Systems and methods for deep packet inspection with a virtual machine

A method for performing deep packet inspection of data packets, the method comprising:

• receiving a plurality of data packets to be forwarded;
• selecting, based at least in part on a first set of rules, one or more of the plurality of data packets for deep packet inspection, by inspecting a predetermined sequence of bits at a predetermined offset of each of the plurality of data packets;
• performing deep packet inspection on the selected one or more data packets to determine whether the selected one or more data packets are allowed for forwarding, according to a second set of rules that are based on
• (i) characters in the selected one or more data packets matching a predetermined pattern,
• (ii) strings in the selected one or more data packets matching a predetermined pattern,
• (iii) cardinality of a group consisting of the selected one or more data packets, wherein the cardinality represents how many packets are in the group,
• (iv) behavioral and statistical analyses of the selected one or more data packets to identify a virus or analyze network traffic, and
• (v) existence, from among the selected one or more data packets, a plurality of consecutive data packets that together contain a particular sequence of actions that indicates a particular application or network entity;
• discarding the selected one or more data packets in response to determining if the deep packet inspection determines that the selected one or more data packets are not allowed for forwarding;
• and
• forwarding the selected one or more data packets if the deep packet inspection determines that the selected one or more data packets are allowed for forwarding.

A processing system for performing deep packet inspection of data packets, the processing system comprising:

• one or more data processors configure to implement a virtual machine that is configured to
• receive, from a switch core, one or more data packets to be forwarded, and
• perform deep packet inspection on the one or more data packets to determine whether the one or more data packets are allowed for forwarding, according to a set of rules that are based on
• (i) characters in the one or more data packets matching a predetermined pattern,
• (ii) strings in the one or more data packets matching a predetermined pattern,
• (iii) cardinality of a group consisting of the selected one or more data packets, wherein the cardinality represents how many packets are in the group,
• (iv) behavioral and statistical analyses of the one or more data packets to identify a virus or analyze network traffic, and
• (v) existence, from among the one or more data packets, a plurality of consecutive data packets that together contain a particular sequence of actions that indicates a particular application or network entity;
• discard the one or more data packets in response to the virtual machine determining, based on the deep packet inspection, that the received one or more data packets are not allowed for forwarding;
• and
• cause the received one or more data packets to be forwarded by the switch core in response to the virtual machine core determining, based on the deep packet inspection, that the one or more data packets are allowed for forwarding.