A Novel Deep Packet Inspection Method for Polymorphic Network
Meiting Xue,Kainuo Ni,Yan Zeng,Yuyu Yin,Baokang Zhao
DOI: https://doi.org/10.1109/ngdn61651.2024.10744179
2024-01-01
Abstract:Deep Packet Inspection (DPI) serves as a critical tool for application-layer traffic detection and control, utilized extensively for the identification and prevention of cyberattacks, the interception of malware, and the monitoring of network traffic. With the rapid development of towards the integration of various network technologies through programmable technologies, the exploration of polymorphic network architectures has intensified and has been an important research directions. Nevertheless, existing DPI approaches are faced with significant challenges in dealing with the complexities of heterogenous networks and achieving timely detection in intricate environments. This paper introduces an innovative, efficient DPI methodology tailored for polymorphic networks. It incorporates a multi-set search algorithm, which hybridizes hash tables and cuckoo filters, enhancing search efficiency. Furthermore, an attack detection mechanism is developed, grounded in the concept of overload attacks, to accurately identify and respond to such threats. A mitigation strategy is proposed, leveraging the power of DPI, to effectively counteract the adverse effects of flow table overload attacks. Empirical evaluations confirm the proposed detection method suitability for networks, demonstrating a 2x-3x improvement in performance compared to conventional algorithms, along with a superior false positive rate. The attack detection and mitigation approach presented herein successfully withstands the onslaught of flow table overload attacks, reinforcing the resilience of polymorphic network environments.