This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
Fast Deep Packet Inspection with a Dual Finite Automata
Feb. 2013 (vol. 62 no. 2)
pp. 310-321
Cong Liu, Sun Yat-sen University, Guangzhou
Jie Wu, Temple University, Philadelphia
Deep packet inspection, in which packet payloads are matched against a large set of patterns, is an important algorithm in many networking applications. Nondeterministic Finite Automaton (NFA) and Deterministic Finite Automaton (DFA) are the basis of existing algorithms. However, both NFA and DFA are not ideal for real-world rule sets: NFA has the minimum storage, but the maximum memory bandwidth; while DFA has the minimum memory bandwidth, but the maximum storage. Specifically, NFA and DFA cannot handle the presence of character sets, wildcards, and repetitions of character sets or wildcards in real-world rule sets. In this paper, we propose and evaluate a dual Finite Automaton (dual FA) to address these shortcomings. The dual FA consists of a linear finite automaton (LFA) and an extended deterministic finite automaton (EDFA). The LFA is simple to implement, and it provides an alternative approach to handle the repetition of character sets and wildcards (which could otherwise cause the state explosion problem in a DFA) without increasing memory bandwidth. We evaluate the automaton in real-world rule sets using different synthetic payload streams. The results show that dual FA can reduce the number of states up to five orders of magnitude while their memory bandwidth is close to minimum.
Index Terms:
Doped fiber amplifiers,Automata,Erbium-doped fiber amplifier,Payloads,Inspection,Bandwidth,Explosions,dual finite automaton (dual FA),Deep packet inspection,linear finite automaton (LFA)
Citation:
Cong Liu, Jie Wu, "Fast Deep Packet Inspection with a Dual Finite Automata," IEEE Transactions on Computers, vol. 62, no. 2, pp. 310-321, Feb. 2013, doi:10.1109/TC.2011.231
Usage of this product signifies your acceptance of the Terms of Use.