Systems, apparatus and methods for the implementation of high-speed network analyzers are provided. A set of high-level specifications is used to define the behavior of the network analyzer emitted by a compiler. An optimized inline workflow to process regular expressions is presented without sacrificing the semantic capabilities of the processing engine. An optimized packet dispatcher implements a subset of the functions implemented by the network analyzer, providing a fast and slow path workflow used to accelerate specific processing units. Such dispatcher facility can also be used as a cache of policies, wherein if a policy is found, then packet manipulations associated with the policy can be quickly performed. An optimized method of generating DFA specifications for network signatures is also presented. The method accepts several optimization criteria, such as min-max allocations or optimal allocations based on the probability of occurrence of each signature input bit.
Ezick, James, et al. "System, apparatus and methods to implement high-speed network analyzers." US 9,185,020, United States Patent and Trademark Office, Nov. 2015.
Ezick, James, Lethin, Richard, Ros-Giralt, Jordi, et al., "System, apparatus and methods to implement high-speed network analyzers," US 9,185,020, issued November 9, 2015.
@misc{osti_1225520,
author = {Ezick, James and Lethin, Richard and Ros-Giralt, Jordi and Szilagyi, Peter and Wohlford, David E.},
title = {System, apparatus and methods to implement high-speed network analyzers},
annote = {Systems, apparatus and methods for the implementation of high-speed network analyzers are provided. A set of high-level specifications is used to define the behavior of the network analyzer emitted by a compiler. An optimized inline workflow to process regular expressions is presented without sacrificing the semantic capabilities of the processing engine. An optimized packet dispatcher implements a subset of the functions implemented by the network analyzer, providing a fast and slow path workflow used to accelerate specific processing units. Such dispatcher facility can also be used as a cache of policies, wherein if a policy is found, then packet manipulations associated with the policy can be quickly performed. An optimized method of generating DFA specifications for network signatures is also presented. The method accepts several optimization criteria, such as min-max allocations or optimal allocations based on the probability of occurrence of each signature input bit.},
url = {https://www.osti.gov/biblio/1225520},
place = {United States},
year = {2015},
month = {11},
note = {US Patent
Proceedings of the 2006 international conference on Compilers, architecture and synthesis for embedded systems - CASES '06https://doi.org/10.1145/1176760.1176771
Proceedings of the international conference on Compilers, architectures and synthesis for embedded systems - CASES '03https://doi.org/10.1145/951710.951749