基于IP流本地性的状态检测性能优化方法

Performance Optimization of State Inspection Based on IP Traffic Locality

提出了一种哈希表优化算法(MTH)以提高状态检测的速度.该算法根据IP流本地性,即最近访问过的会话节点很有可能被再次访问的特点,将刚访问的节点放置在Bucket链表头部,以减少哈希表的整体内存访问次数,提高会话表的速度.历史流量驱动的性能仿真实验表明,MTH算法的性能明显优于原哈希表算法,能够满足高速状态检测防火墙的速度要求.

An optimized hash table algorithm - move-to-head (MTH) is introduced to improve the state inspection speed. Due to the IP traffic locality, the recently accessed session nodes have higher probability to be accessed once again. In MTH, they are moved to the head of the bucket chain to reduce the number of the entire memory accesses in the hash table and improve the session table speed. The trace-driven simulations demonstrate that MTH has a better performance than the original hash table algorithm, which suits the high-speed state inspection firewall well.