Accelerating Application Identification with Two-Stage Matching and Pre-Classification  

作　　者：何飞 项帆 邵熠阳 薛一波 李军 

机构地区：[1]Department of Automation, Tsinghua University [2]Research Institute of Information Technology, Tsinghua University [3]Tsinghua National Lab for Information Science and Technology

出　　处：《Tsinghua Science and Technology》2011年第4期422-431,共10页清华大学学报（自然科学版（英文版）

基　　金：Supported by the National High-Tech Research and Development(863) Program of China (No. 2007AA01Z468)

摘　　要：Modern datacenter and enterprise networks require application identification to enable granular traffic control that eJther Jmproves data transfer rates or ensures network security. Providing application visi- bility as a core network function is challenging due to its performance requirements, including high through- put, low memory usage, and high identification accuracy. This paper presents a payload-based application identification method using a signature matching engine utilizing characteristics of the application identifica- tion. The solution uses two-stage matching and pre-classification to simultaneously improve the throughput and reduce the memory. Compared to a state-of-the-art common regular expression engine, this matching engine achieves 38% memory use reduction and triples the throughput. In addition, the solution is orthogonal to most existing optimization techniques for regular expression matching, which means it can be leveraged to further increase the performance of other matching algorithms.Modern datacenter and enterprise networks require application identification to enable granular traffic control that eJther Jmproves data transfer rates or ensures network security. Providing application visi- bility as a core network function is challenging due to its performance requirements, including high through- put, low memory usage, and high identification accuracy. This paper presents a payload-based application identification method using a signature matching engine utilizing characteristics of the application identifica- tion. The solution uses two-stage matching and pre-classification to simultaneously improve the throughput and reduce the memory. Compared to a state-of-the-art common regular expression engine, this matching engine achieves 38% memory use reduction and triples the throughput. In addition, the solution is orthogonal to most existing optimization techniques for regular expression matching, which means it can be leveraged to further increase the performance of other matching algorithms.

关 键 词：application identification deep inspection regular expression traffic classification 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]