Researches On Non-exact Deep Packet Inspection

With the development of computer networks in today’s society, computernetwork has been widely applied to various fields, like the industrial sector, researchinstitutions, government, financial and economic. And even the entire ordinary socialgroups, there lives have been inseparable from the network, such as various types ofsocial networking and e-commerce. Combined now cloud computing existing，information data is more complex. In order to protect the network data privacy as wellas the reasonable control of network traffic, people are more and more concernedabout how to ensure data security, and data flow analysis. From this direction, itextends a new research direction-deep packet inspection technology.Deep packet inspection extracts the feature strings from the application layerinformation of data packets of an application or some intrusion. And then it uses thesefeature strings do exact matching with the application layer data of input data stream.If input data stream is an exact match with a feature string, the feature stringcorresponds to the intrusion or application type. But a great disadvantage is that whenthe original semantics of a feature string in application layer changes, input datastream could not be detected accuracy by this feature string.In this paper, in order to solve this drawback, we proposed a new classificationmethod, named Counting Deterministic Finite Automata (DFA) that is based onstatistic. And we also designed a cloud classification system based on Counting DFA.The Basic Counting DFA is AC multi-mode matching algorithm. The feature stringrandomly selected from the training set. Classification results with AC automata arebased on statistics. Advanced Counting DFA design two ways to join DFAs togetherwhich are Linked DFA and Combined DFA. At the same time, we design an automaticthreshold selection method to improve classification accuracy.