if (NULL == state->compile_state) {
         state->compile_state = compile_state_new();
@@ -621,8 +624,6 @@ void flag_runtime_perf_stat(struct flag_runtime *flag_rt, struct timespec *start
         return;
     }
 
-    alignment_int64_array_add(flag_rt->scan_times, thread_id, 1);
-
     if (start != NULL && end != NULL) {
         long long consume_time = (end->tv_sec - start->tv_sec) * 1000000000 + 
                                  (end->tv_nsec - start->tv_nsec);
@@ -630,6 +631,15 @@ void flag_runtime_perf_stat(struct flag_runtime *flag_rt, struct timespec *start
     }
 }
 
+void flag_runtime_hit_times_inc(struct flag_runtime *flag_rt, int thread_id)
+{
+    if (NULL == flag_rt || thread_id < 0) {
+        return;
+    }
+
+    alignment_int64_array_add(flag_rt->hit_times, thread_id, 1);
+}
+
 long long flag_runtime_hit_times(void *flag_runtime)
 {
     if (NULL == flag_runtime) {
@@ -645,15 +655,6 @@ long long flag_runtime_hit_times(void *flag_runtime)
     return sum;
 }
 
-void flag_runtime_hit_times_inc(struct flag_runtime *flag_rt, int thread_id)
-{
-    if (NULL == flag_rt || thread_id < 0) {
-        return;
-    }
-
-    alignment_int64_array_add(flag_rt->hit_times, thread_id, 1);
-}
-
 long long flag_runtime_hit_item_num(void *flag_runtime)
 {
     if (NULL == flag_runtime) {
@@ -669,6 +670,15 @@ long long flag_runtime_hit_item_num(void *flag_runtime)
     return sum;
 }
 
+void flag_runtime_scan_times_inc(struct flag_runtime *flag_rt, int thread_id)
+{
+    if (NULL == flag_rt || thread_id < 0) {
+        return;
+    }
+
+    alignment_int64_array_add(flag_rt->scan_times, thread_id, 1);
+}
+
 long long flag_runtime_scan_times(void *flag_runtime)
 {
     if (NULL == flag_runtime) {
@@ -693,7 +703,8 @@ long long flag_runtime_scan_cpu_time(void *flag_runtime)
     struct flag_runtime *flag_rt = (struct flag_runtime *)flag_runtime;
     long long sum = alignment_int64_array_sum(flag_rt->scan_cpu_time, 
                                               flag_rt->n_worker_thread);
-    alignment_int64_array_reset(flag_rt->scan_cpu_time, flag_rt->n_worker_thread);
+    alignment_int64_array_reset(flag_rt->scan_cpu_time,
+                                flag_rt->n_worker_thread);
 
     return sum;
 }
diff --git a/src/maat_interval.c b/src/maat_interval.c
index 65284de..3d7a825 100644
--- a/src/maat_interval.c
+++ b/src/maat_interval.c
@@ -468,7 +468,8 @@ int interval_runtime_commit(void *interval_runtime, const char *table_name,
         return -1;
     }
 
-    struct interval_runtime *interval_rt = (struct interval_runtime *)interval_runtime;
+    struct interval_runtime *interval_rt =
+        (struct interval_runtime *)interval_runtime;
 
     int updating_flag = rcu_hash_is_updating(interval_rt->item_hash);
     if (0 == updating_flag) {
@@ -490,7 +491,8 @@ int interval_runtime_commit(void *interval_runtime, const char *table_name,
     if (rule_cnt > 0) {
         rules = ALLOC(struct interval_rule, rule_cnt);
         for (size_t i = 0; i < rule_cnt; i++) {
-            struct interval_item *interval_item = (struct interval_item *)ex_data_array[i];
+            struct interval_item *interval_item =
+                (struct interval_item *)ex_data_array[i];
             rules[i] = interval_item_to_interval_rule(interval_item);
         }
     }
@@ -549,7 +551,8 @@ long long interval_runtime_rule_count(void *interval_runtime)
         return 0;
     }
     
-    struct interval_runtime *interval_rt = (struct interval_runtime *)interval_runtime;
+    struct interval_runtime *interval_rt =
+        (struct interval_runtime *)interval_runtime;
     return interval_rt->rule_num;
 }
 
@@ -572,11 +575,6 @@ int interval_runtime_scan(struct interval_runtime *interval_rt, int thread_id,
         return -1;
     }
 
-    if (n_hit_item > 0) {
-        alignment_int64_array_add(interval_rt->hit_item_num, state->thread_id,
-                                  n_hit_item);
-    }
-
     struct maat_item hit_maat_items[n_hit_item];
     size_t real_hit_item_cnt = 0;
     
@@ -586,11 +584,13 @@ int interval_runtime_scan(struct interval_runtime *interval_rt, int thread_id,
 
     for (int i = 0; i < n_hit_item; i++) {
         int tag_district_id = *(int *)(hit_results[i].user_tag);
-        if (tag_district_id == state->district_id || tag_district_id == DISTRICT_ANY) {
+        if (tag_district_id == state->district_id ||
+            tag_district_id == DISTRICT_ANY) {
             long long item_id = hit_results[i].rule_id;
-            struct interval_item *int_item = (struct interval_item *)rcu_hash_find(interval_rt->item_hash, 
-                                                                                  (char *)&item_id,
-                                                                                  sizeof(long long));
+            struct interval_item *int_item =
+                (struct interval_item *)rcu_hash_find(interval_rt->item_hash, 
+                                                     (char *)&item_id,
+                                                      sizeof(long long));
             if (!int_item) {
                 // item config has been deleted
                 continue;
@@ -602,6 +602,11 @@ int interval_runtime_scan(struct interval_runtime *interval_rt, int thread_id,
         }
     }
 
+    if (real_hit_item_cnt > 0) {
+        alignment_int64_array_add(interval_rt->hit_item_num, state->thread_id,
+                                  real_hit_item_cnt);
+    }
+
 next:
     if (NULL == state->compile_state) {
         state->compile_state = compile_state_new();
@@ -622,8 +627,6 @@ void interval_runtime_perf_stat(struct interval_runtime *interval_rt,
         return;
     }
 
-    alignment_int64_array_add(interval_rt->scan_times, thread_id, 1);
-    
     if (start != NULL && end != NULL) {
         long long consume_time = (end->tv_sec - start->tv_sec) * 1000000000 +
                                  (end->tv_nsec - start->tv_nsec);
@@ -631,22 +634,8 @@ void interval_runtime_perf_stat(struct interval_runtime *interval_rt,
     }
 }
 
-long long interval_runtime_hit_times(void *interval_runtime)
-{
-    if (NULL == interval_runtime) {
-        return 0;
-    }
-
-    struct interval_runtime *interval_rt = (struct interval_runtime *)interval_runtime;
-    long long sum = alignment_int64_array_sum(interval_rt->hit_times,
-                                              interval_rt->n_worker_thread);
-    alignment_int64_array_reset(interval_rt->hit_times,
-                                interval_rt->n_worker_thread);
-
-    return sum;
-}
-
-void interval_runtime_hit_times_inc(struct interval_runtime *interval_rt, int thread_id)
+void interval_runtime_hit_times_inc(struct interval_runtime *interval_rt,
+                                    int thread_id)
 {
     if (NULL == interval_rt || thread_id < 0) {
         return;
@@ -655,13 +644,42 @@ void interval_runtime_hit_times_inc(struct interval_runtime *interval_rt, int th
     alignment_int64_array_add(interval_rt->hit_times, thread_id, 1);
 }
 
+long long interval_runtime_hit_times(void *interval_runtime)
+{
+    if (NULL == interval_runtime) {
+        return 0;
+    }
+
+    struct interval_runtime *interval_rt =
+        (struct interval_runtime *)interval_runtime;
+
+    long long sum = alignment_int64_array_sum(interval_rt->hit_times,
+                                              interval_rt->n_worker_thread);
+    alignment_int64_array_reset(interval_rt->hit_times,
+                                interval_rt->n_worker_thread);
+
+    return sum;
+}
+
+void interval_runtime_scan_times_inc(struct interval_runtime *interval_rt,
+                                     int thread_id)
+{
+    if (NULL == interval_rt || thread_id < 0) {
+        return;
+    }
+
+    alignment_int64_array_add(interval_rt->scan_times, thread_id, 1);
+}
+
 long long interval_runtime_scan_times(void *interval_runtime)
 {
     if (NULL == interval_runtime) {
         return 0;
     }
 
-    struct interval_runtime *interval_rt = (struct interval_runtime *)interval_runtime;
+    struct interval_runtime *interval_rt =
+        (struct interval_runtime *)interval_runtime;
+
     long long sum = alignment_int64_array_sum(interval_rt->scan_times,
                                               interval_rt->n_worker_thread);
     alignment_int64_array_reset(interval_rt->scan_times,
@@ -676,7 +694,9 @@ long long interval_runtime_scan_cpu_time(void *interval_runtime)
         return 0;
     }
 
-    struct interval_runtime *interval_rt = (struct interval_runtime *)interval_runtime;
+    struct interval_runtime *interval_rt =
+        (struct interval_runtime *)interval_runtime;
+
     long long sum = alignment_int64_array_sum(interval_rt->scan_cpu_time, 
                                               interval_rt->n_worker_thread);
     alignment_int64_array_reset(interval_rt->scan_cpu_time,
@@ -691,7 +711,9 @@ long long interval_runtime_hit_item_num(void *interval_runtime)
         return 0;
     }
 
-    struct interval_runtime *interval_rt = (struct interval_runtime *)interval_runtime;
+    struct interval_runtime *interval_rt =
+        (struct interval_runtime *)interval_runtime;
+
     long long sum = alignment_int64_array_sum(interval_rt->hit_item_num,
                                               interval_rt->n_worker_thread);
     alignment_int64_array_reset(interval_rt->hit_item_num,
@@ -706,6 +728,8 @@ long long interval_runtime_update_err_cnt(void *interval_runtime)
         return 0;
     }
 
-    struct interval_runtime *interval_rt = (struct interval_runtime *)interval_runtime;
+    struct interval_runtime *interval_rt =
+        (struct interval_runtime *)interval_runtime;
+
     return interval_rt->update_err_cnt;
 }
\ No newline at end of file
diff --git a/src/maat_ip.c b/src/maat_ip.c
index 02616a0..eeed055 100644
--- a/src/maat_ip.c
+++ b/src/maat_ip.c
@@ -680,8 +680,6 @@ void ip_runtime_perf_stat(struct ip_runtime *ip_rt, struct timespec *start,
         return;
     }
 
-    alignment_int64_array_add(ip_rt->scan_times, thread_id, 1);
-    
     if (start != NULL && end != NULL) {
         long long consume_time = (end->tv_sec - start->tv_sec) * 1000000000 +
                                  (end->tv_nsec - start->tv_nsec);
@@ -689,6 +687,15 @@ void ip_runtime_perf_stat(struct ip_runtime *ip_rt, struct timespec *start,
     }
 }
 
+void ip_runtime_scan_times_inc(struct ip_runtime *ip_rt, int thread_id)
+{
+    if (NULL == ip_rt || thread_id < 0) {
+        return;
+    }
+
+    alignment_int64_array_add(ip_rt->scan_times, thread_id, 1);
+}
+
 long long ip_runtime_scan_times(void *ip_runtime)
 {
     if (NULL == ip_runtime) {
@@ -718,6 +725,15 @@ long long ip_runtime_scan_cpu_time(void *ip_runtime)
     return sum;
 }
 
+void ip_runtime_hit_times_inc(struct ip_runtime *ip_rt, int thread_id)
+{
+    if (NULL == ip_rt || thread_id < 0) {
+        return;
+    }
+
+    alignment_int64_array_add(ip_rt->hit_times, thread_id, 1);
+}
+
 long long ip_runtime_hit_times(void *ip_runtime)
 {
     if (NULL == ip_runtime) {
@@ -733,15 +749,6 @@ long long ip_runtime_hit_times(void *ip_runtime)
     return sum;
 }
 
-void ip_runtime_hit_times_inc(struct ip_runtime *ip_rt, int thread_id)
-{
-    if (NULL == ip_rt || thread_id < 0) {
-        return;
-    }
-
-    alignment_int64_array_add(ip_rt->hit_times, thread_id, 1);
-}
-
 long long ip_runtime_hit_item_num(void *ip_runtime)
 {
     if (NULL == ip_runtime) {
diff --git a/src/maat_stat.c b/src/maat_stat.c
index 7c21cd0..938e10d 100644
--- a/src/maat_stat.c
+++ b/src/maat_stat.c
@@ -239,7 +239,7 @@ int maat_stat_init(struct maat_stat *stat, struct table_manager *tbl_mgr,
 static void fs_table_row_output(FILE *fp, struct maat_stat *stat, int perf_on)
 {
     long long plugin_cache_num = 0, plugin_rule_num = 0;
-    long long total_rule_num = 0, total_input_bytes = 0, total_update_err = 0;
+    long long total_rule_num = 0, total_scan_bytes = 0, total_update_err = 0;
     long long total_scan_times = 0, total_hit_times = 0, total_scan_cpu_time = 0;
     long long total_regex_num = 0, total_ipv6_num = 0;
     long long total_hit_item_num = 0, total_hit_pattern_num = 0;
@@ -288,59 +288,56 @@ static void fs_table_row_output(FILE *fp, struct maat_stat *stat, int perf_on)
                 break;
         }
 
-        if (table_type == TABLE_TYPE_VIRTUAL) {
-            continue;
-        }
-
-        total_regex_num += regex_rule_num;
-        total_ipv6_num += ipv6_rule_num;
-
         long long rule_num =
             table_manager_runtime_rule_count(stat->ref_tbl_mgr, i);
-
         cell_tag.value_str = stat->tag_value[i];
         fieldstat_easy_counter_set(stat->fs_handle, 0,
                                    stat->fs_column_id[COLUMN_RULE_NUM],
                                    &cell_tag, 1, rule_num);
-        total_rule_num += rule_num;
-
+        
         long long scan_times =
             table_manager_runtime_scan_times(stat->ref_tbl_mgr, i);
-
         fieldstat_easy_counter_set(stat->fs_handle, 0,
                                    stat->fs_column_id[COLUMN_SCAN_TIMES],
                                    &cell_tag, 1, scan_times);
-        total_scan_times += scan_times;
-
+        
         long long hit_times =
             table_manager_runtime_hit_times(stat->ref_tbl_mgr, i);
-
         fieldstat_easy_counter_set(stat->fs_handle, 0,
                                    stat->fs_column_id[COLUMN_HIT_TIMES],
                                    &cell_tag, 1, hit_times);
-        total_hit_times += hit_times;
 
-        if (table_type == TABLE_TYPE_PLUGIN ||
-            table_type == TABLE_TYPE_IP_PLUGIN ||
-            table_type == TABLE_TYPE_IPPORT_PLUGIN ||
-            table_type == TABLE_TYPE_BOOL_PLUGIN ||
-            table_type == TABLE_TYPE_FQDN_PLUGIN) {
-            continue;
-        }
+        long long scan_bytes =
+            table_manager_runtime_scan_bytes(stat->ref_tbl_mgr, i);
+        fieldstat_easy_counter_set(stat->fs_handle, 0,
+                                   stat->fs_column_id[COLUMN_SCAN_BYTES],
+                                   &cell_tag, 1, scan_bytes);
+
+        long long hit_item_num =
+            table_manager_runtime_hit_item_num(stat->ref_tbl_mgr, i);
+
+        fieldstat_easy_counter_set(stat->fs_handle, 0,
+                                   stat->fs_column_id[COLUMN_HIT_ITEM_NUM],
+                                   &cell_tag, 1, hit_item_num); 
+
+        if (table_type != TABLE_TYPE_VIRTUAL) {
+            total_regex_num += regex_rule_num;
+            total_ipv6_num += ipv6_rule_num;
+            total_rule_num += rule_num;
+            total_scan_times += scan_times;
+            total_hit_times += hit_times;
+            total_scan_bytes += scan_bytes;
+            total_hit_item_num += hit_item_num;
+            total_update_err +=
+            table_manager_runtime_update_err_count(stat->ref_tbl_mgr, i);
+        } 
 
-        long long input_bytes = 0;
         if (table_type == TABLE_TYPE_EXPR ||
             table_type == TABLE_TYPE_EXPR_PLUS) {
             fieldstat_easy_counter_set(stat->fs_handle, 0,
                                        stat->fs_column_id[COLUMN_REGEX_NUM],
                                        &cell_tag, 1, regex_rule_num);
 
-            input_bytes = expr_runtime_scan_bytes(runtime);
-            fieldstat_easy_counter_set(stat->fs_handle, 0,
-                                       stat->fs_column_id[COLUMN_SCAN_BYTES],
-                                       &cell_tag, 1, input_bytes);
-            total_input_bytes += input_bytes;
-
             long long hit_pattern_num = expr_runtime_hit_pattern_num(runtime);
             fieldstat_easy_counter_set(stat->fs_handle, 0,
                                        stat->fs_column_id[COLUMN_HIT_PAT_NUM],
@@ -354,6 +351,14 @@ static void fs_table_row_output(FILE *fp, struct maat_stat *stat, int perf_on)
                                        &cell_tag, 1, ipv6_rule_num);
         }
 
+        if (table_type == TABLE_TYPE_PLUGIN ||
+            table_type == TABLE_TYPE_IP_PLUGIN ||
+            table_type == TABLE_TYPE_IPPORT_PLUGIN ||
+            table_type == TABLE_TYPE_BOOL_PLUGIN ||
+            table_type == TABLE_TYPE_FQDN_PLUGIN) {
+            continue;
+        }
+
         if (1 == perf_on) {
             long long scan_cpu_time =
                 table_manager_runtime_scan_cpu_time(stat->ref_tbl_mgr, i);
@@ -362,17 +367,6 @@ static void fs_table_row_output(FILE *fp, struct maat_stat *stat, int perf_on)
                                        stat->fs_column_id[COLUMN_SCAN_CPU_TIME],
                                        &cell_tag, 1, scan_cpu_time); 
         }
-
-        long long hit_item_num =
-            table_manager_runtime_hit_item_num(stat->ref_tbl_mgr, i);
-
-        fieldstat_easy_counter_set(stat->fs_handle, 0,
-                                   stat->fs_column_id[COLUMN_HIT_ITEM_NUM],
-                                   &cell_tag, 1, hit_item_num); 
-        total_hit_item_num += hit_item_num;
-
-        total_update_err +=
-            table_manager_runtime_update_err_count(stat->ref_tbl_mgr, i);
     }
 
     cell_tag.value_str = stat->sum_tag;
@@ -396,7 +390,7 @@ static void fs_table_row_output(FILE *fp, struct maat_stat *stat, int perf_on)
                                &cell_tag, 1, total_hit_pattern_num);
     fieldstat_easy_counter_set(stat->fs_handle, 0,
                                stat->fs_column_id[COLUMN_SCAN_BYTES],
-                               &cell_tag, 1, total_input_bytes);
+                               &cell_tag, 1, total_scan_bytes);
     if (1 == perf_on) {
         fieldstat_easy_counter_set(stat->fs_handle, 0,
                                    stat->fs_column_id[COLUMN_SCAN_CPU_TIME],
diff --git a/src/maat_table.c b/src/maat_table.c
index 3240a11..a8295c4 100644
--- a/src/maat_table.c
+++ b/src/maat_table.c
@@ -84,6 +84,8 @@ struct table_operations {
 
     long long (*scan_times)(void *runtime);
 
+    long long (*scan_bytes)(void *runtime);
+
     long long (*scan_cpu_time)(void *runtime);
 
     long long (*hit_times)(void *runtime);
@@ -134,6 +136,7 @@ struct table_operations table_ops[TABLE_TYPE_MAX] = {
         .commit_runtime = expr_runtime_commit,
         .rule_count = expr_runtime_rule_count,
         .scan_times = expr_runtime_scan_times,
+        .scan_bytes = expr_runtime_scan_bytes,
         .scan_cpu_time = expr_runtime_scan_cpu_time,
         .hit_times = expr_runtime_hit_times,
         .hit_item_num = expr_runtime_hit_item_num,
@@ -149,6 +152,7 @@ struct table_operations table_ops[TABLE_TYPE_MAX] = {
         .commit_runtime = expr_runtime_commit,
         .rule_count = expr_runtime_rule_count,
         .scan_times = expr_runtime_scan_times,
+        .scan_bytes = expr_runtime_scan_bytes,
         .scan_cpu_time = expr_runtime_scan_cpu_time,
         .hit_times = expr_runtime_hit_times,
         .hit_item_num = expr_runtime_hit_item_num,
@@ -263,10 +267,15 @@ struct table_operations table_ops[TABLE_TYPE_MAX] = {
         .type = TABLE_TYPE_VIRTUAL,
         .new_schema = virtual_schema_new,
         .free_schema = virtual_schema_free,
-        .new_runtime = NULL,
-        .free_runtime = NULL,
+        .new_runtime = virtual_runtime_new,
+        .free_runtime = virtual_runtime_free,
         .update_runtime = NULL,
-        .commit_runtime = NULL
+        .commit_runtime = NULL,
+        .scan_times = virtual_runtime_scan_times,
+        .scan_bytes = virtual_runtime_scan_bytes,
+        .scan_cpu_time = virtual_runtime_scan_cpu_time,
+        .hit_times = virtual_runtime_hit_times,
+        .hit_item_num = virtual_runtime_hit_item_num
     },
     {
         .type = TABLE_TYPE_COMPILE,
@@ -1402,6 +1411,28 @@ long long table_manager_runtime_scan_times(struct table_manager *tbl_mgr, int ta
     return table_ops[table_type].scan_times(runtime);
 }
 
+long long table_manager_runtime_scan_bytes(struct table_manager *tbl_mgr, int table_id)
+{
+    void *runtime = table_manager_get_runtime(tbl_mgr, table_id);
+    if (NULL == runtime) {
+        return 0;
+    }
+
+    enum table_type table_type = table_manager_get_table_type(tbl_mgr, table_id);
+    if (table_type == TABLE_TYPE_INVALID) {
+        log_fatal(tbl_mgr->logger, MODULE_TABLE, 
+                  "[%s:%d] table(table_id:%d) table_type is invalid, can't get scan bytes",
+                  __FUNCTION__, __LINE__, table_id);
+        return 0;
+    }
+
+    if (NULL == table_ops[table_type].scan_bytes) {
+        return 0;
+    }
+
+    return table_ops[table_type].scan_bytes(runtime);
+}
+
 long long table_manager_runtime_hit_times(struct table_manager *tbl_mgr, int table_id)
 {
     void *runtime = table_manager_get_runtime(tbl_mgr, table_id);
diff --git a/src/maat_virtual.c b/src/maat_virtual.c
index 85f9ab8..8b1f5ff 100644
--- a/src/maat_virtual.c
+++ b/src/maat_virtual.c
@@ -13,6 +13,7 @@
 #include "maat_kv.h"
 #include "maat_utils.h"
 #include "log/log.h"
+#include "alignment.h"
 #include "maat_rule.h"
 #include "maat_table.h"
 
@@ -24,6 +25,15 @@ struct virtual_schema {
     struct table_manager *ref_tbl_mgr;
 };
 
+struct virtual_runtime {
+    size_t n_worker_thread;
+    long long *scan_times;
+    long long *scan_bytes;
+    long long *scan_cpu_time;
+    long long *hit_times;
+    long long *hit_item_num;
+};
+
 void *virtual_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
                          const char *table_name, struct log_handle *logger)
 {
@@ -66,6 +76,178 @@ void virtual_schema_free(void *virtual_schema)
     FREE(virtual_schema);
 }
 
+void *virtual_runtime_new(void *virtual_schema, size_t max_thread_num,
+                          struct maat_garbage_bin *garbage_bin,
+                          struct log_handle *logger)
+{
+    if (NULL == virtual_schema) {
+        return NULL;
+    }
+
+    struct virtual_runtime *virt_rt = ALLOC(struct virtual_runtime, 1);
+
+    virt_rt->n_worker_thread = max_thread_num;
+    virt_rt->scan_times = alignment_int64_array_alloc(max_thread_num);
+    virt_rt->scan_bytes = alignment_int64_array_alloc(max_thread_num);
+    virt_rt->scan_cpu_time = alignment_int64_array_alloc(max_thread_num);
+    virt_rt->hit_times = alignment_int64_array_alloc(max_thread_num);
+    virt_rt->hit_item_num = alignment_int64_array_alloc(max_thread_num);
+
+    return virt_rt;
+}
+
+void virtual_runtime_free(void *virtual_runtime)
+{
+    if (NULL == virtual_runtime) {
+        return;
+    }
+
+    struct virtual_runtime *virt_rt = (struct virtual_runtime *)virtual_runtime; 
+
+    if (virt_rt->scan_times != NULL) {
+        alignment_int64_array_free(virt_rt->scan_times);
+        virt_rt->scan_times = NULL;
+    }
+
+    if (virt_rt->scan_bytes != NULL) {
+        alignment_int64_array_free(virt_rt->scan_bytes);
+        virt_rt->scan_bytes = NULL;
+    }
+
+    if (virt_rt->scan_cpu_time != NULL) {
+        alignment_int64_array_free(virt_rt->scan_cpu_time);
+        virt_rt->scan_cpu_time = NULL;
+    }
+
+    if (virt_rt->hit_times != NULL) {
+        alignment_int64_array_free(virt_rt->hit_times);
+        virt_rt->hit_times = NULL;
+    }
+
+    if (virt_rt->hit_item_num != NULL) {
+        alignment_int64_array_free(virt_rt->hit_item_num);
+        virt_rt->hit_item_num = NULL;
+    }
+
+    FREE(virt_rt);
+}
+
+void virtual_runtime_scan_bytes_add(struct virtual_runtime *virt_rt,
+                                    int thread_id, long long val)
+{
+    if (NULL == virt_rt || thread_id < 0) {
+        return;
+    } 
+
+    alignment_int64_array_add(virt_rt->scan_bytes, thread_id, val);
+}
+
+long long virtual_runtime_scan_bytes(void *virtual_runtime)
+{
+    if (NULL == virtual_runtime) {
+        return 0;
+    }
+
+    struct virtual_runtime *virt_rt = (struct virtual_runtime *)virtual_runtime; 
+    long long sum = alignment_int64_array_sum(virt_rt->scan_bytes,
+                                              virt_rt->n_worker_thread);
+    alignment_int64_array_reset(virt_rt->scan_bytes,
+                                virt_rt->n_worker_thread);
+
+    return sum; 
+}
+
+void virtual_runtime_scan_times_inc(struct virtual_runtime *virt_rt,
+                                    int thread_id)
+{
+    if (NULL == virt_rt || thread_id < 0) {
+        return;
+    }
+
+    alignment_int64_array_add(virt_rt->scan_times, thread_id, 1);
+}
+
+long long virtual_runtime_scan_times(void *virtual_runtime)
+{
+    if (NULL == virtual_runtime) {
+        return 0;
+    }
+
+    struct virtual_runtime *virt_rt = (struct virtual_runtime *)virtual_runtime; 
+    long long sum = alignment_int64_array_sum(virt_rt->scan_times,
+                                              virt_rt->n_worker_thread);
+    alignment_int64_array_reset(virt_rt->scan_times,
+                                virt_rt->n_worker_thread);
+
+    return sum; 
+}
+
+long long virtual_runtime_scan_cpu_time(void *virtual_runtime)
+{
+    if (NULL == virtual_runtime) {
+        return 0;
+    }
+
+    struct virtual_runtime *virt_rt = (struct virtual_runtime *)virtual_runtime; 
+    long long sum = alignment_int64_array_sum(virt_rt->scan_cpu_time,
+                                              virt_rt->n_worker_thread);
+    alignment_int64_array_reset(virt_rt->scan_cpu_time,
+                                virt_rt->n_worker_thread);
+
+    return sum; 
+}
+
+void virtual_runtime_hit_times_inc(struct virtual_runtime *virt_rt,
+                                   int thread_id)
+{
+    if (NULL == virt_rt || thread_id < 0) {
+        return;
+    }
+
+    alignment_int64_array_add(virt_rt->hit_times, thread_id, 1);
+}
+
+long long virtual_runtime_hit_times(void *virtual_runtime)
+{
+    if (NULL == virtual_runtime) {
+        return 0;
+    }
+
+    struct virtual_runtime *virt_rt = (struct virtual_runtime *)virtual_runtime;
+    long long sum = alignment_int64_array_sum(virt_rt->hit_times,
+                                              virt_rt->n_worker_thread);
+    alignment_int64_array_reset(virt_rt->hit_times,
+                                virt_rt->n_worker_thread);
+
+    return sum;
+}
+
+void virtual_runtime_hit_item_num_add(void *virtual_runtime, int thread_id,
+                                      long long val)
+{
+    if (NULL == virtual_runtime) {
+        return;
+    }
+
+    struct virtual_runtime *virt_rt = (struct virtual_runtime *)virtual_runtime; 
+    alignment_int64_array_add(virt_rt->hit_item_num, thread_id, val);
+}
+
+long long virtual_runtime_hit_item_num(void *virtual_runtime)
+{
+    if (NULL == virtual_runtime) {
+        return 0;
+    } 
+
+    struct virtual_runtime *virt_rt = (struct virtual_runtime *)virtual_runtime; 
+    long long sum = alignment_int64_array_sum(virt_rt->hit_item_num,
+                                              virt_rt->n_worker_thread);
+    alignment_int64_array_reset(virt_rt->hit_item_num,
+                                virt_rt->n_worker_thread);
+    
+    return sum;
+}
+
 static int virtual_table_get_physical_table_id(void *virtual_schema)
 {
     if (NULL == virtual_schema) {