###
DOI:
Journal of Software:2007.18(1):117-126

基于有状态Bloom filter引擎的高速分组检测
叶明江,崔勇,徐恪,吴建平
(清华大学,计算机科学与技术系,北京,100084)
Fast Packet Inspection Using State-Based Bloom Filter Engine
YE Ming-Jiang,CUI Yong,XU Ke,WU Jian-Ping
()
Abstract
Chart / table
Reference
Similar Articles
Article :Browse 4368   Download 3995
Received:November 08, 2005    Revised:April 03, 2006
> 中文摘要: 越来越多的网络安全技术通过分析网络分组中的内容来检测报文中是否含有恶意攻击代码.为了能够在线检测攻击,部署在路由器中的分组检测模块对于分组检测的速度也提出了越来越高的要求.虽然在这个领域已有很多研究工作,然而在性能、可扩展性和适用性方面还有很多可研究的空间.提出了一种基于有状态Bloom filter引擎的高速分组检测方法State-Based Bloom filter engine(SABFE).通过并行查找Bloom filter和前缀寄存器堆,以及利用多个并行的Bloom filter引擎进行流并行检测,达到了较高的吞吐性能.同时,利用快速查找表和前缀寄存器堆保存当前子串的匹配状态来检测长的规则.分析和模拟实验表明:该方法在规则长度增加时依然保持了较高的吞吐性能,可以实现线速的分组检测,同时,极大地减少了硬件资源开销,提高了可扩展性.
Abstract:More and more network security applications depend on inspecting the content of the packets to detect the malicious attacks. To detect these attacks online, packet inspection demands exceptionally high performance. A lot of research works have been done in this field, and yet there is still significant room for improvement in throughput and scalability. This paper proposes a fast packet inspection algorithm based on state-based Bloom filter engines (SABFE). To achieve high throughput, parallel design is adopted when searching in one Bloom filter engine and between multiple Bloom filter engines. In addition, specific lookup table and prefix register heap are constructed in SABFE to keep the state of the matched prefix for the sake of detecting long patterns. The analysis and the evaluation show that the high throughput of the algorithm can satisfy the wire speed detection requirement when the low resource consumption in hardware resource further improves the scalability of SABFE.
文章编号:     中图分类号:    文献标志码:
基金项目:Supported by the National Natural Science Foundation of China under Grant Nos.60473082, 60403035 (国家自然科学基金); the National Grand Fundamental Research 973 Program of China under Grant No.2003CB314801 (国家重点基础研究发展规划(973)) Supported by the National Natural Science Foundation of China under Grant Nos.60473082, 60403035 (国家自然科学基金); the National Grand Fundamental Research 973 Program of China under Grant No.2003CB314801 (国家重点基础研究发展规划(973))
Foundation items:
Reference text:

叶明江,崔勇,徐恪,吴建平.基于有状态Bloom filter引擎的高速分组检测.软件学报,2007,18(1):117-126

YE Ming-Jiang,CUI Yong,XU Ke,WU Jian-Ping.Fast Packet Inspection Using State-Based Bloom Filter Engine.Journal of Software,2007,18(1):117-126