兩階段式快速封包分類演算法

Abstract

封包分類為路由器、防火牆等網路安全設備核心工作之一，其作用在於使用封包標頭部（packet header) 中傳輸層（Transport Layer) 與網路層（Network Layer) 這兩層的欄位，來決定封包是否符合規則資料庫（rule database) 中的某條規則。而隨著網路軟、硬體設備的普及與進步，傳統適用於小維度、且僅能處理少量封包的分類法則已經漸漸無法負荷，諸如虛擬私人網路(Virtual Private Network)、服務品質保證(Quality of Service) 。如何提供一個有效率且具備實用價值的方法，是一項極為重要的議題。 我們提出一個多維度封包分類的架構，主要分為兩個階段：第一個階段為利用決策樹(Decision Tree)進行初步的搜尋分類，我們將規則資料庫依據規則編號分群，決策樹的葉節點儲存著以位元向量(Bit Vector)表示的群編號，由根節點搜尋至葉節點可以知道封包可能符合哪幾群。第二階段則針對各群中的特定位元組建立位元向量表，透過決策樹葉節點所提供的資訊，我們讀取特定群數中的位元向量表來進行更細部的分類。透過此架構，我們期望能夠在合理的記憶體空間內，有極佳的搜尋效率，由實驗結果得知，我們在記憶體用量以及存取次數上的表現均優於以往傳統的封包分類演算法。

Packet classification is one of the most critical functions for network security devices such as routers and firewalls. A packet classifier uses the packet header information to decide if a packet matches a rule in the rule database. As the network wired speed increases, a fast packet classification architecture is required to process the incoming packets. In this paper, we propose a two-stage packet classification approach. The first stage uses the decision tree to conduct an initial coarse search, which partitions the rule database into groups according to their rule numbers; the leaf of the decision tree stores the group number that is expressed with bit vectors. By searching from root to leaf, we classify the incoming packets into groups. The second stage focuses on building bit vector tables for the specific groups for performing a fine search, which conducts detailed classifications to find out the exact matched rule. Through this structure, we can produce an excellent search engine within reasonable memory storage requirements. From the experiment results, we show that the performance of our method is better than existing packet classification algorithms in the average case.