Packet Filtering Using Zero-Suppressed Binary Decision Diagrams
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing packet filtering methods using Binary Decision Diagrams (BDDs) face storage limitations as the depth of the tree structure increases, leading to incomplete processing of the rule set due to excessive storage requirements.
Innovation Solution
The use of Zero-Suppressed Binary Decision Diagrams (ZDDs) for representing logical expressions, which reduces storage needs and allows for high-speed calculations with a mechanism to correct calculation errors, enabling the processing of entire rule sets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If BDD is used to represent the rule set for packet filtering, then high-speed collation can be achieved, but a large storage area is necessary which makes it difficult to represent the entire rule set
Solution Approach 1:
The patent changes the parameter of the tree structure from BDD to ZDD, which fundamentally alters the storage requirements. ZDD represents logical expressions more compactly by eliminating redundant nodes and using a more efficient encoding scheme, thereby reducing the storage area while maintaining the high-speed collation capability.
Solution Approach 2:
The patent extracts and eliminates redundant information from the BDD structure to create ZDD. By removing unnecessary nodes and simplifying the representation, the storage requirements are significantly reduced while preserving the essential logical expression evaluation functionality needed for packet filtering.
2Adaptability or versatility
If the depth of the tree structure increases to represent more rules, then more comprehensive packet filtering is achieved, but the storage area requirement increases exponentially
Solution Approach 1:
The patent transforms the tree structure parameter from BDD to ZDD, which changes how the data is organized and stored. ZDD uses a more compact representation that grows much more slowly with increasing rule set coverage, allowing comprehensive packet filtering without exponential storage growth.
Solution Approach 2:
The patent segments the logical expression evaluation into smaller, more efficient components within the ZDD structure. By dividing the rule set representation into optimized segments that can be evaluated independently and combined, the storage requirements are reduced while maintaining comprehensive filtering capability.
3Productivity
If BDD is used for logical expression calculation, then high-speed processing is achieved, but calculation errors occur that require correction mechanisms
Solution Approach 1:
The patent converts the potential harm of calculation errors into a benefit by designing the ZDD structure to inherently minimize error-prone operations. The reorganized tree structure reduces the likelihood of calculation errors while maintaining high processing speed, turning a reliability problem into an opportunity for improved design.
Solution Approach 2:
The patent implements error correction mechanisms as a preemptive measure before errors can significantly impact the system. By built-in correction capabilities into the ZDD evaluation process, the system maintains high productivity while ensuring calculation accuracy through prior cushioning against potential errors.
Data Source
Figure 1~3
Figure 4~6
Figure 7~8
AI summary
The present invention relates to: a packet filtering apparatus that represents a rule set for packet filtering being a technique for preventing a cyber-attack, using a tree structure suitable for calculation of a logical expression, thereby improving processing efficiency; and a packet filtering method thereof. The packet filtering apparatus includes: a rule set containing a rule in which a condition and an action are associated with each other, and a Zero-Suppressed Binary Decision Diagram (ZDD) that represents a logical expression in which the condition of the rule is described using a logical variable; a packet analyzing unit to analyze a packet received from a network and extract collation information being a character string to be collated; and a filtering unit to collate the collation information extracted by the packet analyzing unit with the ZDD, execute the action associated with the condition that the collation information matches, and permit or deny communication of the packet.