Deep Packet Inspection to Next Generation Network Devices

Projektinformationen

DPI

ID Finanzhilfevereinbarung: 259085

Abgeschlossenes Projekt

Startdatum 1 November 2010

Enddatum 31 Oktober 2016

Finanziert unter

• Specific programme: "Ideas" implementing the Seventh Framework Programme of the European Community for research, technological development and demonstration activities (2007 to 2013)

Gesamtkosten € 990 400,00

EU-Beitrag € 990 400,00

Koordiniert durch

REICHMAN UNIVERSITY
Israel

Ziel

Deep packet inspection (DPI) lies at the core of contemporary Network Intrusion Detection/Prevention Systems and Web Application Firewall. DPI aims to identify various malware (including spam and viruses), by inspecting both the header and the payload of each packet and comparing it to a known set of patterns. DPI are often performed on the critical path of the packet processing, thus the overall performance of the security tools is dominated by the speed of DPI.

Traditionally, DPI considered only exact string patterns. However, in modern network devices patterns are often represented by regular expressions due to their superior expressiveness. Matching both exact string and regular expressions are well-studied area in Computer Science; however all well-known solutions are not sufficient for current network demands: First, current solutions do not scale in terms of speed, memory and power requirements. While current network devices work at 10-100 Gbps and have thousands of patterns, traditional solutions suffer from exponential memory size or exponential time and induce prohibitive power consumption. Second, non clear-text traffic, such as compressed traffic, becomes a dominant portion of the Internet and is clearly harder to inspect.

In this research we design new algorithms and schemes that cope with today demand. This is evolving area both in the Academia and Industry, where currently there is no adequate solution.

We intend to use recent advances in hardware to cope with these demanding requirements. More specifically, we plan to use Ternary Content-Addressable Memories (TCAMs), which become standard commodity in contemporary network devices. TCAMs can compare a key against all rules in a memory in parallel and thus provide high throughput. We believ

Wissenschaftliches Gebiet

• natural sciences › computer and information sciences › internet
• natural sciences › computer and information sciences › computer security › malicious software
• natural sciences › computer and information sciences › computer security › network security

Programm/Programme

• FP7-IDEAS-ERC - Specific programme: "Ideas" implementing the Seventh Framework Programme of the European Community for research, technological development and demonstration activities (2007 to 2013)

Thema/Themen

• ERC-SG-PE7 - ERC Starting Grant - Systems and communication engineering

Aufforderung zur Vorschlagseinreichung

ERC-2010-StG_20091028
Andere Projekte für diesen Aufruf anzeigen

Finanzierungsplan

ERC-SG - ERC Starting Grant

Gastgebende Einrichtung

REICHMAN UNIVERSITY

Kontakt Verwaltung

Eric Zimmerman (Dr.)

Hauptforscher

Anat Bremler-Barr (Prof.)

• EU-Beitrag: € 840 400,40
• Adresse: 8 HAUNIVERSITA ST ; 4610101 Herzliya ; Israel
• Aktivitätstyp: Higher or Secondary Education Establishments
• Gesamtkosten: Keine Daten

Begünstigte (2)

REICHMAN UNIVERSITY

Israel

Kontakt Verwaltung

Eric Zimmerman (Dr.)

Hauptforscher

Anat Bremler-Barr (Prof.)

• EU-Beitrag: € 840 400,40
• Adresse: 8 HAUNIVERSITA ST ; 4610101 Herzliya
• Aktivitätstyp: Higher or Secondary Education Establishments
• Gesamtkosten: Keine Daten

THE HEBREW UNIVERSITY OF JERUSALEM

Israel

Kontakt Verwaltung

Jane Turner (Ms.)

• EU-Beitrag: € 149 999,60
• Adresse: EDMOND J SAFRA CAMPUS GIVAT RAM ; 91904 Jerusalem
• Aktivitätstyp: Higher or Secondary Education Establishments
• Gesamtkosten: Keine Daten