Fast pattern matching in compressed data packages
Michael Berger, Brian Bach Mortensen · 2010
This paper targets deep packet classification (Layer 4-7) for applications within Firewalls and Intrusion Detection/prevention systems (IDS/IPS). Specifically targeting string matching applications, this paper will focus on processing of web-content, HTTP, at high speed (>;10 Gigabit). The main contribution of this work is in the field of combined payload search and HTTP decompression. In general, decompression is difficult to perform at wire-speed due to the additional data-amounts generated, which means that a decompressed 10 Gbit/s link could contain e.g. 30-40 Gigabit data. This paper presents a method which makes it is possible to find a match in the data packages of the data stream without the need for searching in the decompressed data stream, thereby avoiding the possibility of "data explosions".