Deep Packet Inspection Signature Matching Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep packet inspection (DPI) systems face performance challenges in matching regular expression patterns across multiple packets due to increasing network speeds, often requiring expensive external processors with specialized hardware.
Innovation Solution
A DPI system and method that utilizes a signature matching engine and flow tracker to inspect arbitrary payload fields, enabling efficient matching of regular expression patterns by selecting initial packets for signature matching and tracking flows across multiple packets, without the need for processing at system packet throughput rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional DPI systems process all packets at system throughput rates, then matching accuracy is maintained, but processing speed and performance deteriorate under increasing network speeds
Solution Approach 1:
The system segments packet processing by dividing packets into fixed-size blocks (e.g., 1500 bytes) and processes only the initial block for signature matching. This segmentation allows the system to maintain high processing speed by avoiding full-packet inspection while preserving matching accuracy for patterns that appear in the initial data portion.
Solution Approach 2:
The system performs preliminary signature matching on the initial block of packet data before complete packet reception. By conducting matching actions in advance on the available initial data, the system achieves early detection of signature patterns without waiting for the entire packet to arrive, thereby improving processing speed while maintaining productivity.
2Productivity
If expensive external processors with specialized hardware are added, then signature matching performance improves, but system complexity and cost increase
Solution Approach 1:
The system implements a universal signature matching approach that works across different network speeds and packet types using standard processing components. By designing a multi-functional matching engine that handles various signature patterns and packet formats through a unified initial-block processing mechanism, the system achieves high productivity without requiring specialized hardware or complex external processors.
Solution Approach 2:
The system creates a simplified copy of the packet data (initial block) for signature matching purposes, rather than processing the complete original packet. This copying approach enables efficient matching operations using standard processors, avoiding the need for expensive specialized hardware while maintaining matching accuracy.
3Measurement precision
If complete packet inspection is performed, then matching accuracy is ensured, but processing time and resource consumption increase
Solution Approach 1:
The system applies partial inspection by examining only the initial block of packet data (a portion of the complete packet) for signature matching. This partial action approach maintains matching accuracy for patterns that appear in the initial data while significantly reducing processing time and resource consumption compared to complete packet inspection.
Solution Approach 2:
The system performs preliminary matching on the initial block before complete packet reception is finalized. By conducting the matching action in advance on the available initial data, the system reduces processing time while maintaining accuracy for patterns that appear early in the packet stream.
Data Source
AI summary
A system and method for efficient matching regular expression patterns across multiple packets. A deep packet inspection system can be embodied in a switch ASIC using a flow tracker and a signature matching engine. The flow tracker can be positioned in an ingress portion of the switch ASIC at a location where packets in a bi-direction flow can be observed and recorded. The flow tracker generates a signature match request that is forwarded to a signature matching engine in an auxiliary pipeline. The signature matching engine is enabled to perform cross-packet signature matching using signature matching state machines and reports the signature matching results to the flow tracker using a response packet that is sent to the ingress pipeline.