NeTS: Small: Grammar Aware High-Speed Application Protocol Parsing for Deep Flow Inspection

NeTS：小型：用于深度流检查的语法感知高速应用协议解析

• 批准号: 1017588
• 负责人: Alex Liu
• 金额: $ 45万
• 依托单位: Michigan State University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2010
• 资助国家: 美国
• 起止时间: 2010-09-01 至 2015-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1017588&HistoricalAwards=false
• 关键词: NeTS; Small; Grammar; Aware; Speed

Application protocol parsing, the translation of raw packet flows into higher level flows of semantic content, is the foundation and enabler of a wide variety of current and future networking services such as network security, application-aware load balancing, content-aware networking, and vulnerability based signature checking. A key feature of application protocol parsing is the controlled extraction of specific data within such a high level flow for further processing. A fundamentally new framework for application protocol parsing and field extraction, FlowSifter is under development. To achieve practical application protocol parsing and efficient field extraction suitable for high speed networking devices that process millions of concurrent flows, FlowSifter performs automated selective stackless approximate parsing. The new formal language theory models such as counting automata are applied to achieve the research goals. Specifically, FlowSifter allows a user to specify application protocols as well as the desired fields to be extracted using a modified regular grammar. FlowSifter turns the modified regular grammar into a counting automata to perform the approximate, selective, and approximate field extraction with controlled error bounds. Expected results of this project include the new formal language theory models and the comprehensive FlowSifter framework. Research results are broadly disseminated through publications, open source software releases, freely available course modules, and industry interaction. The development of FlowSifter benefits society by enabling the future deployment of potentially transformative security and networking services such as vulnerability based signature checking for detecting polymorphic worms in network intrusion detection/prevention systems (IDSes/IPSes) and content-aware networking.

应用协议解析，将原始数据包流转换为语义内容的更高级别流，是当前和未来各种网络服务的基础和使能器，例如网络安全、应用感知负载平衡、内容感知网络和基于漏洞的签名检查。应用程序协议解析的一个关键特性是在这种高级流中对特定数据进行受控提取，以供进一步处理。FlowSifter是一个用于应用协议解析和字段提取的全新框架，正在开发中。为了实现适用于处理数百万并发流的高速网络设备的实际应用协议解析和高效字段提取，FlowSifter执行自动选择性无栈近似解析。为了实现研究目标，我们引入了计数自动机等新的形式语言理论模型。具体地，FlowSifter允许用户指定应用协议以及使用修改的常规语法提取的期望字段。FlowSifter将修改后的正则文法转换为计数自动机，以执行近似、选择和近似字段提取，并控制误差范围。该项目的预期成果包括新的形式语言理论模型和全面的FlowSifter框架。研究成果通过出版物、开源软件版本、免费课程模块和行业互动广泛传播。FlowSifter的开发使未来部署潜在的变革性安全和网络服务（如基于漏洞的签名检查，用于检测网络入侵检测/防御系统（IDS/IPS）和内容感知网络中的多态蠕虫），从而使社会受益。