{'fraction_non_alphanumeric': 0.03469640644361834, 'fraction_numerical': 0.007434944237918215, 'mean_word_length': 4.9411764705882355, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
On Detection Accuracy of L7-filter and OpenDPI

Traffic identification is an important issue in the network industry. Due to the rapid increase of applications and protocols in the Internet, traffic identification based on TCP/UDP port numbers is no longer a practical approach. Deep packet inspection (DPI) thus becomes necessary, which scans the payload of a flow for certain patterns. In this paper, we analyze the architectures of two popular open-source DPI solutions, L7-filter and OpenDPI, along with their capabilities and limitations. Our extension to L7-filter, called L7-filter-U, which improves the detection accuracy on UDP flows, is also presented. Experiments on real-world traces show that OpenDPI has higher detection accuracy than L7-filter-U, which in turn performs better than L7-filter.