Visible to the public Deep packet inspection using Cuckoo filter

TitleDeep packet inspection using Cuckoo filter
Publication TypeConference Paper
Year of Publication2017
AuthorsAl-hisnawi, M., Ahmadi, M.
Conference Name2017 Annual Conference on New Trends in Information Communications Technology Applications (NTICT)
ISBN Number978-1-5386-2962-8
KeywordsBloom filter, Cuckoo filter, data structures, deep packet inspection, filtering algorithms, Fingerprint recognition, high performance DPI approaches, Information filters, Inspection, Internet, Internet service providers, k hash functions, matched filters, matching check tool, membership query data structures, pubcrawl, Quotient Filter, resilience, Resiliency, Scalability, signature fingerprint, telecommunication traffic, Traffic classification, Traffic identification

Nowadays, Internet Service Providers (ISPs) have been depending on Deep Packet Inspection (DPI) approaches, which are the most precise techniques for traffic identification and classification. However, constructing high performance DPI approaches imposes a vigilant and an in-depth computing system design because the demands for the memory and processing power. Membership query data structures, specifically Bloom filter (BF), have been employed as a matching check tool in DPI approaches. It has been utilized to store signatures fingerprint in order to examine the presence of these signatures in the incoming network flow. The main issue that arise when employing Bloom filter in DPI approaches is the need to use k hash functions which, in turn, imposes more calculations overhead that degrade the performance. Consequently, in this paper, a new design and implementation for a DPI approach have been proposed. This DPI utilizes a membership query data structure called Cuckoo filter (CF) as a matching check tool. CF has many advantages over BF like: less memory consumption, less false positive rate, higher insert performance, higher lookup throughput, support delete operation. The achieved experiments show that the proposed approach offers better performance results than others that utilize Bloom filter.

Citation Keyal-hisnawi_deep_2017