Scalable and Real-Time Deep Packet Inspection

Internet traffic has continued to grow at a spectacular rate over the past ten years. Understanding and managing network traffic have become an important issue for network operators to meet service-level agreements with their customers. In addition, the emergence of high-speed networks, such as 20 Gbps, 40Gbps Ethernet and beyond, requires fast analysis of a large volume of network traffic and this is beyond the capabilities of a single machine. Distributed parallel processing schemes have recently been developed to analyze high quantities of traffic data. However, scalable Internet traffic analysis in real-time is difficult because of a large dataset requires high processing intensity. In this paper, we describe a real-time Deep Packet Inspection (DPI) system based on the MapReduce programming model. We combine a stand-alone classification engine (L7-filter) with the distributed programming MapReduce model. Our experimental results show that the MapReduce programming paradigm is a useful approach for building highly scalable real-time network traffic processing systems. We generate 20 Gbps network traffic to validate the real-time analysis ability of the proposed system.