Pattern Matching Tables for Deep Packet Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep packet inspection (DPI) tools face performance delays due to increasing computational complexity when detecting multiple patterns in network traffic, as the number of patterns to be detected grows, leading to inefficient scaling of network security tools.
Innovation Solution
Implementing a microservices-based architecture with stateless processing and pattern matching using state leaps, where pattern matching tables are dynamically switched based on detected patterns, and pattern functions are used to accelerate the process by focusing on fixed offset patterns, reducing the complexity of pattern matching and improving efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the number of patterns to be detected in network traffic increases, then the detection capability of DPI tools is improved, but the computational complexity and performance delays increase
Solution Approach 1:
The patent segments the monolithic pattern matching process into multiple independent pattern matching tables, each handling a specific subset of patterns. This allows the system to detect multiple patterns simultaneously while maintaining manageable complexity in each table, resolving the contradiction between detection capability and computational complexity.
Solution Approach 2:
The patent implements dynamic switching between different pattern matching tables based on the detected pattern types. The system can adaptively select which table to use for processing specific traffic, optimizing performance for different pattern sets while maintaining comprehensive detection capability.
2Adaptability or versatility
If the number of patterns to be detected in network traffic increases, then the detection capability of DPI tools is improved, but the processing speed decreases
Solution Approach 1:
By dividing patterns into multiple specialized tables, the patent reduces the search space for each matching operation. Each table contains only relevant patterns for its specific function, enabling faster matching while collectively maintaining comprehensive detection capability across all tables.
Solution Approach 2:
The patent performs preliminary organization of patterns into structured tables with predefined schemas and relationships. This pre-processing allows the system to quickly navigate and match patterns without performing exhaustive searches, thereby improving processing speed while maintaining detection capability.
3Adaptability or versatility
If traditional pattern matching methods are used to handle multiple patterns, then comprehensive pattern detection is achieved, but the scaling efficiency of network security tools deteriorates
Solution Approach 1:
The patent segments the pattern detection system into multiple independent, scalable tables that can be individually optimized and processed. This segmentation enables linear scaling of detection capability without the exponential complexity growth associated with traditional monolithic approaches, improving scaling efficiency.
Solution Approach 2:
The patent creates a universal pattern matching framework where multiple specialized tables work together through a common interface and coordination mechanism. This multi-functional architecture allows the system to handle diverse pattern types efficiently while maintaining a unified detection approach that scales well.
Data Source
AI summary
System, methods, and apparatuses enable a network security system to more efficiently perform pattern matching against data items. For example, the disclosed approaches may be used to improve the way in which a deep packet inspection (DPI) microservice performs pattern matching against data items (e.g., network traffic, files, email messages, etc.) in order to detect various types of network security threats (e.g., network intrusion attempts, viruses, spam, and other potential network security issues). A DPI microservice generally refers to an executable component of a network security system that monitors and performs actions relative to input data items for purposes related to computer network security.