Scholarlink

<p>Packet classification is a cornerstone of network security functions, such as firewalls, access control, and network metering. It involves taking different actions on packets based on security rules to implement these network security functions. As networks continue to evolve and the number of network instances rapidly increases, the complexity and size of network security rule sets are also expanding. Additionally, autonomous defense systems with artificial intelligence that can detect and block online attacks have become a new trend in network security. Packet classifiers need to not only achieve fast rule matching under large rule sets but also support rapid rule updates in order to deploy security rules issued by online defense systems in a timely manner. However, existing packet classification methods struggle to balance lookup speed with update performance. To achieve rapid rule matching and support fast rule updates in networks, we propose a novel approach called the Learned Index Updatable Tree (LIPT) to address this challenge. LIPT partitions the rule set into single-field non-overlapping subsets and constructs dynamic learned index trees for each subset using keys obtained by sampling. To implement rule updates directly within the learned index tree without reconstruction, LIPT employs a gap array layout in the data nodes, which reserves space for rule insertion. To enhance lookup and update performance, LIPT addresses the challenge of direct range validation in the data node through payload-assisted validation, which helps quickly identify lookup and insertion locations. Furthermore, LIPT employs a simple linear regression model to construct the learned index tree, enabling swift lookup based on the predictive results of the linear regression model; it also utilizes a cost model to simplify the construction process. We conduct a comprehensive evaluation of LIPT’s performance, showing that both lookup and update speeds are significantly improved compared to existing algorithms that support rule updating. Compared to the benchmark algorithm PSTSS, LIPT’s update speed increases by 25%, and its classification speed increases by 242%.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Efficient packet classification with updatable learned index for online network defense

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年2月2日

查看全文
  • Yuqi Zhang,
  • Chen Li,
  • Zixuan Ma,
  • Xuefei Chen,
  • Bibo Tu

摘要

Packet classification is a cornerstone of network security functions, such as firewalls, access control, and network metering. It involves taking different actions on packets based on security rules to implement these network security functions. As networks continue to evolve and the number of network instances rapidly increases, the complexity and size of network security rule sets are also expanding. Additionally, autonomous defense systems with artificial intelligence that can detect and block online attacks have become a new trend in network security. Packet classifiers need to not only achieve fast rule matching under large rule sets but also support rapid rule updates in order to deploy security rules issued by online defense systems in a timely manner. However, existing packet classification methods struggle to balance lookup speed with update performance. To achieve rapid rule matching and support fast rule updates in networks, we propose a novel approach called the Learned Index Updatable Tree (LIPT) to address this challenge. LIPT partitions the rule set into single-field non-overlapping subsets and constructs dynamic learned index trees for each subset using keys obtained by sampling. To implement rule updates directly within the learned index tree without reconstruction, LIPT employs a gap array layout in the data nodes, which reserves space for rule insertion. To enhance lookup and update performance, LIPT addresses the challenge of direct range validation in the data node through payload-assisted validation, which helps quickly identify lookup and insertion locations. Furthermore, LIPT employs a simple linear regression model to construct the learned index tree, enabling swift lookup based on the predictive results of the linear regression model; it also utilizes a cost model to simplify the construction process. We conduct a comprehensive evaluation of LIPT’s performance, showing that both lookup and update speeds are significantly improved compared to existing algorithms that support rule updating. Compared to the benchmark algorithm PSTSS, LIPT’s update speed increases by 25%, and its classification speed increases by 242%.