NeTS: Small: A Language-Based Approach to Deep Packet Inspection: from Theory to Practice

NeTS：Small：基于语言的深度数据包检测方法：从理论到实践

• 批准号: 1724934
• 负责人: Michela Becchi
• 金额: $ 9.43万
• 依托单位: North Carolina State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2017
• 资助国家: 美国
• 起止时间: 2017-01-01 至 2018-01-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1724934&HistoricalAwards=false
• 关键词: NeTS; Small; Language; Based; Approach

Deep packet inspection is at the core of several established and emerging networking applications, such as network intrusion detection and content-aware routing. Due to their expressive power, in recent years regular expressions have been adopted in pattern-sets used for these applications in both industry and academia. Existing high-performance regular expression matching engines are based on finite automata, and are implemented using either logic- or memory-based designs. The former allow peak performance on single packet flows with relatively simple logic, but are not scalable to large numbers of flows; the latter offer scalability in the number of flows at the cost of algorithmic and design complexity. Despite the rich body of work in the area, providing worst-case guarantees is still challenging in the presence of complex regular expressions that include repetitions of wildcards and large character sets. Moreover, existing solutions assume that packets are inspected in-order and after data decompression. This project will develop a language abstraction, data structures, and algorithms for line rate deep packet inspection. In particular, the project will consider open problems in regular expression-based deep packet inspection, namely: (i) handling of complex patterns containing repetitions of wildcards and large character sets, and (ii) inspection of out-of-order packets and compressed traffic. A language-based approach to deep packet inspection will be introduced in order to handle the regular expressions? complexity. This project will integrate concepts from automata theory, practices in data structure and algorithm design, analysis of the requirements of networking applications, and system architecture considerations. The previous work performed by the PI on high speed regular expression matching has attracted the attention of several companies. The PI will leverage these contacts to facilitate the transfer of the proposed research. The PI has added two computer architecture courses to the undergraduate and graduate Electrical and Computer Engineering curriculum at University of Missouri (MU); she will introduce a new networking systems course, which will cover the knowledge generated by this research. The PI will leverage the MU Undergraduate Research Program to involve undergraduate students in the proposed work, which will allow students to work at the intersection of three domains: algorithm and data structure design, system architecture and networking applications. The results of this research will be disseminated through publications and presentations, and by releasing open-source software modules on the PI?s Lab website.

深度数据包检查是几个已建立和新兴网络应用程序的核心，例如网络入侵检测和内容感知的路由。由于它们的表现力，近年来，用于行业和学术界的这些应用的模式集采用了正则表达式。现有的高性能正则表达式匹配引擎基于有限自动机，并使用基于逻辑或基于内存的设计实现。前者允许具有相对简单逻辑的单数据包流的峰值性能，但不能扩展到大量流量。后者以算法和设计复杂性为代价提供了流量数量的可伸缩性。尽管该地区的工作量丰富，但在存在复杂的正则表达式的情况下，提供最坏的案例保证仍然具有挑战性，其中包括通配符和大型角色集的重复。此外，现有解决方案假设对数据包进行了秩序和数据减压后的检查。该项目将开发一种语言抽象，数据结构和算法，以进行线路速率深度数据包检查。特别是，该项目将考虑基于正则表达的深度数据包检查中的开放问题，即：（i）处理包含通配符和大型角色集重复的复杂模式，以及（ii）检查止境数据包和压缩流量。将引入基于语言的深度数据包检查方法以处理正则表达式？复杂。该项目将整合自动机理论，数据结构和算法设计的实践，网络应用要求的分析以及系统体系结构注意事项的概念。 PI对高速正则表达匹配的先前工作吸引了几家公司的注意。 PI将利用这些联系来促进拟议研究的转移。 PI已在密苏里大学（MU）的本科和研究生电气和计算机工程课程中添加了两项计算机建筑课程；她将介绍一个新的网络系统课程，该课程将涵盖这项研究产生的知识。 PI将利用MU本科研究计划使本科生参与拟议的工作，这将使学生能够在三个领域的交叉点工作：算法和数据结构设计，系统体系结构和网络应用程序。这项研究的结果将通过出版物和演示文稿以及在PI？S LAB网站上发布开源软件模块来传播。