QCF for deep packet inspection

Abstract

Deep packet inspection (DPI) acts as a tool to control and classify incoming network traffic depending on users,content, applications and becomes a very important aspect of every network today. Instead of utilising only incoming packet header information, Internet service providers utilise DPI for security purposes, flow management, and routing. The highperformance challenges that face DPI techniques to manage line-speed packet processing with restricted available memory are the increasing traffic volumes and link rates. Bloom (BF) and quotient (QF) filters are effective randomised data structures for performing approximate membership queries. They have been employed in many networking applications including DPI. Nevertheless, they consume more calculations which degrade the system performance. Consequently, in this paper, the authors propose a new variant of membership query data structure, called quotient-based Cuckoo filter (QCF), that reflects a merging process between QF and CF to minimise the calculation overhead and employing it in a DPI system. QCF employs only two hash functions and consumes less calculation overhead than BF, QF, and CF. The implementation results show that using QCF as an identification tool in a DPI system result in a time improvement up to 77% over CF and up to 98% over BF and QF.

Modern ağ trafiği analizi için derin paket incelemesi hakkında kapsamlı bir çalışma: sorunlar ve zorluklar

“…The biggest challenge facing CF performance is the use of three hash functions which causes additional computations. Quotient-based Cuckoo filter (QCF) [60] which uses only two hash functions has less computational overhead than standard CF. This filter has higher insertion, query and deletion capability than CF.…”

“…Probabilistic data structures are used as a matching tool in many DPI applications [60][61][62][63][64][65]. In the study numbered [61], Prefix BF (PBF) and Chain Heuristic methods are proposed, which allow pattern matching without defragmentation in order to reduce the required storage space.…”

Fast Packet Inspection for End-To-End Encryption

“…Because a DPI is known to consume a large volume of memory space and CPU resources during the packet payload filtering process, numerous studies have been actively conducted to address such issues during the filtering process [24]. A method using quotient-based Cuckoo, which employs a combination of a quotient filter (QF) and a cuckoo filter (CF), was proposed as an alternative to a bloom filter (BF), QF, and CF [25]. This method uses two hash functions, which enables the minimizing of the computational overhead by reducing the inspection time by up to 77% compared to CF, and up to 98% compared to the BF and QF methods [25].…”

“…A method using quotient-based Cuckoo, which employs a combination of a quotient filter (QF) and a cuckoo filter (CF), was proposed as an alternative to a bloom filter (BF), QF, and CF [25]. This method uses two hash functions, which enables the minimizing of the computational overhead by reducing the inspection time by up to 77% compared to CF, and up to 98% compared to the BF and QF methods [25]. However, it poses the limitation that a delay may occur owing to additional decryption and encryption processes added for the packet processing when the method is applied to an E2EE environment.…”

Designing Cuckoo Based Pending Interest Table for CCN Networks

“…CF has several preferences compared with the previous ones, Bloom and Quotient filters. Among these preferences: higher insertion/query/deletion throughput, lower storage requirements, and lower false positive probability [10]. The proposed design for PIT by employing our modification for Cuckoo filter (we called CF-PIT) will result in quick search, and low memory demand which consider the essential significant characteristics for suggesting an effective PIT.…”