Fast protocol recognition by network packet inspection

  • Authors:
  • Chuantong Chen;Fengyu Wang;Fengbo Lin;Shanqing Guo;Bin Gong

  • Affiliations:
  • School of Computer Science and Technology, Shandong University, Jinan, P.R. China;School of Computer Science and Technology, Shandong University, Jinan, P.R. China;School of Computer Science and Technology, Shandong University, Jinan, P.R. China;School of Computer Science and Technology, Shandong University, Jinan, P.R. China;School of Computer Science and Technology, Shandong University, Jinan, P.R. China

  • Venue:
  • ICONIP'11 Proceedings of the 18th international conference on Neural Information Processing - Volume Part II
  • Year:
  • 2011

Quantified Score

Hi-index 0.00

Visualization

Abstract

Deep packet inspection at high speed has become extremely important due to its applications in network services. In deep packet inspection applications, regular expressions have gradually taken the place of explicit string patterns for its powerful expression ability. Unfortunately, the requirements of memory space and bandwidth using traditional methods are prohibitively high. In this paper, we propose a novel scheme of deep packet inspection based on non-uniform distribution of network traffic. The new scheme separates a set of regular expressions into several groups with different priorities and compiles the groups attaching different priorities with different methods. When matching, the scanning sequence of rules is consistent with their priorities. The experiment results show that the proposed protocol recognition performs 10 to 30 times faster than the traditional NFA-based approach and hold a reasonable memory requirement.