Improving Network Security - A Comparison of Open Source DPI Software

Abstract

The classification of data traffic in a firewall using parameters such as port number, IP address, and MAC address is not sufficient. For example, currently, many applications can be used without a port number meaning they can easily circumvent a firewall. Firewalls inspecting up to only layer four could allow malicious data to pass. Next-generation deep packet inspection (DPI) is a method that can be used for firewalls as a method of classification up to layer seven in data traffic control. This research recommends the use of nDPI and L7-filter by network administrators on existing open source firewalls. Eleven internet applications were used to test and analyze nDPI and L7-filter which are capable of detecting traffic based on the data signature. nDPI and L7-filter were tested for accuracy and speed of total time of execution in live performance networks. We conclude that the development of next-generation deep packet inspection is important for the future of system and network security.

Modern ağ trafiği analizi için derin paket incelemesi hakkında kapsamlı bir çalışma: sorunlar ve zorluklar

“…In addition, nDPI supports DPDK which is a kernel bypass technology to minimize performance losses caused by the hardware or the operating system. There are many studies comparing the accuracy of nDPI and PACE libraries according to the degree of granularity in terms of detection of the application protocol [45][46][47][48]. According to these studies, nDPI is the library with the highest accuracy among the open-source classifiers, except for the study numbered [47].…”