Abstract:Network middleboxes perform deep packet inspection (DPI) to detect anomalies and suspicious activities in network traffic. However, increasingly these traffic are encrypted and middleboxes can no longer make sense of them. A recent proposal by Sherry et al. (SIGCOMM 2015), named BlindBox, enables the middlebox to perform inspection in a privacy-preserving manner. BlindBox deploys garbled circuit to generate encrypted rules for the purpose of inspecting the encrypted traffic directly. However, the setup latency (which could be 97s on a ruleset of 3,000 as reported) and overhead size incurred by garbled circuit are high. Since communication can only be commenced after the encrypted rules being generated, such delay is intolerable in many real-time applications. In this work, we present PrivDPI, which reduces the setup delay while retaining similar privacy guarantee. Compared to BlindBox, for a ruleset of 3,000, our encrypted rule generation is 288x faster and requires 290,227x smaller overhead for the first session, and is even 1,036x faster and requires 3424,505x smaller overhead over 20 consecutive sessions. The performance gain is based on a new technique for generating encrypted rules as well as the idea of reusing intermediate results generated in previous sessions across subsequent sessions. This is in contrast to Blindbox which performs encrypted rule generation from scratch for every session. Nevertheless, PrivDPI is 6x slower in generating the encrypted traffic tokens, yet in our implementation, the token encryption rate of PrivDPI is more than 17,271 per second which is sufficient for many real-time applications. Moreover, the intermediate values generated in each session can be reused across subsequent sessions for repeated tokens, which could further speedup token encryption. Overall, our experiment shows that PrivDPI is practical and especially suitable for connections with short flows.

DCDPI: Dynamic and Continuous Deep Packet Inspection in Secure Outsourced Middleboxes

CloudDPI: Cloud-Based Privacy-Preserving Deep Packet Inspection Via Reversible Sketch.

PrivDPI

Privacy-preserving Efficient Verifiable Deep Packet Inspection for Cloud-assisted Middlebox

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Dpi & Dfi: A Malicious Behavior Detection Method Combining Deep Packet Inspection and Deep Flow Inspection

Privacy-Preserving and Lightweight Verification of Deep Packet Inspection in Clouds

NetDP: In-Network Differential Privacy for Large-Scale Data Processing

Asidps: Auto-Scaling Intrusion Detection And Prevention System For Cloud

MiCuts: Combing Bit-Based Cutting and Splitting for Efficient Packet Classification

Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

SPABox: Safeguarding Privacy During Deep Packet Inspection at a MiddleBox

Privacy-Preserving Traceable Encrypted Traffic Inspection in Blockchain-based Industrial IoT

Tearing Down the Face of Algorithmic Complexity Attacks for DPI Engines

Machine learning based malicious payload identification in software-defined networking

Dual Cuckoo Filter with a Low False Positive Rate for Deep Packet Inspection

Pine: Enabling Privacy Preserving Deep Packet Inspection on TLS with Rule Hiding and Fast Connection Establishment

A Real Implementation of DPI in 3G Network

Research and Implementation of Efficient DPI Engine Base on DPDK

Accelerating Deep Packet Inspection With SIMD-Based Multi-Literal Matching Engine

Securing Middlebox Policy Enforcement in SDN