Deep Packet Inspection Using Pattern Codes for Keyword Matching

Solution Overview

Problem

Deep packet inspection (DPI) of network packets for keywords in vocabularies poses challenges due to the lack of pre-specified bit positions, making it resource-intensive, especially in environments with limited resources such as time and memory.

Innovation Solution

A method involving the computation of unique pattern codes for keywords using a positional formula, allowing for efficient matching by generating token codes from network packet sequences, which reduces the number of comparisons needed to identify matching keywords.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Difficulty of detecting and measuring

If deep packet inspection is performed by examining deeper portions of network packets for keywords, then the inspection capability is improved, but the resource consumption (time and memory) increases

Engineering Contradiction:

Improveinspection capabilityVSAvoidprocessing time

Core Design Contradiction:

Difficulty of detecting and measuringVSLoss of time

Solution Approach 1:

The patent pre-computes pattern codes for all keywords in the vocabulary before actual packet inspection begins. These pattern codes are stored in a data structure that enables rapid comparison. When a packet arrives, the system only needs to compare the computed packet code against these pre-computed pattern codes, avoiding the need to scan and compare against the full keyword vocabulary during inspection, thus reducing processing time

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent transforms keywords into numerical pattern codes using a positional formula that converts character sequences into compact numerical representations. This parameter transformation allows the system to work with numerical values instead of string comparisons, significantly improving comparison speed and reducing memory requirements for storing the inspection vocabulary

Inventive Principle:

Principle #35Parameter changes

2Difficulty of detecting and measuring

If deep packet inspection is performed by examining deeper portions of network packets for keywords, then the inspection capability is improved, but the resource consumption (time and memory) increases

Engineering Contradiction:

Improveinspection capabilityVSAvoidmemory usage

Core Design Contradiction:

Difficulty of detecting and measuringVSQuantity of substance

Solution Approach 1:

The patent creates a compact numerical representation (pattern code) of each keyword and stores only these codes in memory rather than storing the full keyword vocabulary. This copying approach replaces large text-based keyword storage with small numerical code storage, dramatically reducing memory usage while preserving the ability to perform accurate keyword matching through code comparison

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent transforms keywords into numerical pattern codes using a positional formula that converts character sequences into compact numerical representations. This parameter transformation allows the system to work with numerical values instead of string comparisons, significantly improving comparison speed and reducing memory requirements for storing the inspection vocabulary

Inventive Principle:

Principle #35Parameter changes

3Reliability

If traditional DPI methods are used to inspect network packets for keywords, then comprehensive keyword matching is achieved, but the number of comparisons required increases

Engineering Contradiction:

Improvekeyword matching accuracyVSAvoidcomparison efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent replaces the mechanical process of scanning and comparing packet content against a vocabulary of keywords with a computational approach. A positional formula automatically generates pattern codes from both keywords and packet content, enabling direct numerical comparison. This substitution of mechanical scanning with computational code generation and comparison dramatically improves productivity while maintaining matching accuracy

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent transforms keywords into numerical pattern codes using a positional formula that converts character sequences into compact numerical representations. This parameter transformation allows the system to work with numerical values instead of string comparisons, significantly improving comparison speed and reducing memory requirements for storing the inspection vocabulary

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS9680797B2Deep packet inspection (DPI) of network packets for keywords of a vocabulary

Publication Date: 2017.06.13 ORACLE INT CORP

AI summary

An aspect of the present disclosure provides deep packet inspection (DPI) of network packets for keywords of a vocabulary. In one embodiment, a mapping specifying association of respective keywords to corresponding unique pattern codes is maintained, with each pattern code being shorter in length compared to the corresponding keyword and being computed based on a formula. Upon receiving a network packet, a token (containing a sequence of characters) present in the network packet is first identified and the formula then applied to the identified token to generate a token code. The token is determined to match a specific keyword when the token code equals the pattern code corresponding to the specific keyword in the mapping.