Hish speed deep packet inspection method with low power dissipation - ZHU Guo-sheng1; YU Shao-hua1 (Tongxin xuebao)
Hish speed deep packet inspection using TCAM faces the problem of high power dissipation.A 2-phase DPI method BF-TCAM was proposed.The first phase used parallel Bloom filters to exclude the normal packets not including attack signatures.The second phase used TCAM to inspect suspicious packets including real attack packets and false positive packets of the first phase.The Bloom filters’ false negative probability is zero and false positive probability is very low.Since most of the network data traffic does not include attack signatures,the method can get high speed deep packet inspection with low power dissipation.