Deep packet inspection with DFA-trees and parametrized language overapproximation

Abstract

IPSs determine whether incoming traffic matches a database of vulnerability signatures defined as regular expressions. DFA representations are popular, but suffer from the state-explosion problem. We introduce a new matching structure: a tree of DFAs where the DFA associated with a node overapproximates those at its children, and the DFAs at the leaves represent the signature set. Matching works top-down, starting at the root of the tree and stopping at the first node whose DFA does not match. In the common case (benign traffic) matching does not reach the leaves. DFA-trees are built using Compact Overapproximate DFAs (CODFAs). A CODFA D for D overapproximates the language accepted by D, has a smaller number of states than D, and has a low false-match rate. Although built from approximate DFAs, DFA-trees perform exact matching faster than a commonly used method, have a low memory overhead and a guaranteed good worst case performance.

Multi‐stride Indexing: Improve NFA for Fast and Scalable DPI

“…More specifically, when performing DPI on realworld network traffics, a successful matching occurs very rarely. According to our experiment result, only 0.39% of 400K real-world HTTP packets result in successful matching against 500 Snort patterns, according to other researcher [4] . is 0.27%.…”

“…Fortunately, matching on these independent DFAs can be processed in parallel with the cost of more compute resources and memory bandwidth. Moreover, mDFA can be optimized by recursively grouping to CODFA-tree [4] to gain further memory cost reduction with more groups while sacrifice a little speed on average condition. Grouping the rules still may lead to lowering whole matching speed as the power of parallelism is limited.…”

Deep Packet Inspection in FPGAs via Approximate Nondeterministic Automata

“…The works closest to our NFA reduction techniques are [16] and [17]. In [16], the authors address the issue of softwarebased acceleration of matching REs describing network attacks in SNORT.…”

An Efficient Elephant Flow Detection with Cost-Sensitive in SDN

“…To avoid this problem, we propose the flow collect method based on the first time series. [16], and the other deep packet inspection (DPI) [17] characteristics can also be used to represent the flows in SDN. In this system the Real-time Detection Strategy module aims to select a n-tuple features to build a robust classification.…”