Pattern matching

Increasing volume of network traffic in modern high-speed network comes with increasing number and diversity of threats. In addition, the attacks are more and more sophisticated and it is more difficult to reveal them. It’s no longer enough to use detection based on L3 or L4 header fields as many applications use dynamic TCP/UDP ports and attackers use non-standard TCP/UDP ports. If you want to see what’s really going on, you need to look inside. The technique known as Deep Packet Inspection (DPI) serves exactly this purpose. It looks at L7 application data and analyses the contents of Internet (HTTP protocol), email (SMTP, POP, IMAP), DNS and other forms of communication.

There is a crucial difference between DPI and classification based on extracted header fields. The classification works with values of header fields that are always located on positions relative to the beginning of the packet that can be determined fairly easily. On the other hand, DPI needs to inspect the whole packet, including its payload. An example could be the class of HTTP traffic that is identified by its text header, not by a TCP/UDP port it has assigned. If you use the TCP/UDP port number for identification of HTTP traffic, you will lose all HTTP traffic passing through non-standard TCP/UDP ports.

Input for DPI is typically a set of regular expressions describing a class of traffic, which makes the whole thing much complex. The issue is so serious that today’s software-based appliances deploying DPI do not scale above 10Gbps. The solution to this computation-intensive task arises from the parallelism provided by FPGA technology. FPGA is well-suitable for implementation of DPI engines that scale over 100Gbps throughputs. As a result, the implementation on an FPGA chip saves immense amount of CPU time and electric energy and allows to achieve DPI performance that is unreachable with today’s CPUs.