Method and system for decompression-free inspection of shared dictionary compressed traffic over HTTP

摘要

A system and a method for decompression-free inspection of compressed data are provided herein. The method includes the following stages: obtaining a dictionary file comprising a string of symbols, each associated with a respective index; obtaining at least one delta file associated with said dictionary file, wherein said delta file comprises a sequence of instructions that include at least one copy instruction pointing to an index within said dictionary and a length of a copy substring to be copied; scanning said dictionary using a pattern matching algorithm associated with a plurality of patterns and implemented as a Deterministic Finite Automaton (DFA), to yield DFA execution data; scanning said at least one delta file, using said pattern matching algorithm, wherein said DFA execution data is used to skip at least part of the scanning of the copy substrings for at least one of the copy instructions.

主权项

1. A method comprising:
obtaining a dictionary file comprising a string of symbols, each symbol associated with a respective index; obtaining at least one delta file associated with said dictionary file, wherein said delta file comprises a sequence of instructions that include at least one copy instruction pointing to an index within said dictionary and a length of a copy substring to be copied; scanning said dictionary using a pattern matching algorithm associated with a plurality of patterns and implemented as a Deterministic Finite Automaton (DFA), to yield DFA execution data; scanning said at least one delta file, using said pattern matching algorithm, wherein said DFA execution data is used to skip at least part of the scanning of the copy substrings for at least one of the copy instructions, wherein when encountering a copy instruction which copies the symbols bp, . . . , bp+x−1 from the dictionary: scanning the copied symbols from the dictionary one by one, until when scanning a symbol bp+i, a state in the DFA is reached whose depth is less or equal to i, wherein in a case that the end of the copied data is reached before encountering said state, the next instruction on the delta file is applied as if all the copied symbol were scanned; otherwise, checking to find any patterns in the dictionary that ends within interval [x, x+p), and in a case said patterns are found, checking by their length that said patterns are fully contained within that interval; and obtaining the state in the DFA that corresponds to the last copied symbol.