Method and apparatus for inspection of compressed data packages

A major challenge for deep packet inspection is related to inspection of WWW traffic which uses the HTTP protocol to transport data. This is due to the fact that compression is commonly used to reduce latency and increase bandwidth efficiency. Pattern match methods typically de‐compress the data before the actual search is carried out. This has the undesired effect that the necessary bandwidth may have to be many times the bandwidth of the incoming data. Therefore, searching in such de‐compressed data is difficult or impossible to perform at line speed. To overcome this limitation, a new method is proposed that enables inspection of compressed data without a full search in decompressed data stream. The GZIP/deflate compression algorithms behind HTTP compression are complex because they use a combination of Huffman coding and LZ77 (back references). Therefore it is difficult to completely avoid decompression in some way, but with the proposed scheme, it has been avoided to search in the decompressed data with potentially huge impact on the performance in terms of supported bandwidth.