DSM: Delayed Signature Matching in Deep Packet Inspection

Symmetry

Ting Wu¹  Shanqing Guo²  Qiuhua Zheng³  Yingpei Zeng³ 

[1] Hangzhou Innovation Institute, Beihang University, Hangzhou 310000, China;School of Cyber Science and Technology, Shandong University, Jinan 250000, China;School of Cyberspace, Hangzhou Dianzi University, Hangzhou 310000, China;

关键词: DPI;    deep packet inspection;    delayed signature matching;    DSM;    fast path;    traffic classification;   

DOI  :  10.3390/sym12122011

来源: DOAJ

【 摘 要 】

Deep Packet Inspection (DPI) is widely used in network management and network security systems. The core part of existing DPI is signature matching, and many researchers focus on improving the signature-matching algorithms. In this paper, we work from a different angle: The scheduling of signature matching. We propose a Delayed Signature Matching (DSM) method, in which we do not always immediately match received packets to the signatures since there may be not enough packets received yet. Instead, we predefine some rules, and evaluate the packets against these rules first to decide when to start signature matching and which signatures to match. The predefined rules are convenient to create and maintain since they support custom expressions and statements and can be created in a text rule file. The correctness and performance of the DSM method are theoretically analyzed as well. Finally, we implement a prototype of the DSM method in the open-source DPI library nDPI, and find that it can reduce the signature-matching time about 30∼84% in different datasets, with even smaller memory consumption. Note that the abstract syntax trees (ASTs) used to implement DSM rule evaluation are usually symmetric, and the DSM method supports asymmetric (i.e., single-direction) traffic as well.

【 授权许可】

Unknown