Deep packet inspection using cuckoo filter paper summary

---

Abstract

Less memory consumption , The false alarm rate is low , Higher insertion performance , Higher lookup throughput , Support delete operation

---

INTRODUCTION

• stay DPI Use in BF The main challenge is the need (k) Additional calculation of hash function
• Even though QF Use only one hash function , but QF The query nature of brings extra slowness .
• Member query data structure Cuckoo filter [11] Has been used as DPI Method , To overcome simultaneous use BF and QF The resulting restrictions

 Higher throughput and simpler to implement than using both Bloom and Quotient filters.
 More accurate because Cuckoo filter has less false positive rate than both Bloom and Quotient filters.
 Consuming less memory than using both Bloom and Quotient filters.
 Less memory accesses than using both BF and QF.
 Higher throughput and simpler to implement than using both Bloom and Quotient filters.
 More accurate because Cuckoo filter has less false positive rate than both Bloom and Quotient filters.
 Consuming less memory than using both Bloom and uotient filters.
 Less memory accesses than using both BF and QF.

---

REALATED WORKS

Consequently, in this paper a Cuckoo filter that support delete operation has been used and employed in a DPI approach to get better results than employing both BF and QF.

---

CUCKOO FILTER

See this article for details : QCF for deep packet inspection A summary of the paper

Insertion process

Lookup process

Deletion process

Mapping signatures into CF

Architecture of the proposed approach

1. Map all predefined signatures to CF
2. Take the incoming packet as input , Specify the size of the search window .
3. Traverse the bytes of all packets , The algorithm queries CF To check all bytes , To find interested (iinteresting) Any appearance of the string
4. There is any match , The algorithm will take appropriate actions and stop searching immediately , Wait for the next packet , And so on
5. otherwise , If the end of the packet has been reached , But not with CF matching , Then the packet will be forwarded to its original destination .

Proposed DPI approach

EVALUATION

Insertion throughput

False positive rate

Query throughput

Memory accesses

DPI time improvement

Deletion throughput

CONCLUSION

• Support frequent signature set updates
• Consume less memory
• Greater insertion throughput
• Higher discovery performance
• Support deletion and lower false positive rate