Packet Detection Protocol Recognition via Association Table Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing Deep Packet Inspection (DPI) technologies face low processing speeds during protocol recognition due to the need for rule matching and protocol verification when flow table matching fails, which slows down the overall protocol recognition process.
Innovation Solution
The method involves performing association recognition table matching using triple information, which includes a Type, Source IP (SIP), and Source Port (SPort), or Type, Destination IP (DIP), and Destination Port (DPort), to directly recognize the protocol without the need for rule matching and protocol verification, thereby increasing the protocol recognition speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If rule matching and protocol verification are performed when flow table matching fails, then protocol recognition accuracy is maintained, but protocol recognition speed decreases
Solution Approach 1:
The patent segments the protocol recognition process into multiple stages: flow table matching (fast path), association recognition table matching (intermediate path), and rule matching with protocol verification (slow path). By dividing the recognition process into hierarchical levels with different matching criteria and data volumes, the system can quickly handle common cases through flow table matching while maintaining the option to perform more detailed analysis only when necessary, thus resolving the contradiction between speed and accuracy
Solution Approach 2:
The patent performs preliminary action by pre-establishing the flow table with quintuple information and the association recognition table with triple information before actual packet processing. This allows the system to quickly match incoming packets against pre-computed tables without performing complex rule matching and protocol verification for every packet, thereby improving recognition speed while maintaining accuracy through the hierarchical structure
2Adaptability or versatility
If rule matching is performed on packets with numerous data in the rule base, then comprehensive protocol recognition is achieved, but processing speed becomes low
Solution Approach 1:
The patent applies local quality by creating different types of matching tables with different levels of detail and scope. The flow table contains quintuple information for broad flow identification, while the association recognition table contains triple information for more specific protocol identification. This localized differentiation allows the system to apply the appropriate level of matching complexity based on the specific recognition needs, improving both coverage and throughput
Solution Approach 2:
The patent introduces another dimension by adding the association recognition table as an intermediate layer between flow table matching and rule matching. This additional dimensional layer with triple information provides a middle ground that captures protocol-specific characteristics without requiring the full complexity of rule base matching, thereby expanding recognition capabilities while maintaining high processing speed
Data Source
Figure 1~3
Figure 4
Figure 4A~5A
AI summary
A method and a device for detecting a packet are provided according to the embodiments of the present invention. The method includes: performing association recognition table matching between first match information in a received packet and first match information in an association recognition table, where the first match information of the association recognition table is obtained by extracting a content of a control packet used for creating a data channel, the first match information corresponds to a packet protocol, and the packet protocol is obtained by performing protocol recognition on the control packet; and when the association recognition table matching succeeds, outputting protocol information obtained after the association recognition table matching succeeds. In the embodiments of the present invention, when match information of the association recognition table is matched, since the match information of the association recognition table is obtained by extracting the content of the control packet used for creating the data channel and corresponds to the protocol obtained by performing the protocol recognition on the control packet, the protocol is recognized without detecting the packet content, thereby increasing a protocol recognition speed.