Inspection context caching for deep packet inspection
View Patent ↗A method, system, and computer-usable medium are disclosed for performing deep packet inspection of network traffic, comprising: receiving a unit of one or more network packets, calculating a calculated fingerprint for data within the unit, determining a current inspection context, determining whether the calculated fingerprint and the current inspection context matches an entry stored in a cache, wherein the entry includes a stored fingerprint and a cached inspection context, and performing operations associated with deep packet inspection of the unit based on whether the calculated fingerprint and the current inspection context match the entry.
1. A computer-implemented method for performing inspection of network traffic, comprising:
receiving a unit of one or more network packets;
calculating a calculated fingerprint for data within the unit;
determining a current inspection context, wherein the current inspection context is indicative of a state of an algorithm for performing deep packet inspection;
determining whether the calculated fingerprint and the current inspection context matches an entry stored in a cache, wherein the entry includes a stored fingerprint and a cached inspection context; and
performing operations associated with deep packet inspection of the unit based on whether the calculated fingerprint and the current inspection context match the entry.
2. The method of claim 1 , wherein performing operations associated with deep packet inspection of the unit comprises, responsive to determining that the calculated fingerprint and the current inspection context match the entry stored in the cache:
reading from the cache an inspection result associated with the stored fingerprint, the inspection result resulting from a deep packet inspection of a previous unit of one or more network packets from which the stored fingerprint was generated; and
handling the unit in accordance with the inspection result.
3. The method of claim 1 , wherein performing operations associated with deep packet inspection of the unit comprises, responsive to determining that the calculated fingerprint and the current inspection context fails to match any entry stored in the cache, deleting entries of the cache following entries associated with one or more previous data blocks to the unit.
4. The method of claim 1 , wherein performing operations associated with deep packet inspection of the unit comprises, responsive to determining that the calculated fingerprint and the current inspection context fails to match any entry stored in the cache:
performing deep packet inspection of data of the unit;
handling the unit in accordance with an inspection result; and
storing in the cache fingerprints of data and an inspection context associated with the unit along with the inspection result.
5. The method of claim 1 , wherein calculating the calculated fingerprint comprises calculating a hash checksum of the data within the unit.
6. A system comprising:
a processor; and
a non-transitory, computer-readable storage medium embodying computer program code comprising instructions executable by the processor and configured for:
receiving a unit of one or more network packets;
calculating a calculated fingerprint for data within the unit;
determining a current inspection context, wherein the current inspection context is indicative of a state of an algorithm for performing deep packet inspection;
determining whether the calculated fingerprint and the current inspection context matches an entry stored in a cache, wherein the entry includes a stored fingerprint and a cached inspection context; and
performing operations associated with deep packet inspection of the unit based on whether the calculated fingerprint and the current inspection context match the entry.
7. The system of claim 6 , wherein performing operations associated with deep packet inspection of the unit comprises, responsive to determining that the calculated fingerprint and the current inspection context match the entry stored in the cache:
reading from the cache an inspection result associated with the stored fingerprint, the inspection result resulting from a deep packet inspection of a previous unit of one or more network packets from which the stored fingerprint was generated; and
handling the unit in accordance with the inspection result.
8. The system of claim 6 , wherein performing operations associated with deep packet inspection of the unit comprises, responsive to determining that the calculated fingerprint and the current inspection context fails to match any entry stored in the cache, deleting entries of the cache following entries associated with one or more previous data blocks to the unit.
9. The system of claim 6 , wherein performing operations associated with deep packet inspection of the unit comprises, responsive to determining that the calculated fingerprint and the current inspection context fails to match any entry stored in the cache:
performing deep packet inspection of data of the unit;
handling the unit in accordance with an inspection result; and
storing in the cache fingerprints of data and an inspection context associated with the unit along with the inspection result.
10. The system of claim 6 , wherein calculating the calculated fingerprint comprises calculating a hash checksum of the data within the unit.
11. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
receiving a unit of one or more network packets;
calculating a calculated fingerprint for data within the unit;
determining a current inspection context, wherein the current inspection context is indicative of a state of an algorithm for performing deep packet inspection;
determining whether the calculated fingerprint and the current inspection context matches an entry stored in a cache, wherein the entry includes a stored fingerprint and a cached inspection context; and
performing operations associated with deep packet inspection of the unit based on whether the calculated fingerprint and the current inspection context match the entry.
12. The non-transitory, computer-readable storage medium of claim 11 , wherein performing operations associated with deep packet inspection of the unit comprises, responsive to determining that the calculated fingerprint and the current inspection context match the entry stored in the cache:
reading from the cache an inspection result associated with the stored fingerprint, the inspection result resulting from a deep packet inspection of a previous unit of one or more network packets from which the stored fingerprint was generated; and
handling the unit in accordance with the inspection result.
13. The non-transitory, computer-readable storage medium of claim 11 , wherein performing operations associated with deep packet inspection of the unit comprises, responsive to determining that the calculated fingerprint and the current inspection context fails to match any entry stored in the cache, deleting entries of the cache following entries associated with one or more previous data blocks to the unit.
14. The non-transitory, computer-readable storage medium of claim 11 , wherein performing operations associated with deep packet inspection of the unit comprises, responsive to determining that the calculated fingerprint and the current inspection context fails to match any entry stored in the cache:
performing deep packet inspection of data of the unit;
handling the unit in accordance with an inspection result; and
storing in the cache fingerprints of data and an inspection context associated with the unit along with the inspection result.
15. The non-transitory, computer-readable storage medium of claim 11 , wherein calculating the calculated fingerprint comprises calculating a hash checksum of the data within the unit.