Abstract: Embodiments are described for automata models for use in deep packet inspection. Various embodiments are described for a new automata model, Overlay DFA (ODFA), which captures state replication in DFAs. Additional embodiments include combining the ODFA model with a D2FA model to provide an Overlay Delayed Input DFA (OD2FA). As the DFA model captures transition sharing, the OD2FA model captures both state replication and transition sharing. Algorithms are disclosed for efficiently constructing the OD2FA model and for implementing the OD2FA model in Ternary Content Addressable Memory (TCAM).

Abstract: A computer-implemented system is provided for implementing application protocol field extraction. The system includes: an automata generator configured to receive the extraction specification that specifies data elements to be extracted from data packets and generate a counting automaton; and a field extractor configured to receive a data flow and operates to extract data elements from the data packets in accordance with the counting automaton. The extraction specification is expressed in terms of a context-free grammar, where the grammar defines grammatical structures of data packets transmitted in accordance with an application protocol and includes counters used to chronicle parsing history of production rules comprising the grammar.

Abstract: A method is provided for implementing regular expression matching using ternary content-addressable memory devices. The method includes: receiving a set of regular expressions (REs) that specify data elements to be extracted from data packets; constructing a deterministic finite automaton (DFA) from the set of regular expressions; building a state transition table for each node of the deterministic finite automaton; combining the state transition tables into a single lookup table; and instantiating the lookup table in a ternary content-addressable memory device. Additional techniques are provided to reduce the TCAM space and improve RE matching speed.

Abstract: A method is provided for constructing a packet classifier for a computer network system. The method includes: representing a set of rules for packet classification as a directed graph; formulating a plurality of minimization problems from the directed graph, where subgraphs extending from non-terminal nodes in the directed graph represent a minimization problem (i.e., a one-dimensional packet classifier); solving the plurality of minimization problems; combining solutions for the plurality of minimization problems to yield a reduced set of rules which form a reduced packet classifier; and instantiating the reduced packet classifier in a content-addressable memory device.

Abstract: A method is provided for constructing a packet classifier for a computer network system. The method includes: receiving a set of rules for packet classification, where a rule sets forth values for fields in a data packet and a decision for data packets having matching field values; representing the set of rules as a directed graph; partitioning the graph into at least two partitions; generating at least one lookup table for each partition of the graph; and instantiating the lookup tables from one partition on a first content-addressable memory and the lookup tables from the other partition on a second content-addressable memory device.

Abstract: An improved technique is provided for compressing a packet classifier for a computer network system. A set of packet classification rules is first partitioned into one or more partitions. For each partition, columns of bits in each of the ternary strings of a given partition are reordered, the ternary strings within each partition are consolidated into one or more replacement strings and then the columns of bits of the replacement strings are rearranged back to the starting order. The rearranged replacement strings from each of the partitions are appended together to form a compressed packet classifier which may be instantiated in a content-addressable memory device.

Abstract: A computer-implemented system is provided for implementing application protocol field extraction. The system includes: an automata generator configured to receive the extraction specification that specifies data elements to be extracted from data packets and generate a counting automaton; and a field extractor configured to receive a data flow and operates to extract data elements from the data packets in accordance with the counting automaton. The extraction specification is expressed in terms of a context-free grammar, where the grammar defines grammatical structures of data packets transmitted in accordance with an application protocol and includes counters used to chronicle parsing history of production rules comprising the grammar.

Abstract: An improved technique is provided for compressing a packet classifier for a computer network system. A set of packet classification rules is first partitioned into one or more partitions. For each partition, columns of bits in each of the ternary strings of a given partition are reordered, the ternary strings within each partition are consolidated into one or more replacement strings and then the columns of bits of the replacement strings are rearranged back to the starting order. The rearranged replacement strings from each of the partitions are appended together to form a compressed packet classifier which may be instantiated in a content-addressable memory device.

Abstract: A method is provided for implementing regular expression matching using ternary content-addressable memory devices. The method includes: receiving a set of regular expressions (REs) that specify data elements to be extracted from data packets; constructing a deterministic finite automaton (DFA) from the set of regular expressions; building a state transition table for each node of the deterministic finite automaton; combining the state transition tables into a single lookup table; and instantiating the lookup table in a ternary content-addressable memory device. Additional techniques are provided to reduce the TCAM space and improve RE matching speed.

Abstract: A method is provided for constructing a packet classifier for a computer network system. The method includes: receiving a set of rules for packet classification, where a rule sets forth values for fields in a data packet and a decision for data packets having matching field values; representing the set of rules as a directed graph; partitioning the graph into at least two partitions; generating at least one lookup table for each partition of the graph; and instantiating the lookup tables from one partition on a first content-addressable memory and the lookup tables from the other partition on a second content-addressable memory device.

Abstract: A method is provided for constructing a packet classifier for a computer network system. The method includes: representing a set of rules for packet classification as a directed graph; formulating a plurality of minimization problems from the directed graph, where subgraphs extending from non-terminal nodes in the directed graph represent a minimization problem (i.e., a one-dimensional packet classifier); solving the plurality of minimization problems; combining solutions for the plurality of minimization problems to yield a reduced set of rules which form a reduced packet classifier; and instantiating the reduced packet classifier in a content-addressable memory device.