Traffic-Aware Frequent Elements Matching Algorithms for Deep Packet Inspection

Abstract

Deep packet inspection sometimes is called application level semantic detection, which capable of examining the content of data packets in order to provide application-specific services and improve network security. Application traffic classification based on regular expressions is an essential step for deep packet inspection. However regular expression, especially multiple regular expressions matching is known to require intensive system resources and is often a performance bottleneck. Currently, the DFAs of regular expression are constructed in the preprocessing stage and the context of network streams is excluded which leads to low throughputs. In this paper, we analyzed the application level protocols and found that the protocols are uniformly distributed and it is changing dynamically. From the protocol distribution characteristic, we proposed an adaptive multiple regular expressions matching method for application traffic classification with deep packet inspection. The adaptive method, schedule the multiple DFAs through splay tree by matching probability other than linear scheduling in linked list, can adjust scheduling sequence according with the changing dynamic traffics. We evaluate the proposed method with the L7 rules; experiments proved that our method can improve the throughputs more than three times.