Leveraging Traffic Repetitions for High-Speed Deep Packet Inspection

Abstract — Deep Packet Inspection (DPI) plays a major role in contemporary networks, and specifically, in datacenters of content providers, scanned data may be highly repetitive. Most DPI engines are based on identifying signatures in packet payload. This pattern matching process is expensive both in memory and CPU resources, and therefore, often becomes the bottleneck of the entire application. This paper shows how DPI can be accelerated by leveraging repetitions in the inspected traffic. We first show that such repetitions exist in many traffic types and present a mechanism that allows skipping repeated data instead of scanning it again. In its slow path, frequently repeated strings are identified and stored in a dictionary along with some succinct information for accelerating the DPI process. In the mechanism’s data path, each time the scanning algorithm encounters a string from the dictionary, it skips it and recovers to the correct state had this word been scanned byte by byte. Our solution achieves significant performance boost, especially when data is of the same content source (e.g. same website). Our experiments show that for such cases, our solution achieves throughput gain of 1.25−2.5 times the original throughput, when implemented in software