Fast 2D filter with low false positive for network packet inspection. Issue 6 (1st November 2017)

• Record Type: Journal Article
• Authors: Shubbar, Roaa; Ahmadi, Mahmood
• Is Part Of: IET networks. Volume 6:Issue 6(2017)
• Page Start: 224
• Page End: 231
• Publication Date: 2017-11-01
• Subjects: two‐dimensional digital filters -- packet radio networks -- digital signatures; deep packet inspection -- DPI -- network intrusion detection and prevention systems -- security threat -- data packet -- central processing unit resources -- memory resources -- two‐dimensional filter -- 2D filter -- false positive rate -- single hash function; Computer network architectures -- Periodicals; Computer network protocols -- Periodicals; Information networks -- Periodicals; Telecommunication systems -- Periodicals; 004.605
• DOI: 10.1049/iet-net.2017.0055
• Languages: English
• ISSNs: 2047-4954

Abstract

Abstract : Deep packet inspection (DPI) represents the major process in network intrusion detection and prevention systems. In DPI each security threat is represented as a signature, and the payload of every incoming data packet is matched against the set of current signatures. Moreover, DPI is also used for other networking applications such as packet classification, quality of service techniques, protocol identification and so on. DPI exhausts extra central processing unit and memory resources, and as a result, several attempts have been proposed to improve this process. In this study, the authors proposed a fast two‐dimensional (2D) filter with low false positive (FP) rate for DPI purposes. It consists of 2D array that employs single hash function and has very low FP rate. Using this filter as an identification tool in a DPI technique will result in more accurate and higher throughput than other systems that employ Bloom (BFs) and quotient filters (QFs). Our experiments show that the proposed solution has time improvement up to 94% over others that employ BFs or QFs and the achieved average throughput is 1.8 Gbps.