Research And Implementation Of LZ77 Compressed Network Traffic Matching Algorithm

The dramatic increase in compression of HTTP text when transferring pages over the Web is largely due to the increase in the number of people accessing the Web via mobile devices.Such as Yahoo! Google,MSN,YouTube,Facebook and other sites use HTTP compression to speed up content downloads.The standard compression method used in HTTP1.1 is GZIP.The dramatic increase in HTTP compression presents new challenges for network devices,such as intrusion prevention systems(IPS),content filtering,and Web application firewalls(WAF),which check content for security risks and balance decisions.These devices are located between the server and the client and perform deep packet checking(DPI),where,after receiving compressed traffic,the network device first needs to unpack the message to check its payload.Recently,DPI components have to deal with compressed traffic,especially due to the proliferation of bandwidth-limited mobile devices.This adds to the additional performance penalty of decompressing data before checking,and most sites now use compressed traffic.So matching compressed network traffic becomes more challenging.The security of the internal network can be protected only if the compressed network traffic can be matched,otherwise the security of the internal network will be greatly reduced.Currently,there are two main compression algorithms for network traffic,namely GZIP algorithm and SDCH algorithm.This paper mainly aims at network traffic compressed by GZIP algorithm.Several for GZIP compression on the analysis of the existing network traffic pattern matching algorithm is the core idea and the matching process,this paper proposes a compression network traffic based on ACCH matching algorithm,named IACCH,mainly aims at is the ACCH when scanning a pointer around the boundary and interior area redundancy scanning problems that may occur.The main research direction of this algorithm is to realize the accelerated compression network traffic matching by increasing the number of bytes that can be skipped when the pointer is scanned.IACCH introduced the concept of a negative factor,a string that does not appear in a pattern string.In the left edge scan process,the left edge scan process can be skipped by judging whether there is a negative factor before the pointer.Then,in the process of scanning the inner region,a new parameter depth is introduced to determine whether the matches between the bytes with the match state in the inner region exceed the pointer boundary.Finally through comparing the experimental design groups,respectively,on the performance of the two algorithms,comparing the space utilization and the matching accuracy by the experimental results can be concluded that IACCH in the space basic unchanged and at the same time can guarantee good any detection under the basis of compared ACCH algorithm on the performance of 10%-30%,and significantly improve the performance.Then,IACCH is further optimized by analyzing the nature of network traffic.In the analysis of the matching process of IACCH,it is found that if the state of the scanned bytes in the automaton can be recorded,the right edge scanning process can be skipped in most cases,so as to achieve the accelerated compression of network traffic matching.IACCH optimization is by introducing a new parameter state to store the bytes in the DFA automata state,in the left border processing process,or by judging whether the pointer before the negative factors to determine whether you can skip the left boundary scan process,right at the scanning boundary by introducing the new parameters in the process of the state to determine whether you can skip right boundary scan process,through the analysis of all the possible case,the algorithm is verified in the vast majority of cases you can skip right boundary scan process,so as to realize the acceleration compression match network traffic.The performance,space occupation and matching accuracy of the algorithm before and after the optimization of ACCH algorithm and IACCH algorithm were compared through several groups of comparative experiments.Through the experiments,it can be concluded that the performance of the optimized algorithm is improved by 5%-20% compared with that of the algorithm before the optimization on the basis of sacrificing some space.