面向深度分组检测的高速数据分组解析结构

doi:10.3969/j.issn.1000-436X.2013.06.019

通信学报 ›› 2013, Vol. 34 ›› Issue (6): 156-164.doi: 10.3969/j.issn.1000-436X.2013.06.019

面向深度分组检测的高速数据分组解析结构

董永吉¹,郭云飞^1,²,黄万伟¹,黄慧群¹

¹ 国家数字交换系统工程技术研究中心，河南郑州 450002
² 解放军理工大学指挥信息学院，江苏南京 210007

出版日期:2013-06-25 发布日期:2017-07-20
基金资助:
国家重点基础研究发展计划（“973”计划）基金资助项目;国家高技术研究发展计划（“863”计划）基金资助项目;国家科技支撑计划基金资助项目

Deep packet inspection oriented high speed packet parsing architecture

Yong-ji DONG¹,Yun-fei GUO^1,²,Wan-wei HUANG¹,Hui-qun HUANG¹

¹ National Digital Switching System Engineering Technological R＆D Center, Zhengzhou 450002, China
² College of Command Information Systems, the PLA University of Science ＆ Technology, Nanjing 210007, China

Online:2013-06-25 Published:2017-07-20
Supported by:
The National Basic Research Program of China(973 Program);The National High Technology R＆D Program of China(863 Program);The National Key Technology R＆D Program of China

摘要/Abstract

摘要：

提出了一种面向深度分组检测的高速数据分组解析结构BiPPCS（bidirectional packet parsing architecture for content security）。结构采用内容萃取树描述协议的耦合关系从而提高了数据分组解析的灵活性；利用硬件双向并行流水线提升了数据分组解析的处理速率；通过使用节点映射算法来均衡各级流水线上的节点数目优化存储空间；分析和仿真显示BiPPCS在处理速率、空间利用率等方面能取得较好的均衡。

关键词: 数据分组解析, 深度分组检测, 二叉trie树, 网络安全, 可重构, NetFPGA

Abstract:

A deep packet inspection oriented high speed packet parsing architecture called BiPPCS (bidirectional packet parsing architecture for content security) was proposed. Firstly, the content extraction tree was used to describe the cou-pling of the protocol relationship to improve flexibility of the packet parsing. Secondly, hardware bi-directional parallel pipeline was used to enhance the processing rate of the packet parsing. Thirdly, a node mapping algorithm was used to balance the number of nodes on all pipeline stages to optimize the storage space. Analysis and simulation show that BiPPCS gets balance among the rate processing, resource consumption and other aspects.

Key words: packet parsing, deep packet inspection, binary trie; network security, reconfiguration, NetFPGA

董永吉,郭云飞,黄万伟,黄慧群. 面向深度分组检测的高速数据分组解析结构[J]. 通信学报, 2013, 34(6): 156-164.

Yong-ji DONG,Yun-fei GUO,Wan-wei HUANG,Hui-qun HUANG. Deep packet inspection oriented high speed packet parsing architecture[J]. Journal on Communications, 2013, 34(6): 156-164.

图/表 11

图1

图2

图3

图4

图5

图6

图7

图8

图9

表1

表2

参考文献 14

[1]	朱映映, 吴锦锋, 明仲 . 基于网络事件和深度协议分析的入侵检测研究[J]. 通信学报 2011,(8):171-178. ZHU Y Y , WU J F , MING Z . Research on intrusion detection based on network events and deep protocol analysis[J]. Journal on Communications, 2011,(8):171-178.
[2]	LIAO M Y , LUO M Y , YANG C S , et al. Design and evaluation of deep packet inspection system: a case study[J]. IET Networks, 2012,1(1): 2-9.
[1]	朱国胜, 余少华 . 基于TCAM的范围匹配方法——C-TCAM[J]. 通信学报 2012,33(1):31-37. ZHU G S , YU S H . Range matching method based on TCAM:C-TCAM[J]. Journal on Communications, 2012,33(1):31-37.
[4]	PENG K , TANG S , DONG Q , et al. Chain-based DFA deflation for fast and scalable regular expression matching using TCAM[A]. Proceedings of the ACM/IEEE Symposium on Architectures for Networking and Communications Systems. Brooklyn[C]. NY, USA, 2011. 24-35.
[7]	BHATNAGAR H , . 高级ASIC芯片综合[M]. 北京: 清华大学出版社, 2007. BHATNAGAR H . Advanced ASIC Chip Synthesis[M]. Beijing: Tsinghua Universit Press, 2007.
[6]	AHMADI M , WONG S . Network processors: challenges and trends[A]. Proceedings of the 17th Annual Workshop on Circuits, Systems and Signal Processing[C]. The Netherlands, 2006. 223-232.
[7]	Xilinx corporaton[EB/OL]. 2012.
[8]	ANWER M B , MOTIWALA M , TARIQ M B , et al. Switchblade: a platform for rapid deployment of network protocols on programmable hardware[A]. Proceedings of the ACM SIGCOMM Conference[C]. New Delhi, India, 2010. 183-194.
[9]	BANDO M , SERTAC ARTAN N , CHAO H J . Scalable lookahead regular expression detection system for deep packet inspection[J]. IEEE/ACM Transactions on Networking, 2012.
[10]	KOBIERSKY P , KORENEK J , POLCAK L . Packet header analysis and field extraction for multigigabit networks[A]. Proceedings of the IEEE Symposium on Design and Diagnostics of Electronic Circuits and Systems[C]. Liberec, Czech Republic, 2009. 96-101.
[11]	KOZANITIS C , HUBER J , SINGH S . Leaping multiple headers a single bound: wire-speed parsing using the Kangaroo system[A]. Proceedings of the 29th IEEE Conference on Computer Communications[C]. San Diego, CA, USA, 2010. 830-838.
[12]	ATTIG M , GORDON B . 400Gb/s programmable packet parsing on a single FPGA[A]. Proceedings of the ACM/IEEE Symposium on Architectures for Networking and Communications Systems[C]. Brooklyn, NY, USA, 2011. 12-23.
[13]	KORCEK P , KOSAR V , ZADNIK M , et al. Hacking NetCOPE to run on NetFPGA-10G[A]. Proceedings of the ACM/IEEE Symposium on Architectures for Networking and Communications Systems[C]. Brooklyn, NY, USA, 2011. 217-218.
[14]	BASU A , NARLIKAR G . Fast incremental updates for pipelined forwarding engines[A]. Proceedings of IEEE INFOCOM Conference[C]. San Francisco, CA, USA, 2003. 64-74.

流水线深度	逻辑资源(slice)	BRAM/36 kbit	时钟频率/ns	吞吐量/(Gbit·s^?1)
6	10.4%	12	4.778 9	214
10	12.5%	20	4.914 6	208
14	14%	28	4.971 4	206

结构	逻辑资源(slice)	BRAM/36 kbit	吞吐量/(Gbit·s^?1)	接口独立的协议解析能力
BiPPCS	10.4%	3%	214	是
PP	44%	—	343	否
Kangaroo	6.4%	15%	10	否

[1]	赵仕祺, 黄小红, 钟志港. 基于信誉的域间路由选择机制的研究与实现[J]. 通信学报, 2023, 44(6): 47-56.
[2]	谢人超, 文雯, 唐琴琴, 刘云龙, 谢高畅, 黄韬. 轨道交通移动边缘计算网络安全综述[J]. 通信学报, 2023, 44(4): 201-215.
[3]	徐明, 张保俊, 伍益明, 应晨铎, 郑宁. 面向网络攻击和隐私保护的多智能体系统分布式共识算法[J]. 通信学报, 2023, 44(3): 117-127.
[4]	康海燕, 龙墨澜. 基于吸收马尔可夫链攻击图的网络攻击分析方法研究[J]. 通信学报, 2023, 44(2): 122-135.
[5]	曾嵘, 杭潇. 车联网环境下可重构智能反射面辅助无线信道估计算法[J]. 通信学报, 2022, 43(8): 142-150.
[6]	郭海燕, 杨震, 邹玉龙, 吕斌, 冯蕴天, 赵玉娟. 基于主被动波束成形联合优化的双RIS辅助抗干扰通信方法[J]. 通信学报, 2022, 43(7): 21-30.
[7]	郭渊博, 李勇飞, 陈庆礼, 方晨, 胡阳阳. 融合Focal Loss的网络威胁情报实体抽取[J]. 通信学报, 2022, 43(7): 85-92.
[8]	李斌, 周清雷, 陈晓杰, 冯峰. 可重构的素域SM2算法优化方法[J]. 通信学报, 2022, 43(3): 30-41.
[9]	周嵩林, 唐隽文, 刘罗颢, 吴优, 刘长昊, 金一飞, 杨帆, 许慎恒, 李懋坤. 基于电磁表面的阵列天线及应用概述[J]. 通信学报, 2022, 43(12): 13-23.
[10]	唐奎, 胡琪, 赵俊明, 陈克, 冯一军. 基于RIS的室内无线通信信号增强系统[J]. 通信学报, 2022, 43(12): 24-31.
[11]	刘海霞, 易浩, 马向进, 乐舒瑶, 孔旭东, 马培, 曾宇鑫, 李龙. 基于无源可重构智能超表面的室内无线信号覆盖增强[J]. 通信学报, 2022, 43(12): 32-44.
[12]	神显豪, 曾紫玲, 牛少华. 面向异构网络的可重构智能表面辅助资源优化方法[J]. 通信学报, 2022, 43(11): 171-182.
[13]	黎赛, 杨亮, 崔琪楣, 于思源. RIS辅助的混合RF/THz系统性能分析[J]. 通信学报, 2022, 43(1): 49-58.
[14]	张红斌, 尹彦, 赵冬梅, 刘滨. 基于威胁情报的网络安全态势感知模型[J]. 通信学报, 2021, 42(6): 182-194.
[15]	张腾飞, 余顺争. 移动设备加密流量的用户信息探测研究展望[J]. 通信学报, 2021, 42(2): 154-167.

面向深度分组检测的高速数据分组解析结构

Deep packet inspection oriented high speed packet parsing architecture

在线阅读

PDF下载

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 11

参考文献 14

相关文章 15

Metrics

推荐阅读 0