Abstract:Deep Packet Inspection (DPI) has been one of the most significant network security techniques. It is widely used to identify and classify network traffic in various applications such as web application firewall and intrusion detection. Different from traditional packet filtering that only examines packet headers, DPI detects payloads as well by comparing them with an existing signature database. The literal matching engine, which plays a key role in DPI, is the primary determinant of the system performance. FDR, an engine that utilizes 3 SIMD operations to match 1 character with multiple literals, has been developed and is currently one of the fastest literal matching engines. However, FDR has significant performance drop-off when faced with small-scale literal rule sets, whose proportion is more than 90% in modern databases. In this paper, we designed Teddy, an engine that is highly optimized for small-scale literal rule sets. Compared with FDR, Teddy significantly improves the matching efficiency by a novel shift-or matching algorithm that can simultaneously match up to 64 characters with only 15 SIMD operations. We evaluate Teddy with real-world traffic and rule sets. Experimental results show that its performance is up to 43.07x that of Aho-corasick (AC) and 2.17x that of FDR. Teddy has been successfully integrated into Hyperscan, together with which it is widely deployed in modern popular DPI applications such as Snort and Suricata.

Dual Cuckoo Filter with a Low False Positive Rate for Deep Packet Inspection

DM-CIFA: Detection and Mitigation of Collusion Interesting Flooding Attacks in NDNs

FROD: an Efficient Framework for Optimizing Decision Trees in Packet Classification

Accelerating Deep Packet Inspection With SIMD-Based Multi-Literal Matching Engine

Fast String Matching with Overlapped Substring Classifier in Deep Packet Inspection Systems

Embedded network processor based parallel intrusion detection

MiCuts: Combing Bit-Based Cutting and Splitting for Efficient Packet Classification

Parallel Architecture for High Throughput DFA-Based Deep Packet Inspection

Ultra-High Throughput String Matching for Deep Packet Inspection

TSCF: an Efficient Two-Stage Cuckoo Filter for Data Deduplication

Practical Multituple Packet Classification Using Dynamic Discrete Bit Selection.

A Memory-Efficient Parallel String Matching Architecture for High-Speed Intrusion Detection

Research and Implementation of Efficient DPI Engine Base on DPDK

An Efficient Tuple Pruning Scheme for Packet Classification Using On-chip Filtering and Indexing

Scalable Double Filter Structure for Port Scan Detection.

A Fast Multi-pattern Matching Algorithm for Deep Packet Inspection on a Network Processor

Flexible fingerprint cuckoo filter for information retrieval optimization in distributed network

DiCuPIT: Distributed Cuckoo Filter-based Pending Interest Table

APFA: Asynchronous Parallel Finite Automaton for Deep Packet Inspection in Cloud Computing

Research and Design of a Novel Deep Packet Inspection Engine

An Efficient Hybrid Algorithm for Multidimensional Packet Classification.