PGSM-DPI: Precisely Guided Signature Matching of Deep Packet Inspection for Traffic Analysis

Yan, Haonan; Li, Hui; Xiao, Mingchi; Dai, Rui; Zheng, Xianchun; Zhao, Xingwen; Li, Fenghua

doi:10.1109/globecom38437.2019.9013941

Search citation statements

Order By: Relevance

Paper Sections

Select...

Citation Types

Supporting

Mentioning

Contrasting

Year Published

2022

2024

Publication Types

Select...

Article3

Book1

Relationship

Self Cite0

Independent4

Authors

Journals

Cited by 4 publications

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

An Encrypted Traffic Classification Framework Based on Higher-Interaction-Graph Neural Network

Hu,

Qu,

et al. 2024

Information Security and Privacy

View full text Add to dashboard Cite

An Encrypted Traffic Classification Framework Based on Higher-Interaction-Graph Neural Network

Hu,

Qu,

et al. 2024

Information Security and Privacy

View full text Add to dashboard Cite

An adaptive detection model for IPv6 extension header threats based on deterministic decision automaton

Lin,

Zhang,

Zhang

et al. 2024

Sci Rep

View full text Add to dashboard Cite

The IPv6 extension header mechanism, a new feature of the IPv6 protocol, enhances flexibility and scalability but introduces numerous security threats like firewall evasion and covert channels. Existing threat detection methods face limitations in detection types, universality, and speed. Hence, an adaptive detection model for IPv6 extension header threats (ADM-DDA6) is proposed. Firstly, standard rule sets are designed for common IPv6 extension headers, successfully detecting 70 types of threats from THC-IPv6 and ExtHdr tools using only 20 rules. Secondly, by parsing IPv6 extension headers, matching rules, establishing transition relationships, and deciding packet threat status based on final states (Normal or Abnormal), complex threats like header disorder and header repetition can be detected. Finally, an adaptive rule matching method is introduced, which dynamically selects rule sets based on IPv6 extension header types, effectively reducing rule matching time. Experimental results show that under different threat magnitudes, ADM-DDA6 is 32% faster than Suricata v6.0.12 and 21.2% faster than Snort v3.1.61.0 in detection speed. Additionally, as the number of threats increases, on commodity hardware, ADM-DDA6 incurs only a 0.7% increase in CPU overhead with no significant memory consumption increase, maintains maximum throughput, and exhibits minor performance changes under low and moderate network load conditions.

show abstract

MARS: Automated Protocol Analysis Framework for Internet of Things

Yan

Dai

et al. 2022

IEEE Internet Things J.

View full text Add to dashboard Cite

PGSM-DPI: Precisely Guided Signature Matching of Deep Packet Inspection for Traffic Analysis

Cited by 4 publications

References 17 publications

An Encrypted Traffic Classification Framework Based on Higher-Interaction-Graph Neural Network

An Encrypted Traffic Classification Framework Based on Higher-Interaction-Graph Neural Network

An adaptive detection model for IPv6 extension header threats based on deterministic decision automaton

MARS: Automated Protocol Analysis Framework for Internet of Things

Contact Info

Product

Resources

About