Packet Payload Monitoring for Internet Worm Content Detection Using Deterministic Finite Automaton with Delayed Dictionary Compression

Pseudocode 1

Pseudocode for proposed approach.

Input: Packet

Output: Payload

Begin

 For each packet transfer

 Scan and compare with regular expression pattern

 If ( matches )

  Divide into subpacket

  for to

  {

   Construct into state using transistion function

   Compress stateless = encode

    = decode

  }

  Compute decode latency

  for to

  {

   for to

   {

     Compare

     If ( matches )

     {

      Count = count + 1

     }

    }

  }

   If (count threshold)

     Payload occurred

 Until end of packet

End