Method for detecting deep packet under large flow

A technology of deep packet inspection and large flow, which is applied in the field of data communication to achieve the effect of convenient addition, precise matching and flexible configuration

Active Publication Date: 2012-07-04
RUN TECH CO LTD BEIJING
View PDF3 Cites 15 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

However, when the hash operation result of the unmatched content to be matched is the same a

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Method for detecting deep packet under large flow
  • Method for detecting deep packet under large flow
  • Method for detecting deep packet under large flow

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0032] In order to make the above-mentioned features and advantages of the present invention more comprehensible, the following specific embodiments are described in detail with reference to the accompanying drawings.

[0033] The hardware environment of the present invention adopts the structure of the main control unit+FPGA+TCAM of the operating system, such as figure 1 shown. The main control unit implements keyword statistics, and initializes the configuration address according to the user’s operation of adding / deleting keywords. After the data packet enters the FPGA, it is input to the buffer, and then performs rough matching (Bloom filter) and fine matching (TCAM matching) , and output after processing.

[0034] Firstly, three hierarchical filtering modules are built inside the FPGA.

[0035] The structure of coarse matching module in FPGA is as follows: figure 2 shown. L first-layer filter modules are arranged in parallel (the value of L is determined by the data f...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

PUM

No PUM Login to view more

Abstract

The invention provides a method for detecting a deep packet under a large flow. Aiming at solving problems encountered under the large flow in the process of deep packet detection in FPGA (Field Programmable Gate Array) and TCAM (Ternary Content-addressable Memory) modes, different types and numbers of layered Bloom counters are respectively constructed in the internal memory of a master control unit of an operation system and an FPGA, a Bloom filter is utilized for prefiltration, keyword counting is realized in the internal memory of the master control unit, rough matching of the Bloom filter is realized in the FPGA, and then, fine matching is realized in a TCAM. According to the invention, through a two-step matching method, not only is fine matching realized, but also the pressure of the TCAM is reduced, and the problems that the number of the keywords is large and the keywords are different in length are fully considered, so the adding, deleting and matching processes of the keywords are convenient and easy.

Description

technical field [0001] The invention relates to a method for performing deep packet detection under large flow, and belongs to the field of data communication. Background technique [0002] In data communication networks, deep packet inspection technology is widely used, and is often used in data packet application type analysis, user behavior analysis, intrusion detection, virus / worm detection, etc. [0003] The implementation methods of deep packet inspection technology are divided into software and hardware. The software method uses various pattern matching algorithms to match specific keywords, but the speed of software deep packet inspection is limited, and line-speed processing cannot be guaranteed. The method of using hardware to implement deep packet inspection can realize wire-speed processing under large traffic conditions. [0004] There are many ways to use hardware for deep packet inspection. When the number of keywords is large and needs to be updated at runt...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

Application Information

Patent Timeline
no application Login to view more
IPC IPC(8): H04L12/26H04L29/06
Inventor 岳培培
Owner RUN TECH CO LTD BEIJING
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Try Eureka
PatSnap group products

Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic.

© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap