An improved method in deep packet inspection based on regular expression

摘要

The continuous development of Internet technology makes the network intrusion detection technology get more and more attention. Deep packet inspection technology as an effective network intrusion detection technology can play a huge role in network security. Deep packet inspection technology is a kind of network intrusion detection technology applied to the application layer in detail, rather than only detecting the port information of the packet. The regular expression matching technology is a key technology in deep packet inspection because of the rich semantics and flexibility of regular expressions. However, a huge number of transfer edges exist when the matching algorithm is being applied, which will lead to an increase in memory usage of the algorithm. In this paper, we propose an improved method of concatenating transfer edges. By using character interval, several consecutive characters are represented by character intervals, which can reduce the number of transfer edges effectively. In addition, a comparison experiment is given to compare the two methods which are before and after the improvement. It shows that the number of transfer edges can be reduced to 10% of that before improvement and the efficiency of deep packet inspection is improved.