Deep Packet Inspection (DPI) remains a critical technique for network traffic analysis, enabling comprehensive examination of both packet headers and payload content for security, policy enforcement, and traffic management. As network threats become more complex, especially with deepfake-based social engineering attacks, there is a crucial need to advance DPI capabilities through the development of intelligent firewalls that integrate machine learning (ML) for real-time threat detection. This paper advances the state-of-the-art in DPI research through three key contributions. First, it proposes a novel taxonomy that systematically distinguishes between traditional DPI techniques and ML DPI techniques, and highlights their respective strengths, limitations, and applicability. Second, it presents a comparative performance evaluation of ML models across multiple benchmark datasets and the evaluation offers insights into their practical deployment in real-world environments. Third, the paper explores emerging trends in DPI, including hybrid analytical approaches and methods to inspect encrypted traffic. Furthermore, it outlines strategic future directions, such as incorporating deepfake detection into DPI frameworks for improving data governance, and embedding explainable artificial intelligence (XAI) for transparent and trusted decision-making. These contributions collectively provide a forward-looking perspective on the integrated role of DPI and ML in next-generation cybersecurity systems.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

A Review of Deep Packet Inspection for Network Security: From Traditional Techniques to Machine Learning Integration

  • Teerath Kumar,
  • Susan Leavy,
  • Patrick Eustace,
  • Edward Curry,
  • Mamoona Naveed Asghar

摘要

Deep Packet Inspection (DPI) remains a critical technique for network traffic analysis, enabling comprehensive examination of both packet headers and payload content for security, policy enforcement, and traffic management. As network threats become more complex, especially with deepfake-based social engineering attacks, there is a crucial need to advance DPI capabilities through the development of intelligent firewalls that integrate machine learning (ML) for real-time threat detection. This paper advances the state-of-the-art in DPI research through three key contributions. First, it proposes a novel taxonomy that systematically distinguishes between traditional DPI techniques and ML DPI techniques, and highlights their respective strengths, limitations, and applicability. Second, it presents a comparative performance evaluation of ML models across multiple benchmark datasets and the evaluation offers insights into their practical deployment in real-world environments. Third, the paper explores emerging trends in DPI, including hybrid analytical approaches and methods to inspect encrypted traffic. Furthermore, it outlines strategic future directions, such as incorporating deepfake detection into DPI frameworks for improving data governance, and embedding explainable artificial intelligence (XAI) for transparent and trusted decision-making. These contributions collectively provide a forward-looking perspective on the integrated role of DPI and ML in next-generation cybersecurity systems.