Abstract: The traditional methods for hardware/softwarebased Deep Packet Inspection (DPI) have intrinsic limitations in practical implementation. To address the shortcomings, this paper presented a DPI algorithm implemented on the multicore platform based on the parallel Bloom filters. Firstly, the algorithm grouped the rule sets according to their lengths and constructed a set of counting Bloom filters to represent the grouped rule sets. Each Bloom filter stood for a rule set with a specific length. Secondly, efficient hash functions were introduced to reduce the collision probability and the computing complexity. Lastly, the algorithm was implemented using the parallel programming method based on the parallel processing ability of the multicore platform. The theoretic analysis and experimental results show that the proposed algorithm is time and space efficient.

Key words: deep packet inspection, rule set, multicore platform, Counting Bloom Filter (CBF), parallel Bloom filters

摘要： 针对基于软件、硬件的深度数据包检测存在处理速度慢或规则集更新困难等方面的局限性，提出一种在多核平台上基于并行Bloom过滤器组的深度数据包检测算法。算法中首先将规则集按规则的长度分组，构造一个并行Bloom过滤器组，组中每个计数式 Bloom过滤器表示特定规则长度的规则集。为了减少执行过程中的冲突概率和计算量，构造了高性能的哈希函数，然后基于多核平台的并行处理能力使用并行编程实现了该算法。理论分析和实验结果表明该算法是一种时空高效的算法。

关键词: 深度数据包检测, 规则集, 多核平台, 计数式Bloom过滤器, 并行Bloom过滤器组