Advanced Algorithms for Fast and Scalable Deep Packet Inspection Author ： Sailesh Kumar 、 Jonathan Turner 、 John Williams Publisher ： ANCS’06 Presenter ： Wen-Tse Liang Date ： 2010/12/15 1

 Introduction  Background  Content-address D 2 FA  Alphabet reduction  Experimental Evaluation Outline 2

 This paper builds on a new technique for parsing regular expressions using Delayed Input Deterministic Finite Automata (D 2 FA).  Unfortunately, the use of default transitions also reduces throughput, since no input is consumed when a default transition is followed, but memory must be accessed to retrieve the next state. Introduction 3

 D 2 FA Background 4

 replace state identifiers with content labels that include part of the information that would normally be stored in the table entry for the state.  The content labels can be used to skip past default transitions that would otherwise need to be traversed before reaching a labeled transition that matches the current input character. Content-address D 2 FA 5

 content addressing with the example Content-address D 2 FA 6

 Complete Example Content-address D 2 FA 7

 complete representation  example ： aAcba  1 → 461 → 46 → 61 → 58 → 9 Content-address D 2 FA 8

 Our general objective is to create compact CD 2 FAs and not compact therefore we take proper care that default paths do not grow too deep and content labels do not ecome too big.  To meet these objectives, we have developed simple yet effective heuristic called CRO, which runs in three phases, called creation, reduction and optimization. CONSTRUCTION OF GOOD D 2 FAS 9

 Creation phase  During the creation phase, a collection of trees on the space reduction graph is constructed using a variant of Kruskal’s algorithm [24].  We refer to these trees as spanning forest; diameter of all trees in this forest is bounded to two edges, thus the default paths contain a single default transition. CONSTRUCTION OF GOOD D 2 FAS 10

 Creation phase  a) A set of default transition trees created by Kruskal’s algorithm with tree diameter bounded to 2. CONSTRUCTION OF GOOD D 2 FAS 11

 Reduction phase  During reduction phase, the number of trees is reduced in an attempt to increase the weight of the spanning forest.  For any tree under examination, it is first dissolved and all its edges are removed from the forest. Afterwards, each vertex u of the dissolved tree is joined to the root vertex r of one of the tree among all trees in the forest, so that edge (u, r) has the highest weight. CONSTRUCTION OF GOOD D 2 FAS 12

 Reduction phase  After dissolving tree 2-3 and joining its vertices to root vertex 1.  c) After dissolving tree and joining its vertices to root vertices 1, 1 and 8. CONSTRUCTION OF GOOD D 2 FAS 13

 Optimization phase  some states may have many labeled outgoing transition because their default paths are bounded to single default transition.  We may reduce the number of labeled transitions at these states by allowing them to have longer default paths.  This, however, may increase the size of content label of transitions entering into those states, as labels associated with those transitions will store all characters for which transitions are defined at all states along the default path. CONSTRUCTION OF GOOD D 2 FAS 14

 Optimization phase  For a state under examination, a new default state from among all states, whose default path contains a single default transition, is evaluated. If one such default state results in an overall reduction in the memory, then it becomes the new default transition of the examined state. CONSTRUCTION OF GOOD D 2 FAS 15

 Alphabet reduction  We refer to the most frequently occurring “next state” from any given state as its common transition. If we let A denote the original alphabet, set C(s) denote the characters Alphabet reduction 16

 Alphabet reduction  alphabet of the root states can be reduced to  If L(s) is the set of characters for which labeled transitions are present at a non-root state s, then the alphabet of non-root states can become Alphabet reduction 17

 representative regular expression groups Experimental Evaluation 18

Experimental Evaluation 19