Method and computing device for packet classification

1. A method for packet classification comprising the steps of:

analyzing packet classification rules to obtain a plurality of categories of rules;

building a plurality of decision trees, one for each category of rules;

adding pre-processing information in a header of each leaf of the plurality of decision trees for use in relation with at least one field of a header of a packet, for selecting at least one rule for classification of the packet, said pre-processing information comprising a plurality of sub-rules, disjointed two by two, for matching against a selected field of the header of the packet, each sub-rule comprising a rule constraint on a single field of the rule; and

applying the sub-rules for matching a plurality of selected fields of the header of the packet before making a full match of the header of the packet against at least one complete rule selected for classification of the packet;

wherein the at least one complete rule is selected according to at least one positive match between at least one sub-rule, corresponding to the complete rule, and at least one selected field of the header of the packet.

2. The method of claim 1 wherein the step of analysing comprises iteratively analysing the packet classification rules using a variable factor, to obtain the plurality of categories of rules.

3. The method of claim 2 , wherein the step of iteratively analysing comprises partitioning a rule-set into subsets which each contain fewer rules than a given threshold.

4. The method of claim 3 , wherein the partitioning is done by applying a cutting heuristic.

5. The method of claim 4 , wherein the rules with a similar size pattern are grouped in a subset and wherein the subset is associated with a dedicated decision tree.

6. The method of claim 5 , wherein the variable factor is a ratio of a range covered by a rule over a range covered by a field.

7. The method of claim 6 , wherein the ratio is varied at each iteration until a smaller number of subsets is obtained.

8. The method of claim 1 further comprising the steps of:

receiving a packet for classification;

for each tree, starting at a root of the tree, until a leaf node is reached, iteratively:

comparing the header of the packet to a rule space covered by the node; and

identifying a next node for use in the step of comparing;

comparing the pre-processing information comprised in the header of the leaf node to the at least one field of the header of the packet; and

selecting at least one rule for standard rule matching with the header of the packet, according to at least one positive match between at least one sub-rule and at least one selected field of the header of the packet, for classification of the packet.

9. A computing device for packet classification comprising a processor and memory, said memory containing instructions executable by said processor whereby said computing device is operative to:

analyze packet classification rules to obtain a plurality of categories of rules;

build a plurality of decision trees, one for each category of rules;

add pre-processing information in a header of each leaf of the plurality of decision trees for use in relation with at least one field of a header of a packet, to select at least one rule for classification of the packet, said pre-processing information comprising a plurality of sub-rules, disjointed two by two, for matching against a selected field of the header of the packet, each sub-rule comprising a rule constraint on a single field of the rule; and

apply the sub-rules for matching a plurality of selected fields of the header of the packet before making a full match of the header of the packet against at least one complete rule selected for classification of the packet;

wherein the at least one complete rule is selected according to at least one positive match between at least one sub-rule, corresponding to the complete rule, and at least one selected field of the header of the packet.

10. The computing device of claim 9 wherein the step of analysing comprises iteratively analysing the packet classification rules using a variable factor, to obtain the plurality of categories of rules.

11. The computing device of claim 10 , wherein the step of iteratively analysing comprises partitioning a rule-set into subsets which each contain fewer rules than a given threshold.

12. The computing device of claim 11 , wherein the partitioning is done by applying a cutting heuristic.

13. The computing device of claim 12 , wherein the rules with a similar size pattern are grouped in a subset and wherein the subset is associated with a dedicated decision tree.

14. The computing device of claim 13 , wherein the variable factor is a ratio of a range covered by a rule over a range covered by a field.

15. The computing device of claim 14 , wherein the ratio is varied at each iteration until a smaller number of subsets is obtained.

16. The computing device of claim 9 , wherein the memory contains further instructions executable by said processor and whereby said computing device is further operative to:

receive a packet for classification;

for each tree, starting at a root of the tree, until a leaf node is reached, iteratively:

compare the header of the packet to a rule space covered by the node; and

identify a next node for use in the step of comparing;

compare the pre-processing information comprised in the header of the leaf node to the at least one field of the header of the packet; and

select at least one rule for standard rule matching with the header of the packet, and at least one selected field of the header of the packet, for classification of the packet.