Flow-aware Cross Packet Inspection using Bloom Filters for High Speed Data-path Content Matching

Content matching based algorithms form the core of many network security devices. It is one of the critical components due to the fact that it allows making decisions based on the actual content flowing through the network. The most important parameters that go into the design of a content matching algorithm are its performance and accuracy of detection. Although this topic had received significant attention in literature over past decade, much of the work was focused on improving the performance. The accuracy of detection was limited within a packet instance. Protocols like TCP do not guarantee that message boundaries are preserved. This can result in a segmented pattern across packets. This paper demonstrates a novel flow-aware content matching algorithm that solves this limitation without compromising the performance.