FlowSifter: A counting automata approach to layer 7 field extraction for deep flow inspection

In this paper, we introduce FlowSifter, a systematic framework for online application protocol field extraction. FlowSifter introduces a new grammar model Counting Regular Grammars (CRG) and a corresponding automata model Counting Automata (CA). The CRG and CA models add counters with update functio...

Full description

Saved in:
Bibliographic Details
Published in2012 Proceedings IEEE INFOCOM pp. 1746 - 1754
Main Authors Meiners, C., Norige, E., Liu, A. X., Torng, E.
Format Conference Proceeding
LanguageEnglish
Published IEEE 01.03.2012
Subjects
Approximation methods
Automata
Data mining
Grammar
Production
Protocols
Radiation detectors
Online AccessGet full text

Cover

More Information
Summary:In this paper, we introduce FlowSifter, a systematic framework for online application protocol field extraction. FlowSifter introduces a new grammar model Counting Regular Grammars (CRG) and a corresponding automata model Counting Automata (CA). The CRG and CA models add counters with update functions and transition guards to regular grammars and finite state automata. These additions give CRGs and CAs the ability to parse and extract fields from context sensitive application protocols. These additions also facilitate fast and stackless approximate parsing of recursive structures. These new grammar models enable FlowSifter to generate optimized Layer 7 field extractors from simple extraction specifications. In our experiments, we compare FlowSifter against both BinPAC and UltraPAC, which are the freely available state of the art field extractors. Our experiments show that when compared to UltraPAC parsers, FlowSifter extractors run 84% faster and use 12% of the memory.
ISBN:9781467307734
1467307734
ISSN:0743-166X
2641-9874
DOI:10.1109/INFCOM.2012.6195547