Deep Packet Inspection Systems Research Articles

From porn to cybersecurity passing by copyright: How mass surveillance technologies are gaining legitimacy … The case of deep packet inspection technologies

Recent coverage in the press regarding large-scale passive pervasive network monitoring by various state and government agencies has increased interest in both the legal and technical issues surrounding such operations. The monitoring may take the form of which systems (and thus potentially which people) are communicating with which other systems, commonly referred to as the metadata for a communication, or it may go further and look into the content of the traffic being exchanged over the network. In particular the monitoring may rely upon the implementation of Deep Packet Inspection (DPI) technologies. These technologies are able to make anything that happens on a network visible and recordable. While in practice the sheer volume of traffic passing through a DPI system may make it impractical to record all network data, if the system systematically records certain types of traffic, or looks for specific patterns in all traffic, the privacy concerns are highly significant. The aim of this paper is twofold: first, to show that despite the increasing public awareness in relation to the capabilities of Internet service providers (ISPs), a cross-field and comparative examination shows that DPI technologies are in fact progressively gaining legal legitimacy; second to stress the need to rethink the relationship between data protection law and the right to private life, as enshrined in Article 8 of the European Convention on human rights and Article 7 of the European Charter of fundamental rights, in order to adequately confine DPI practices. As a result, it will also appear that the principle of technical neutrality underlying ISP's liability exemptions is misleading.

A Scalable Carrier-Grade DPI System Architecture Using Synchronization of Flow Information

In this paper, the concept of deep packet inspection (DPI) is explained, and technical issues in deployment of DPI systems in a backbone network of Internet service provider (ISP) are mainly discussed. First, technologies of content identification using DPI are briefly explained, and types of clustering mechanisms that support a large bandwidth with a number of DPI systems are dealt with in detail. Second, a flow synchronization-based DPI architecture is introduced in order to achieve high scalability in system configuration and identification accuracy without rerouting of data flows. Based on the proposed architecture, flow information synchronization and adaptive traffic control using polling-based bandwidth arbitration and virtual queue synchronization are proposed, so that flows, which are randomly distributed over DPI modules by asymmetric routing, can be identified and controlled accurately. The proposed system architecture is practically manufactured as a 40-Gb/s system with four 10-Gb/s DPI modules, and performances of the proposed mechanisms are proved by practical tests that are executed using real traffic in an ISP backbone network. Finally, the scalability and the flexibility of the proposed mechanisms are reviewed from the viewpoint of enabling technologies of smart networks.

TCP/IP Reassembly in Network Intrusion Detection and Prevention Systems

Deep Packet Inspection (DPI) in Network Intrusion Detection and Prevention Systems (NIDPS) typically involves the matching of packet payloads against attack signatures in the form of fixed strings and regular expressions. As an attack pattern may span multiple IP fragments or TCP segments, accurate DPI requires that the traffic is reassembled prior to analysis of the payload data stream. Although hardware acceleration of the TCP layer, including reassembly, is well known in the form of TCP Offload Engines for Network Interface Cards, only limited research has been conducted into reassembly architectures suited to the particular requirements of DPI systems. The challenging requirements include the tracking and fragment/segment reordering of a potentially very large number of streams in addition to dealing with subtle ambiguities in IP fragmentation and TCP segmentation using target based reassembly or traffic normalization. In this article, the authors present a combined hardware and software architecture which harnesses the resources of the latest FPGA technology to improve on existing research proposals.

EXTENDING THE DEEP PACKET INSPECTION MODEL TO THE GCC/MENA REGION

This study seeks to explore extending the technology acceptance model (DPAM) from a 2011 quantitative study—Modeling Intention to Use Deep Packet Inspection Technology in the United Arab Emirates, to the cyber security practitioner community of the Gulf Cooperation Council (GCC) and greater Middle East North Africa (MENA) Region. Analysis of regression between independent variable model factors of computer self efficacy, attitude toward ICT, perceived usefulness of ecommerce, intention to use ecommerce, societal trust and Internet filtration toward the dependent variable intention to use deep packet inspection, to determine parsimony, using confirmatory factor analysis (CFA), multinomial regression to assess correlation of independent and dependent variables, and assessment of the cross-suitability of DPAM across the MENA/GCC states through a MANOVA assessment. A qualitative component of the instrument enables collection of data about specific hardware and software deployed for deep packet inspection and cyber security systems. To cite this document: Alfred H. Miller, Extending the deep packet inspection model to the GCC/MENA region, International Journal of Cyber Society and Education, Vol. 6, No. 2, pp. 101-122, 2013. Permanent link to this document: http://dx.doi.org/10.7903/ijcse.1066

Network traffic signature generation mechanism using principal component analysis

The Deep Packet Inspection (DPI) method is a popular method that can accurately identify the flow data and its corresponding application. Currently, the DPI method is widely used in common network management systems. However, the major limitation of DPI systems is that their signature library is mainly extracted manually, which makes it hard to efficiently obtain the signature of new applications. Hence, in this paper, we propose an automatic signature extraction mechanism using Principal Component Analysis (PCA) technology, which is able to extract the signature automatically. In the proposed method, the signatures are expressed in the form of serial consistent sequences constructed by principal components instead of normally separated substrings in the original data extracted from the traditional methods. Extensive experiments based on numerous sets of data have been carried out to evaluate the performance of the proposed scheme, and the results prove that the newly proposed method can achieve good performance in terms of accuracy and efficiency.

Performance of OpenDPI in Identifying Sampled Network Traffic

The identification of the nature of the traffic flowing through a TCP/IP network is a relevant target for traffic engineering and security related tasks. Despite the privacy concerns it arises, Deep Packet Inspection (DPI) is one of the most successful current techniques. Nevertheless, the performance of DPI is strongly limited by computational issues related to the huge amount of data it needs to handle, both in terms of number of packets and the length of the packets. One way to reduce the computational overhead with identification techniques is to sample the traffic being monitored. This paper addresses the sensitivity of OpenDPI, one of the most powerful freely available DPI systems, with sampled network traffic. Two sampling techniques are applied and compared: the per-packet payload sampling, and the per-flow packet sampling. Based on the obtained results, some conclusions are drawn to show how far DPI methods could be optimised through traffic sampling.

Deep packet inspection tools and techniques in commodity platforms: Challenges and trends

Deep packet inspection (DPI) helps Internet service providers in efforts to profile networked applications. By relying on DPI systems, Internet service providers may apply different charging policies, traffic shaping, or offer quality of service (QoS) guarantees to selected users or applications. As critical network services rely on the precise characterization of network flows, building agile and efficient DPI systems has recently become an important research topic. In this paper, we present a comprehensive literature review on the tools and techniques necessary to develop modern DPI systems. We provide the essential technical background material and examine the current body of research in DPI engines’ optimization for commodity platforms. Then we discuss current research challenges and present guidelines for building high performance DPI systems.

Design and evaluation of deep packet inspection system: a case study

An increasing number of Internet applications and services render network management more troublesome for bandwidth misuse and security concern. As a result, network traffic identification plays an increasingly important role in network management. Deep packet inspection (DPI) is one of the effective approaches. Conventional network devices lookup the header of a packet, but DPI means the network device is required to match a pattern in the payload of a packet. This study proposes a DPI system and WMT (Wu-Manber with trie) algorithm to classify popular network services; The Net-DPIS is developed based on Netfilter framework in Linux kernel. The authors show how to rearrange the rule policies to increase the performance of Net-DPIS. In the results, the authors show that WMT algorithm is faster than WM algorithm; Net-DPIS has higher average accuracy and performance than L7-filter.

듀얼 프로세서 기반 DPI (Deep Packet Inspection) 엔진을 위한 효율적 패킷 프로세싱 방안 구현 및 성능 분석

Implementation of DPI(Deep Packet Inspection) system on a general purpose multiprocessor platform is an attractive option from the implementation cost point of view, since it does not require high-cost customized hardware. Load balancing has been considered as a primary means to achieve high performance in multi processor systems. We claim, however, that in case of DPI system design simply balancing the load of each processor does not necessarily yield the highest system performance. Instead, we propose a method in which tasks are allocated to processors based on their functions. We implemented the proposed method in dual processor Linux system and compare its performance with the existing load balancing methods. Under the proposed method, one processor is dedicated to deal with interrupt handling and generic packet processing, while another processor is dedicated to DPI processing. According to experimental results, the proposed scheme outperforms the existing schemes by 60%, mainly because of the reduction of cache miss and spin lock occurrences.