AStudyond-leftCountingBloomFilterforDynamicPacketsFiltering.docVIP

A Study on d-left Counting Bloom Filter for Dynamic Packets Filtering Peizhen Lin, Feng Wang*, Weiliang Tan, Hui Deng Yunnan Computer Technology Application Key Lab Kunming University of Science and Technology Kunming, China, 650051 lpz@cnlab.net, wf@cnlab.net, twl@cnlab.net, dh@kmust.edu.cn Abstract In the previous study of dynamic packet filtering technique, list-base Counting Bloom Filter (CBF) algorithm was adopted to implement the filtering rule’s adding and deleting dynamically. However, the drawbacks of list-base CBF, i.e., low memory utilization, limited rule capacity and high false positive rate (FP rate), are obvious. Time efficiency also needs improvement. In this paper, d-left Counting Bloom Filter (d-left CBF) algorithm is exploited to improve the performance of the dynamic packet filtering. Through the usage of the algorithm, compared with list-based CBF, approximately 55 times memory space can be saved at least. In addition, with the increasing of memory allocation, the false positive rate of d-left CBF decreases more significantly than list-base CBF. Improved d-left CBF can enhance time efficiency from16.61% to 39.55% compare with list-based CBF when querying data which matches the filter rules with existed rules quantity from 1000 to 40000 and enhance time efficiency from 0.91% to 18.12% compare with list-based CBF when querying data which doesn’t match the filter rules with existed rules quantity from 1000 to 35000. The experimental results and corresponding analyses indicate that d-left CBF is feasible and high-efficient in the process of the dynamic packet filtering. Key Words: dynamic packet filter; d-left Counting Bloom Filter; false positive rate 1. Introduction Network stream packets capturing technique has been widely used in network applications, i.e., protocol analysis, firewall and intrusion detection system. With the advent of high-speed (more than 1Gbits) network, the capturing performance cannot meet the requirements of real tim