基于有状态Bloomfilter引擎的高速分组检测-软件学报.PDF

ISSN 1000-9825, CODEN RUXUEW E-mail: jos@ Journal of Software, Vol.18, No.1, January 2007, pp .117− 126 http://www.j DOI: 10. 1360/jos1 80117 Tel/Fax : +86-10 © 2007 by Journal of Software. All rights reserved. ∗ 基于有状态Bloom filter 引擎的高速分组检测 + 叶明江 , 崔 勇, 徐 恪, 吴建平 (清华大学 计算机科学与技术系,北京 100084) Fast Packet Inspection Using State-Based Bloom Filter Engine + YE Ming-Jiang , CUI Yong, XU Ke, WU Jian-Ping (Department of Computer Science and Technology, Tsinghua University, Beijing 100084, China) + Corresponding author: Phn: +86-10 Fax: +86-10 E-mail: yemingjiang@ Ye MJ, Cui Y, Xu K, Wu JP. Fast packet inspection using state-based Bloom filter engine. Journal of Software, 2007,18(1):117−126. /1000-9825/18/117.htm Abstract: More and more network security applications depend on inspecting the content of the packets to detect the malicious attacks. To detect these attacks online, packet inspection demands exceptionally high performance. A lot of research works have been done in this field, and yet there is still significant room for improvement in throughput and scalability. This paper proposes a fast packet inspection algorithm based on state-based Bloom filter engines (SABFE). To achieve high throughput, parallel design is adopted when searching in one Bloom filter engine and between multiple Bloom filter engines. In addition, specific lookup table and prefix register heap are constructed in SABFE to keep the state of the matched prefix for the sake of detecting long patterns. The analysis and the evaluation show that the high throughput of the al