Deep packet inspection tools and techniques in commodity platforms: Challenges and trends

Journal of Network and Computer Applications

Volumn 35, Issue 6, 2012, Pages 1863-1878

  Antonello, Rafael ^a   Fernandes, Stenio ^a   Kamienski, Carlos ^b   Sadok, Djamel ^a   Kelner, Judith ^a   Gódor, István ^c   Szabó, Géza ^c   Westholm, Tord ^d  

^a FEDERAL UNIVERSITY OF PERNAMBUCO   (Brazil)

^b UNIVERSIDADE FEDERAL DO ABC   (Brazil)

^c ERICSSON RESEARCH   (Hungary)

^d ERICSSON RESEARCH   (Sweden)

Author keywords

Deep packet inspection; Internet profiling; Traffic Identification

Indexed keywords

DEEP PACKET INSPECTION; LITERATURE REVIEWS; NETWORK FLOWS; NETWORK SERVICES; NETWORKED APPLICATIONS; QUALITY OF SERVICE GUARANTEES; RESEARCH CHALLENGES; RESEARCH TOPICS; TECHNICAL BACKGROUND; TOOLS AND TECHNIQUES; TRAFFIC IDENTIFICATION; TRAFFIC-SHAPING;

INTERNET SERVICE PROVIDERS; QUALITY OF SERVICE; RESEARCH; WORLD WIDE WEB;

PACKET NETWORKS;

EID: 84867561938     PISSN: 10848045     EISSN: 10958592     Source Type: Journal    
DOI: 10.1016/j.jnca.2012.07.010     Document Type: Article

References (83)

1. Aceto G, Dainotti A, de Donato W, Pescape A, PortLoad: taking the best of two worlds in traffic classification, INFOCOM IEEE conference on computer communications workshops; 2010, pp. 1-5, 15-19 March 2010.
2. AV Aho, and MJ Corasick Efficient string matching: an aid to bibliographic search Communications of the ACM 18 6 1975 333 340
3. Antonello R, Fernandes S, Sadok D, Kelner J, Characterizing signature sets for testing DPI systems. In: The 3rd IEEE international workshop on management of emerging networks and services (IEEE MENS 2011), 2011, Houston.
4. Antonello R, Fernandes S, Sadok D, Kelner Je Geza S. Deterministic finite automaton for scalable traffic identification: the power of compressing by range. NOMS 2012, 2012.
5. Becchi M, Franklin M, Crowley P.A workload for evaluating deep packet inspection architectures. In: Proceedings of the 11th IEEE international symposium on workload characterization (IISWC 2008), Seattle, WA, September, 2008.
6. Becchi M, Crowley P. A hybrid finite automaton for practical deep packet inspection. In Proceedings of the 2007 ACM CoNEXT conference (New York, NY, December 10-13, 2007). CoNEXT '07, 2007a.
7. Becchi M, Crowley P. An improved algorithm to accelerate regular expression evaluation. In Proceedings of the 3rd ACM/IEEE symposium on architecture for networking and communications systems (Orlando, FL, December 03-04, 2007). ANCS '07, 2007b.
8. Becchi M, Cadambi S.Memory-efficient regular expression search using state merging, INFOCOM 2007. 26th IEEE international conference on computer communications. IEEE: 1064-72, 2007.
9. D Bovet, and M Cesati Understanding the Linux Kernel 3rd ed. 2005 Oreilly & Associates Inc
10. Boyer RS, Moore JS 1977. A fast string searching algorithm. Commun. ACM 20, 10 (Oct. 1977).
11. Bro Intrusion Detection System. 〈http://bro-ids.org/Overview. html〉. Last access: April, 2012.
12. Callado A, Kamienski C, Gero B, Szabo G, Fernandes S, Sadok, D,A survey on internet traffic identification and classification IEEE Communications Surveys & Tutorials, 2009.
13. N Cascarano, P Rolando, F Risso, and R Sisto iNFAnt: Nfa pattern matching on GPGPU devices ACM SIGCOMM Computer Communication Review (CCR) 40 5 2010
14. Cisco IOS IPS deployment guide, 〈www.cisco.com〉. Last access: April, 2012.
15. Clam AntiVirus WebSite. 〈http://www.clamav.net/〉. Last access: April, 2012.
16. Covington GA, Gibb G, Lockwood JW, Mckeown N.A packet generator on the NetFPGA platform, field programmable custom computing machines, 2009. FCCM '09. 17th IEEE symposium on, pp. 235-238, 5-7 April 2009.
17. DAG Network Monitoring Cards. 〈http://www.endace.com/dag-network- monitoring-cards.html〉. Last access: April, 2012.
18. DansGuardian WebSite. 〈http://dansguardian.org/. Last access〉: April, 2012.
19. Deri L 2005. nCap: wire-speed packet capture and transmission. Workshop on end-to-end monitoring techniques and services (May 2005), pp. 47-55. IEEE computer society, Los Alamitos, CA, USA. 〈http://doi.ieeecomputersociety. org/10.1109/E2EMON.2005.1564468〉
20. Dreger H, Feldmann A, Mai M, Paxson V, Sommer R. Dynamic application-layer protocol analysis for network intrusion detection. In Proceedings of the 15th conference on USENIX Security Symposium, pp. 18-18, July 31-August 04, 2006, Vancouver, BC, Canada.
21. D Ficara, A Di Pietro, S Giordano, G Procissi, F Vitucci, and G Antichi Differential encoding of DFAs for fast regular expression matching IEEE/ACM Transactions on Networking 19 3 2011
22. Ficara D, Giordano S, Procissi G, Vitucci F, Antichi G, Di Pietro A 2008. An improved DFA for fast regular expression matching. SIGCOMM Computer Communications Review 38, 5 29-40. 〈http://doi.acm.org/10.1145/1452335. 1452339〉.
23. Garcia-Dorado J, Finamore A, Mellia M, Meo M, Munafo M. Characterization of ISP traffic: trends, user habits, and access technology impact, network and service management, IEEE transactions on, vol. no. 99: 1-14, 2012.
24. Gibb G, Lockwood JW, Naous J, Hartke P, McKeown N. Netfpga: an open platform for teaching how to build gigabit-rate network switches and routers. In IEEE transactions on education, August 2008.
25. Gonzalez JM, Paxson V, Weaver N 2007. Shunting: a hardware/software architecture for flexible, high-performance network intrusion prevention. In Proceedings of the 14th ACM conference on computer and communications security (Alexandria, VA, USA, October 28-31, 2007). CCS '07. ACM, New York, NY, pp. 139-49.
26. Goyal N, Ormont J, Smith R, Sankaralingam K, Estan C. Signature matching in network processing using SIMD/GPU Architectures, Technical report, department of computer sciences, University of Wisconsin-Madison, available at 〈http://www.cs.wisc.edu/techreports/2008/TR1628.pdf〉, January 2008.
27. Guo D, Liao G, Bhuyan LN, Liu B, Ding JJ. A scalable multithreaded L7-filter design for multi-core servers. In Proceedings of the 4th ACM/IEEE symposium on architectures for networking, 2008.
28. Handley M, Paxson V, Kreibich C. Network intrusion detection: evasion, traffic normalization, and end-to-end protocol semantics. In Proceedings of the 10th conference on USENIX security symposium, vol. 10 (Washington, DC, August 13-17, 2001). USENIX security symposium. USENIX association, Berkeley, CA, 9-9, 2001.
29. Hopcroft JE. An N Log N algorithm for minimizing states in a finite automaton. Technical report. UMI order number: CS-TR-71-190, Stanford University, 1971.
30. Hopcroft JE, Motwani R, Ullman, JD. Introduction to automata theory, languages, and computation, 3rd ed, 2006.
31. Jiang W, Prasanna VK. A FPGA-based parallel architecture for scalable high-speed packet classification. Application-specific systems, architectures and processors, 2009. ASAP 2009. 20th IEEE international conference on, pp. 24-31, 7-9 July 2009.
32. Toshihiro Kataa, Yoshinori Yamaguchi, Atusi Maeda, and Kenji Toda FPGA-based intrusion detection system for 10 gigabit ethernet IEICE TRANSACTIONS on Information and Systems E90-D 1923-1931
33. Kim H, Claffy K, Fomenkov M, Barman D, Faloutsos M, Lee K. Internet traffic classification demystified: myths, caveats, and the best practices. In Proceedings of the 2008 ACM CoNEXT conference (Madrid, Spain, December 09-12, 2008). CoNEXT '08. ACM, New York, NY, 1-12
34. Knuth D, Morris JH, Jr, Pratt V. Fast pattern matching in strings. SIAM Journal on Computing 6(2): 323-350. doi:10.1137/0206024.
35. Kumar S, Dharmapurikar S, Yu F, Crowley, P, Turner, J. Algorithms to accelerate multiple regular expressions matching for deep packet inspection. In Proceedings of the 2006 conference on applications, technologies, architectures, and protocols for computer communications (Pisa, Italy, September 11-15, 2006). SIGCOMM '06, 2006a.
36. Kumar S, Turner J, Williams J. Advanced algorithms for fast and scalable deep packet inspection. In Proceedings of the 2006 ACM/IEEE symposium on architecture for networking and communications systems (San Jose, California, USA, December 03-05, 2006). ANCS '06, 2006b.
37. Levandoski J, Sommer E, Strait M. Application layer packet classifier for Linux. 〈http://l7-filter.sourceforge.net/〉. Last access: April, 2012.
38. Harry R. Lewis, and H Papadimitrou Christo Elemenets of the theory of computation 1981 Prentice Hall
39. Libpcap. 〈http://sourceforge.net/projects/libpcap/〉. Last access: April, 2012.
40. Libpcap-mmap. 〈http://public.lanl.gov/cpw/〉. Last access: April, 2012.
41. Lin C, Huang C, Jiang C, Chang S.Optimization of regular expression pattern matching circuits on FPGA. In Proceedings of the conference on design, automation and test in Europe: designers' forum (Munich, Germany, March 06-10, 2006).
42. P.-C Lin, ZX Li, YD Lin, YC Lai, and FC Lin Profiling and accelerating string matching algorithms in three network content security applications Communications Surveys & Tutorials, IEEE 8 2 2006 24 37 Second Quarter
43. T Liu, Y Yang, Y Liu, Y Sun, and Li Guo An efficient regular expressions compression algorithm from a new perspective IEEE INFOCOM 2011
44. Lockwood John W, McKeown Nick, Watson Greg, Gibb Glen, Hartke Paul, Naous Jad, Raghuraman Ramanan, Luo Jianying. NetFPGA - an open platform for gigabit-rate network switching and routing. In: Proceedings of the 2007 IEEE international conference on microelectronic systems education (MSE '07). IEEE computer society, Washington, DC, USA, 2007.
45. Moore AW, Papagiannaki K.Toward the accurate identification of network applications. In passive and active network measurement: Proceedings of the passive & active measurement workshop, pp. 41-54, 2005.
46. NAPI-New API. 〈http://www.linuxfoundation.org/en/Net:NAPI〉. Last access: April, 2012.
47. Nathan Tuck, Timothy Sherwood, Brad Calder, George Varghese. Deterministic memoryefficient string matching algorithms of intrusion detection. In Proceedings of the IEEE infocom onference [1], pp. 333-340, 2004.
48. EK Ngassam Hardcoding finite automata 2003 MSc Dissertation, Delft University of Petroria
49. Ngassam EK, Watson BW, Kourie D Gg.On hardcoding finite state automata processing, Technische Universiteit Eindhoven. 2003.
50. Nigel Jacob, Carla Brodley. Offloading IDS computation to the GPU, computer security applications conference, 2006. ACSAC '06. 22nd Annual, 371-80, 2006.
51. Packet Logic Platform. 〈http://www.proceranetworks.com/packetlogic- hardware-platforms.html〉. Last access: April, 2012.
52. Park K, Lee H. On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets. SIGCOMM Computer Communications Review 31, 4, 15-26. http://doi.acm.org/10.1145/964723.383061, 2001.
53. Paxson V, Asanović K, Dharmapurikar S, Lockwood J, Pang R, Sommer R, Weaver N. Rethinking hardware support for network analysis and intrusion prevention. In Proceedings of the 1st conference on USENIX workshop on hot topics in security,vol. 1 (Vancouver, BC, Canada). USENIX Association, Berkeley, CA, pp. 11-11, 2006.
54. Paxson V, Sommer R, Weaver N. An architecture for exploiting multi-core processors to parallelize network Intrusion Prevention. Proceedings of IEEE sarnoff symposium, May 2007, 2007.
55. PCI Sig-PCI express specifications. 〈http://www.pcisig.com/ specifications/pciexpress/specifications〉. Last access: April, 2012.
56. PF: Packet Filtering. 〈http://www.openbsd.org/faq/pf/filter. html〉. Last access: April, 2012.
57. PF-RING Page. 〈http://www.ntop.org/PF-RING.html〉. Last access: April, 2012.
58. Randy Smith, Cristian Estan, Somesh Jha. XFA: faster signature matching with extended automata, sp, pp. 187-201, 2008 IEEE symposium on security and privacy (sp 2008).
59. Schneider F, Wallerich J Performance evaluation of packet capturing systems for high-speed networks. In Proceedings of the 2005 ACM conference on emerging network experiment and technology (Toulouse, France, October 24-27, 2005). CoNEXT '05. ACM, New York, NY, pp. 284-5. http://doi.acm.org/10.1145/ 1095921.1095982.
60. Schneider F, Wallerich J, Feldmann A Packet capture in 10-gigabit ethernet environments using contemporary commodity hardware. pp. 207-17. 2007.
61. Seamans Elizabeth, Alexander Thomas. Fast virus signature natching on the GPU. GPU Gems 3, chapter 35, pp. 771-83, Addison-Wesley, 2007.
62. Jongwoo Seongjin Lee, Soohan Song, Ahn, and Youjip Won Session-based classification of internet applications in 3G wireless networks Computer Networks 55 17 2011 3915 3931
63. Smith R, Estan C, Jha S, Kong S. Deflating the big bang: fast and scalable deep packet inspection with extended finite automata. SIGCOMM Computer Communications Review 38, 4, 207-218. http://doi.acm.org/10.1145/1402946. 1402983, 2008.
64. SNORT Network Intrusion Detection System. 〈http://www.snort. org〉. Last access: April, 2012.
65. Song H, Lockwood JW. Efficient packet classification for network intrusion detection using FPGA. In Proceedings of the 2005 ACM/SIGDA 13th international symposium on field-programmable gate arrays (Monterey, California, USA, February 20-22, 2005). FPGA '05. ACM, New York, NY, pp. 238-45. http://doi.acm.org/10.1145/1046192.1046223.
66. Song T, Zhang W, Wang D, Xue Y. A memory efficient multiple pattern matching architecture for network Security. In Proceedings of 27th IEEE international conference on computer communications, joint conference of the IEEE computer and communications societies, April 2008, Phoenix, AZ, USA 2008.
67. Sourdis I Designs & algorithms for packet and content inspection. PhD thesis, Delft University of Technology, 2007.
68. Spitznagel E, Taylor D, Turner, J. Packet classification using extended TCAMs. In Proceedings of the 11th IEEE international conference on network protocols (November 04-07, 2003). ICNP. IEEE Computer Society, Washington, DC, 120, 2003.
69. Sun Y, Liu H, Valgenti VC, Kim M. Hybrid regular expression matching for deep packet inspection on multi-core architecture, computer communications and networks (ICCCN), 2010 Proceedings of 19th international conference on, pp. 1-7, 2-5 Aug. 2010.
70. Tan L, Sherwood T. A high throughput string matching architecture for intrusion detection and prevention. In Proceedings of the 32nd annual international symposium on computer architecture (June 04-08, 2005). International symposium on computer architecture. IEEE computer society, Washington, DC, 112-22.
71. TNAPI-Multi-threaded NAPI. 〈http://www.ntop.org/TNAPI.html〉. Last access: April, 2012.
72. User-space E1000 driver library. 〈http://sourceforge.net/projects/ libe1000/〉. Last access: April, 2012.
73. M. Vallentin, R Sommer, J Lee, C Leres, V Paxson, and Brian Tierney The N.I.D.S. cluster: scalable, stateful network intrusion detection on commodity hardware Proceedings of RAID 2007
74. O Villa, DP Scarpazza, and F Petrini Accelerating real-time string searching with multicore processors Computer 41 4 2008 42 50
75. Wang L, Chen S, Tang Y, Su J. Gregex: GPU based high speed regular expression matching engine, innovative mobile and internet services in ubiquitous computing (IMIS), 2011. Fifth international conference on, pp. 366-70, June 30 2011-July 2 2011.
76. Weaver N, Paxson V, Gonzalez JM. The shunt: an FPGA-based accelerator for network intrusion prevention. In Proceedings of the 2007 ACM/SIGDA 15th international symposium on field programmable gate arrays (Monterey, California, USA, February 18-20, 2007). FPGA '07. ACM, New York, NY, pp. 199-206, 2007.
77. Wu S, Manber U. A fast algorithm for multi-pattern searching, Technical report TR-94-17, Department of computer science, University of Arizona (May 1993).
78. Yan Luo, Pablo Cascon, Eric Murray, Julio Ortega. Accelerating OpenFlow switching with network processors. In Proceedings of the 5th ACM/IEEE symposium on architectures for networking and Communications Systems (ANCS '09). ACM, New York, NY, USA, 70-1, 2009.
79. Yaxuan Qi, Bo Xu, Fei He, Baohua Yang, Jianming Yu, Jun Li. 2007. Towards high-performance flow-level packet processing on multi-core network processors. In Proceedings of the 3rd ACM/IEEE symposium on architecture for networking and communications systems (ANCS '07). ACM, New York, NY, USA, pp. 17-26.
80. Yeon-sup Lim, Hyun-chul Kim, Jiwoong Jeong, Chong-kwon Kim, Ted Taekyoung Kwon, Yanghee Choi. Internet traffic classification demystified: on the sources of the discriminative power. In Proceedings of the 6th international conference (Co-NEXT '10). ACM, New York, NY, USA, article 9, 12 p, 2010.
81. Yu F, Chen Z, Diao Y, Lakshman TV, Katz RH. Fast and memory-efficient regular expression matching for deep packet inspection. In Proceedings of the 2006 ACM/IEEE symposium on architecture for networking and communications systems (San Jose, California, USA, December 03-05, 2006), 2006.
82. Yu F, Katz RH, Lakshman TV. Gigabit rate packet pattern-matching using TCAM. In Proceedings of the 12th IEEE international conference on network protocols (October 05-08, 2004). ICNP. IEEE Computer Society, Washington, DC, pp. 174-83.
83. Zheng Kai, Che H, Wang Z, Liu B. TCAM-based distributed parallel packet classification algorithm with range-matching solution, INFOCOM 2005. 24th annual joint conference of the IEEE computer and communications societies. Proceedings IEEE, vol. 1: 293-303, 2005