Pattern Matching Tables for Deep Packet Inspection Speed
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep packet inspection (DPI) tools face performance delays due to increasing computational complexity when detecting numerous patterns in network traffic, as the number of patterns to be detected grows, leading to inefficient pattern matching processes.
Innovation Solution
The implementation of microservices-based network security systems that utilize stateless processing and pattern matching tables, including master pattern matching tables, alternative master pattern matching tables, and class pattern matching tables, allows for efficient pattern matching by dynamically switching between pattern classes and using pattern functions for fixed offset patterns, reducing the need for full data item scanning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the number of patterns to be detected in network traffic increases, then the detection capability and security coverage are improved, but the computational complexity and processing time increase, leading to performance delays
Solution Approach 1:
The patent divides the set of patterns into multiple pattern classes based on their characteristics (e.g., fixed offset patterns, variable offset patterns). Each pattern class is assigned a dedicated pattern matching table, allowing the system to process different types of patterns in parallel through multiple worker processes, thereby reducing the computational burden on a single process and improving overall processing speed while maintaining comprehensive detection capability
Solution Approach 2:
The patent introduces a new dimension of parallel processing by creating multiple worker processes, each responsible for a specific pattern class. This transforms the single-threaded sequential pattern matching into a multi-threaded concurrent system, effectively utilizing multiple CPU cores to accelerate pattern detection without increasing the number of patterns being detected
2Measurement precision
If comprehensive pattern matching is performed on all data items, then detection accuracy is improved, but resource utilization increases unnecessarily for patterns that do not match
Solution Approach 1:
The patent implements partial action by having worker processes handle only specific pattern classes assigned to them. Each worker process performs pattern matching only on the subset of patterns relevant to its class, avoiding the wasteful computation of checking all patterns against every data item. This partial processing approach maintains detection accuracy for assigned patterns while significantly reducing overall resource utilization
Data Source
AI summary
System, methods, and apparatuses enable a network security system to more efficiently perform pattern matching against data items. For example, the disclosed approaches may be used to improve the way in which a deep packet inspection (DPI) microservice performs pattern matching against data items (e.g., network traffic, files, email messages, etc.) in order to detect various types of network security threats (e.g., network intrusion attempts, viruses, spam, and other potential network security issues). A DPI microservice generally refers to an executable component of a network security system that monitors and performs actions relative to input data items for purposes related to computer network security.