Predicting Potentially Undetectable Flows in DPI System using Machine Learning

Abstract

A Deep Packet Inspection (DPI) system examines packet payload to identify traffic flow. For flows that are eventually detected, DPI system processes average 1 to 2 packets while for eventually undetected flows, DPI system processes 10+ packets on average before concluding that detection is not possible. For such flows, costly packet processing operation is done without any eventual detection result. Our proposed algorithm adds intelligence in DPI system, using classifier and regressor Machine Learning models, to predict that given flow has very low chance of eventually being detected by the given DPI system. With that, DPI engine can stop processing that flow for subsequent packets and save a lot of unnecessary processing to enhance DPI system throughput. Our initial test results show that a competitively fast solution achieving above 98% accuracy can be derived using this method.