A property-based technique for tolerating faults in bloom filters for deep packet inspection

Abstract

In network security applications, such as network intrusion detection, string matching is used to scan packets to detect malicious content. Bloom filters have drawn a great attention due to the fact that they can provide constant lookup times at the cost of small false positives. A fault in Bloom filters, however, cannot guarantee no-false-negatives. In this paper, we present a property-based technique for tolerating faults in Bloom filters for deep packet inspection. It employs a single spare hashing unit in each Bloom filter to detect and eliminate false negatives until the spare itself is faulty. The design is simple to be implemented in hardware. Moreover, the process for eliminating false negatives can be done without reducing the system throughput. © Springer-Verlag Berlin Heidelberg 2007.