Using string matching for deep packet inspection

Abstract

String matching has recently proven useful for deep packet inspection (DPI) to detect intrusions, scan for viruses, and filter Internet content. However, the algorithm must still overcome some hurdles, including becoming efficient at multigigabit processing speeds and scaling to handle large volumes of signatures. Before 2001, researchers in packet processing were most interested in longest-prefix matching in the routing table on Internet routers and multifield packet classification in the packet header for firewalls and quality-of- service applications. However, DPI for various signatures is now of greater interest.