Network Device Application Identification Using DFA Merging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network devices face inefficiencies in application identification due to the computational expense of sophisticated pattern matching schemes, which can lead to increased security vulnerabilities and decreased performance, especially with emerging time-sensitive applications like VoIP that dynamically assign port numbers.
Innovation Solution
Implementing a network device with a graph data structure using Deterministic Finite Automata (DFA) that separates 'explosive' and 'non-explosive' regular expressions, merging only non-explosive DFAs to form a group DFA, and using signature fingerprints to reduce state replication, thereby minimizing memory consumption and improving traversal speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If sophisticated pattern matching schemes are used to identify applications, then application identification accuracy is improved, but computational expense and time consumption increase
Solution Approach 1:
The patent segments the application identification process into two distinct phases: a classification phase that uses a classification table to quickly determine application categories, and a pattern matching phase that applies regex patterns only to packets identified as potentially malicious. This segmentation reduces overall processing time by avoiding exhaustive pattern matching for all packets.
Solution Approach 2:
The patent performs preliminary classification of packets into application categories before applying detailed pattern matching. By using a classification table to pre-sort packets and identify potential security threats, the system performs necessary filtering actions in advance, reducing the computational burden during the actual pattern matching phase.
2Measurement precision
If detailed pattern matching schemes are implemented, then application identification accuracy is improved, but device complexity increases
Solution Approach 1:
The patent divides the complex pattern matching task into manageable segments by separating classification logic from pattern matching logic. The classification table handles high-level categorization while individual regex patterns handle specific security checks, making the overall system more manageable and easier to maintain.
Solution Approach 2:
The patent introduces a classification table as an intermediary component that sits between packet inspection and pattern matching. This intermediary layer simplifies the overall system architecture by providing a first level of filtering and categorization, reducing the complexity of the pattern matching process.
3Speed
If static port number associations are used for application identification, then processing speed is improved, but security vulnerabilities increase
Solution Approach 1:
The patent transitions from static port number associations to dynamic application identification using regex patterns. This allows the system to adapt to emerging applications that use non-standard ports while maintaining security through active pattern matching, resolving the contradiction between speed and security.
Solution Approach 2:
The patent implements a feedback mechanism where pattern matching results are used to update and refine the classification table. This feedback loop allows the system to learn from detected patterns and improve its classification accuracy over time, maintaining both speed and security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In general, techniques are described for efficiently implementing application identification within network devices. In particular, a network device includes a control unit that stores data defining a group Deterministic Finite Automata (DFA) and an individual DFA. The group DFA is formed by merging non-explosive DFAs generated from corresponding non-explosive regular expressions (regexs) and fingerprint DFAs (f-DFAs) generated from signature fingerprints extracted from explosive regexs. The non-explosive regexs comprise regexs determined not to cause state explosion during generation of the group DFA, the signature fingerprints comprise segments of explosive regexs that uniquely identifies the explosive regexs, and the explosive regexs comprise regexs determined to cause state explosion during generation of the group DFA. The network device includes an interface that receives a packet and the control unit traverses first the group DFA and then, in some instances, the individual DFAs to more efficiently identify network applications to which packets correspond.