高速低功耗深度报文检测方法

Hish speed deep packet inspection method with low power dissipation

针对基于三态内容寻址存储器(TCAM,ternary content addressable memory)的深度报文检测(DPI,deep packet inspection)存在的高功耗问题,提出一种分级DPI方法BF-TCAM。第一级采用低功耗的并行布鲁姆过滤器(bloom fliter)排除无需检测的正常报文;第二级采用TCAM对真正需要检测的攻击报文和第一级的假阳性误判报文做进一步的检测。由于网络流量中大部分报文是正常报文,攻击报文在其中只占很少的部分,布鲁姆过滤器的假阴性(false negative)概率为0,可以保证不会产生漏检,假阳性概率很低,可以保证高速DPI检测的同时大大地降低功耗。

Hish speed deep packet inspection using TCAM faces the problem of high power dissipation.A 2-phase DPI method BF-TCAM was proposed.The first phase used parallel Bloom filters to exclude the normal packets not including attack signatures.The second phase used TCAM to inspect suspicious packets including real attack packets and false positive packets of the first phase.The Bloom filters＇ false negative probability is zero and false positive probability is very low.Since most of the network data traffic does not include attack signatures,the method can get high speed deep packet inspection with low power dissipation.