Data Inspection State Machine for Out-of-Order Packet Handling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional deep packet inspection methods require significant computational resources and memory to reconstruct flows and maintain state for each flow, making them infeasible for large traffic volumes, especially when dealing with out-of-order packets.
Innovation Solution
A method that checks data parts for matching signatures in both forward and backward directions, temporarily saving states and updating them as necessary, allowing for efficient inspection without reconstructing flows and minimizing memory usage, using deterministic finite automata for pattern matching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If flow reconstruction is performed to detect patterns spanning multiple packets, then detection accuracy is improved, but memory consumption and computational resources increase significantly
Solution Approach 1:
The patent segments the flow inspection process into independent per-packet operations. Instead of reconstructing entire flows before inspection, each packet is inspected individually using a state machine that maintains only the necessary inspection state, not the entire flow data. This segmentation eliminates the need to store complete flow reconstructions in memory while maintaining detection accuracy for multi-packet patterns.
Solution Approach 2:
The patent changes the parameter of state representation from storing complete flow data to storing only inspection-relevant state information. The state machine maintains minimal state (current pattern matching position, etc.) rather than the full flow reconstruction, dramatically reducing memory requirements while preserving detection capability.
2Reliability
If a flow reconstruction chain is dedicated for every flow, then detection completeness is improved, but computational resources are drained
Solution Approach 1:
The patent implements a universal state machine that can handle pattern matching for all flows simultaneously. Instead of dedicating separate reconstruction chains to each flow, a single multi-functional state machine processes packets from multiple flows, transitioning between states based on pattern matching requirements. This universal approach maintains detection completeness while sharing computational resources across all flows.
Solution Approach 2:
The state machine is designed to be self-sufficient, maintaining its own internal state and processing packets autonomously without requiring external flow reconstruction services. Each packet processed by the state machine contributes to the inspection independently, eliminating the need for separate flow management infrastructure.
3Measurement precision
If packets are stored in order to complete reconstruction, then pattern matching accuracy is improved, but memory resources are drained
Solution Approach 1:
The state machine performs preliminary pattern matching actions on each packet as it arrives, without waiting for the complete flow reconstruction. By maintaining inspection state and processing packets in real-time order, the system achieves pattern matching accuracy equivalent to full reconstruction while avoiding the memory cost of storing all packets.
Solution Approach 2:
Instead of the conventional approach of storing all packets first then performing pattern matching, the patent inverts the process by performing pattern matching incrementally as packets arrive. The state machine processes packets in real-time, maintaining only the necessary state information, thereby achieving the same detection accuracy with minimal memory usage.
Data Source
AI summary
A method for data inspection includes upon receiving an out-of-order part of a sequence of parts, checking the out-of-order part for matching in forward and backward direction of the sequence; temporarily saving a forward state and a backward state of said both checkings; and upon receiving an in-order part of the sequence, checking the in-order part for matching in the forward direction of the sequence and if the in-order packet is within a gap between the first part and the last part of the sequence the in-order part is also checked for matching in backward direction of the sequence. The backward state or the forward and backward state are updated or temporarily saved.