NeTS: Small: Grammar Aware High-Speed Application Protocol Parsing for Deep Flow Inspection

应用程序协议解析（将原始数据包流转换为更高级的语义内容流）是当前和未来各种网络服务（如网络安全、应用程序感知负载平衡、内容感知网络和基于漏洞的签名检查）的基础和推动者。应用程序协议解析的一个关键特性是在这样一个高级流中受控地提取特定数据以进行进一步处理。FlowSifter是一个用于应用协议解析和字段提取的全新框架，目前正在开发中。为了实现实际应用协议解析和高效的字段提取，适用于处理数百万并发流的高速网络设备，FlowSifter执行自动选择无堆栈近似解析。采用计数自动机等新的形式语言理论模型来实现研究目标。具体来说，FlowSifter允许用户指定应用协议以及使用修改后的规则语法提取所需字段。FlowSifter将修改后的正则语法转换为计数自动机，以控制误差范围执行近似，选择性和近似字段提取。该项目的预期成果包括新的形式语言理论模型和全面的FlowSifter框架。研究成果通过出版物、开源软件发布、免费课程模块和行业互动广泛传播。FlowSifter的开发使未来部署具有潜在变革性的安全和网络服务（如在网络入侵检测/防御系统（ids / ips）和内容感知网络中检测多态蠕虫的基于漏洞的签名检查）成为可能，从而造福社会。

Application protocol parsing, the translation of raw packet flows into higher level flows of semantic content, is the foundation and enabler of a wide variety of current and future networking services such as network security, application-aware load balancing, content-aware networking, and vulnerability based signature checking. A key feature of application protocol parsing is the controlled extraction of specific data within such a high level flow for further processing. A fundamentally new framework for application protocol parsing and field extraction, FlowSifter is under development. To achieve practical application protocol parsing and efficient field extraction suitable for high speed networking devices that process millions of concurrent flows, FlowSifter performs automated selective stackless approximate parsing. The new formal language theory models such as counting automata are applied to achieve the research goals. Specifically, FlowSifter allows a user to specify application protocols as well as the desired fields to be extracted using a modified regular grammar. FlowSifter turns the modified regular grammar into a counting automata to perform the approximate, selective, and approximate field extraction with controlled error bounds. Expected results of this project include the new formal language theory models and the comprehensive FlowSifter framework. Research results are broadly disseminated through publications, open source software releases, freely available course modules, and industry interaction. The development of FlowSifter benefits society by enabling the future deployment of potentially transformative security and networking services such as vulnerability based signature checking for detecting polymorphic worms in network intrusion detection/prevention systems (IDSes/IPSes) and content-aware networking.