Research On DPI Technology And Its Implemtntation

With the development and popularization of computer network, Internet has become an important element of our life in recent years. Facing with the increasing traffic on Internet due to the explosive growth of the Internet users and access bandwidth, issues such as how to distribute the network resource reasonably to insure the different application demands with different users; how to decrease network congestion to improve the performance of several applications; how to identify and deal with malwares to insure a safe and reliable network environment has been getting more and more attention from ISPs, operators and companies. To solve the issues, the primary thing we need to do is to identify and classify the application traffic correctly. Therefore, traffic identification and classification has become an important research direction.This paper focuses on the traffic identification and classification in the high speed environment, the main work and innovative contributions in this paper are listed as follows.First, to solve the low precision and lagging of encrypted P2P traffic identification in current network, this paper propose a deep flow identification scheme which uses statistical feature of a bidirectional flow and combines decision tree method. The scheme extracts the length of initial three messages during the interaction of protocol in a flow as flow feature and uses method of decision tree to learn a classification model, then use the model to identify unkown flows.Through experiments the paper explains the accuracy of using this flow feature to identify encrypted P2P flows; it shows that ups to90%encrypted P2P flows can be identified correctly and the recognition rate of traffic can reach ups to93%, which shows a very good real-time and accurate performance.Second, aiming at the demand of traffic identification and classification in the high speed environment, this paper proposes a real-time and efficient traffic identification and classification scheme that combines DPI technology with DFI technology that uses the length of initial three messages during the interaction of protocol in a flow as flow feature. The main work includes the design of operating mechanism, division of modules, implementation of principle modules and performance analysis. It shows that the scheme can support a packet-by-packet identification in a multi-application system and the traffic recognition rate can reach ups to90%.Third, basing on the preceding scheme, this paper designs the scheme of traffic identification on10G EPON system and evaluates the amount of subsequent flows in OLT and ONU. Embedded software for10G EPON ONU which supports traffic identification under this design is also designed.