Abstract:With the rapid development of the Internet, network traffic is becoming more complex and diverse. At the same time, malicious traffic is growing. This seriously threatens the security of networks and information. However, the current DPI (Deep Packet Inspect) engine based on x86 architecture is slow in monitoring speed, which cannot meet the needs. Generally, two factors affect the detection rate: CPU and memory; The efficiency of data packet acquisition, and multi regular expression matching. Under these circumstances, this paper presents an efficient implementation of the DPI engine based on a generic x86 platform. DPDK is used as the platform of network data packets acquisition and processing. Using the multi-queue of the NIC (network interface controller) and the customized symmetric RSS key, the network traffic is divided and reorganized in the form of conversation. The core of traffic identification is hyperscan, which uses a flow pattern to match the packets load of a single conversation efficiently. It greatly reduces memory requirements. The method makes full use of the system resources and takes into account the advantages of high efficiency of hardware implementation. And it has a remarkable improvement in the efficiency of recognition.

Realtime Capture of High-Speed Traffic on Multi-Core Platform

Research and Implementation of High Performance Traffic Processing Based on Intel DPDK

Research on High-Speed Network Data Stream Capture Based on Multi-Queue NIC and Multi-Core Processor

High Performance Packet Capture on Multi-Core Platform

An Architecture for Parallelizing Network Monitoring Based on Multi-Core Processors

Real-time Pre-Processing System with Hardware Accelerator for Mobile Core Networks

Real-time capturing and measurement of traffic flow based on WinPcap

Study and Implementation of High-speed Network Packet Capture Based on Zero-Copy

A Real-Time Network Traffic Profiling System

Research and Implementation of Efficient DPI Engine Base on DPDK

Design and Implementation of a High Performance Intrusion Prevention System

Packet Capture and Generating at High Speed with DMA

Efficient packet capture method for very high speed network based on shared memory

Handling high speed traffic measurement using network processors

High Speed Network Packet Capture Based on Linux

A High-Speed Real-Time HTTP Performance Measurement Architecture Based on Network Processor

A High Performance User Level Packet Capture System

The Comparison and Verification of Some Efficient Packet Capture and Processing Technologies.

Fast Parallelized TCP/IP Stack for High-Speed Network Intrusion Detection Systems

Design and Implementation of High-Speed Network Traffic Sensor for Emergency Response

Adaptive Load-Aware Sampling for Network Monitoring on Multicore Commodity Hardware