Slimming Down Deep Packet Inspection Systems

• Published in: IEEE INFOCOM Workshops 2009 pp. 1 - 6
• Main Authors: Fernandes, S., Antonello, R., Lacerda, T., Santos, A., Sadok, D., Westholm, T.
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01.04.2009
• Subjects: Computer networks; Inspection; Intrusion detection; Payloads; Performance loss; Quality of service; Spine; Telecommunication traffic; Throughput; Web and internet services
• ISBN: 142443968X; 9781424439683
• DOI: 10.1109/INFCOMW.2009.5072188

Internet service providers (ISP) have been recently relying on deep packet inspection (DPI) systems, which are the most accurate techniques for traffic identification and classification. However, building high performance DPI systems requires an in-depth and careful computing system design due to the memory and processing power demands. DPI's accuracy mostly depends on string matching process and regular expression heuristics that go deep down on the packet payloads in a search for networked application signatures. As ISPs backbone links' speed and data volume soar, commodity hardware-based DPI systems start to face performance bottlenecks (e.g., packet losses), which interferes on traffic classification accuracy dramatically. In this paper we propose a lightweight DPI (LW-DPI) system that overcomes performance bottlenecks of traditional DPI systems, without a significant decrease on accuracy. We evaluate LW-DPI's accuracy by inspecting two factors: a limited number of full-payload packets in a given flow or a fraction of the packet payload. Our experiments were performed using more than 6TB of packet-level data from a large ISP and show that there is some interesting trade-offs between such factors and accuracy. Most flows can be classified with only their first 7 packets or a fraction of their payload. We also show that the impact on DPI's processing time may decrease around 75% as compared to analyzing all full-payload packets in a flow.