USING LEARNED FLOW REPUTATION AS A HEURISTIC TO CONTROL DEEP PACKET INSPECTION UNDER LOAD

摘要

A network appliance can adjust the amount of deep packet inspection performed by the network appliance as a function of load. In one example, the network appliance can be configured to utilize load (e.g., of its internal processors) and reputation of data flows to determine when selected trusted flows can bypass inspection performed using deep packet analysis. Reputation of data flows can be determined based on historical information regarding a particular flow in combination with a reputation service determining reputation scores based on properties of the data flow (e.g., source, type of data in flow, destination, Internet Protocol domains, etc.). In general, when the network appliance is under heavy load, the more trusted flows are allowed to pass through without in depth inspection.