Pre-flow grouping of packets for optimized deep packet inspection

1. A computer-implemented method, comprising:

receiving a plurality packets;

dividing the packets into a plurality of batches based on a first specified batch size;

performing a stateless processing operation on a batch in the plurality of batches, comprising:

creating a flow-hash lookup key for each packet in the batch; and

generating a first output indicating flow-hash lookup keys for the packets in the batch;

performing a stateful processing operation on the batch, comprising:

dividing the batch into a plurality of sub-batches based on a second specified batch size smaller than the first specified batch size;

accessing the first output of the stateless processing operation using the flow-hash lookup keys; and

generating a second output indicating the sub-batches, wherein packets within each sub-batch are grouped based on respective flows of the packets; and

performing a deep packet inspection (DPI) processing operation on a per-flow basis based on individual groups in the sub-batches indicated in the second output.

2. The computer-implemented method of claim 1 , wherein the DPI processing operation comprises updating flow statistics for the individual groups.

3. The computer-implemented method of claim 1 , wherein the DPI processing operation comprises performing transport layer state tracking for the individual groups.

4. The computer-implemented method of claim 1 , wherein the DPI processing operation includes performing application layer processing for the individual groups.

5. The computer-implemented method of claim 1 , wherein the stateless processing operation comprises:

decoding a packet in the batch to obtain a tuple including a protocol, a source IP address, a source port, a destination IP address, and a destination port for the packet; and

creating the flow-hash lookup key for the packet based on the tuple.

6. The computer-implemented method of claim 1 , wherein the stateless processing operation includes performing a timer management bookkeeping operation on the batch, wherein the timer management bookkeeping operation comprises:

determining a current time of the batch; and

expiring flow data associated with the flow-hash lookup keys of the batch if the current time is after a bookkeeping time threshold.

7. The computer-implemented method of claim 6 , wherein the first output comprises a data structure that indicates the current time of the batch and the data for each packet in the patch.

8. The computer-implemented method of claim 1 , wherein the stateful processing operation comprises:

accessing a hash table using the flow-hash lookup keys, wherein the accessing is performed on the hash table in parallel using a multi-threaded lookup operation.

9. The computer-implemented method of claim 8 , wherein the multi-threaded lookup operation implements a cuckoo-based hashing algorithm.

10. The computer-implemented method of claim 8 , wherein the multi-threaded lookup operation inserts a new record in the hash table if a particular flow-hash lookup key is not found in the hash table.

11. The computer-implemented method of claim 8 , wherein the multi-threaded lookup operation deletes an existing record from the hash table if the hash table has insufficient space for an insertion.

12. A system comprising:

one or more computer devices that implement a deep packet inspection (DPI) server, configured to:

receive a plurality packets;

divide the packets into a plurality of batches based on a first specified batch size;

perform a stateless processing operation on a batch in the plurality of batches, including to:

create a flow-hash lookup key for each packet in the batch; and

generate a first output indicating flow-hash lookup keys for the packets in the batch;

perform a stateful processing operation on the batch, including to:

divide the batch into a plurality of sub-batches batches based on a second specified batch size smaller than the first specified batch size;

access the first output of the stateless processing operation using the flow-hash lookup keys; and

generate a second output indicating the sub-batches, wherein packets within each sub-batch are grouped based on respective flows of the packets; and

perform a deep packet inspection (DPI) processing operation on a per-flow basis based on individual groups in the sub-batches indicated in the second output.

13. The system of claim 12 , wherein the DPI server implements a switched port analyzer that monitors network traffic associated with a port and selects batches of packets for DPI analysis.

14. The system of claim 12 , wherein the DPI server is implemented as part of a port scanning system that scans for open ports on a network.

15. The system of claim 12 , wherein the DPI server implements one or more anomaly detection algorithms based on the received packets.

16. The system of claim 12 , wherein the DPI server is implemented in a cloud computing environment.

17. The system of claim 12 , wherein the DPI processing operation updates flow statistics for the individual groups.

18. The system of claim 12 , wherein the stateless processing operation includes a timer management bookkeeping operation to:

determine a current time of the batch; and

expire flow data associated with the flow-hash lookup keys of the batch if the current time is after a bookkeeping time threshold.

19. The system of claim 12 , wherein the stateful processing operation accesses a hash table using the flow-hash lookup keys, and the access is performed on the hash table in parallel using a multi-threaded lookup operation.

20. The system of claim 19 , wherein the multi-threaded lookup operation inserts a new record in the hash table if a particular flow-hash lookup key is not found in the hash table and deletes an existing record from the hash table if the hash table has insufficient space for an insertion.