| With the development of the Internet,a number of areas,including intrusion detection,content audit and network control,have higher demanding on the deep packet inspection(DPI)under high-speed links.They require high-performance pattern matching technology for fine traffic analysis,as well as larger flow-tables for flow-level packet splitting and processing.Under the high-speed network environment,the challenge lies on how to improve the processing capacity and performance of the system.Pattern matching is the core technology of DPI,which is generally implemented by automaton.The matching speed is mainly limited by great storage space and slow memory access.And the critical part to realize a massive flow-table is dealing with the address collisions.To address the issues mentioned above,this thesis proposed relevant solutions which are implemented in practice.The main work and innovations of the thesis are as follows:(1)A pattern matching technique based on hybrid memories was proposed.Memory accessing problem can be solved using low-capacity high-speed memory for frequent-access states and large-capacity low-speed memory to store full state tables.Through the Markov chains theory,the states accessing probability can be predicted to reasonably deploy the state transition tables,making the highspeed memory have a high hit rate.(2)A look-up method for massive flows based on DDR SDRAM was proposed.To ensure the flow tables have sufficient storage capacity and acceptable accessing performance,an efficient flow look-up model based on DDR was designed.The table collision rate can be greatly reduced using a modified hashing algorithm,thus satisfying ten millions of flows storing and looking up.(3)The relevant methods and algorithms were implemented in a DPI system based on FPGA.Parallel matching engines with two-stage table look-up was used with efficient flow management realized in an approach combining hardware and software.The system performance was evaluated to be higher than 10 Gbps. |
PDF Full Text Request