1. DPI = Packets Handling + Domain Knowledge + Multi-Pattern Search Engine
The Deep Packet Inspection (DPI) is an advanced method which inspects the data being sent over a computer network comprehensively, and usually takes action by blocking, modifying, adjust bandwidth or logging it accordingly. We regard DPI as three parts, the network packets handling, the domain knowledge and the searching mechanism.
2. Packets Handling and Domain Knowledge
The network packets handling part and application specific domain knowledge are tightly coupled in various DPI applications. For example, in the anti-virus network gateway or intrusion prevention system, some actions are taken immediately according to anti-virus or anti-intrusion knowledge when the network packets are received. Also, DPI signatures are made by application specific domain knowledge. For example, the anti-virus signature is extracted from malware instances by anti-virus experts.
3. Multi-Pattern Search Engine
About the searching mechanism part, Lionic has invested much research effort to it for many years. We utilized several sophisticated algorithms and have our own modifications and enhancements to meet the needs of real world. The searching mechanism is packaged as the Lionic regular expression solutions. They can search multi-pattern at the same time. Also, pattern is written in plain string or regular expression syntax by human and then compiled into special formats executed by plain string search engine or RE search engine. The Lionic regular expression solutions are developed not only for network packets but also for other multiple data streams.
A DPI solution is necessary to combine the searching mechanism, network packets handling and application specific domain knowledge together. Lionic has chosen several domains and dedicates to the research and development of their deep packet inspection solutions, not the regular expression products only.
Lionic is both the pioneer and veteran in deep packet inspection area. Our lesson learned is “Deep Pocket is necessary for Deep Packet”. Thanks to the deep pocket and the wonderful team, so that we can have some small success in DPI.