## 2 Review of the State of the Art about Packet Analysis and Related Work
### Network Forensics and the Cybersecurity Market  
Internet traffic grows rapidly, with an expectation of 278 Exabytes of data being transmitted per month by 2021 (see Figure 1), as stated in [25]. As DPI is correlated to network traffic, this growth also implies a higher amount of DPI devices used in the several different types of its applications and segments. Major factors for the DPI market expansion are evolution of cyberattacks, which influences the need for modern and good performance network analysis devices and advancements in the communication technology. As a consequence of this growth, there is an increased occurrence of cyberattacks and more money being invested by companies to secure their assets, as a data breach may cost millions of dollars and result in a loss of market [26]. Figure 2 shows that the security alerts has risen from 2013 to 2016. It is possible to see a spike of alerts in 2015, evidencing an explosion of attacks in that year [27], which can be verified by the Symantec Report [28], which shows an increasing appearance of, among other threats, new mobile malware variants and a higher rate of e-mail malware in recent years. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Challenges** & **Description** & **Supporting References** \\ \hline Performance & When monitoring a network in real time, the device assigned to perform the DPI should be able to process the packets information in the least time possible, for it to be capable of analyzing every packet of the flow, without accumulated delay. Optimizing the use of the memory of the device, for instance, improves the performance. As internet traffic generates a huge amount of data, its processing may require tools specialized for Big Data, such as Hadoop and Kafka. & [3,4,13] \\ \hline Encryption & As DPI consists of the analysis of the payload and headers of each packet, encrypting it hinders the detection with DPI, it being possible to analyze only the metadata. In such cases, solutions include the use of proxies which can decrypt the traffic, in cases where it performs Man-In-The-Middle (MITM) transactions on behalf of users, or analyzing packets after they are decrypted. & [14, 15, 16] \\ \hline Anonymity & Cases in which the attacker uses network anonymizers, such as The Onion Router (TOR), will lead the DPI investigation to an inaccurate conclusion regarding the source of the attack. Spoofing packets will also masquerade its source. & [17, 18, 19] \\ \hline Number of attacks & With the increasing number of different attacks, thorougher inspections are necessary to detect their patterns and signatures, and keep the database updated. In addition, as zero-day vulnerabilities may occur at any time, a more detailed investigation is necessary in order to identify and follow the attacker’s trail. To circumvent this, Machine Learning techniques may be applied, to detect known and emerging malware. & [20, 21, 22] \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Resume of DPI common challenges. As reported by a Cisco Report [27], with the advent of new technologies, such as Internet of Things (IoT), the attack surface will only expand, giving malicious users more space to operate. As a consequence, the use of DPI is expected to grow, in order to prevent targeted networks from being exploited [29]. One of the biggest reasons for this rise is the growing trend of ransomware, which are dominating the malware market, partially due to the use of bitcoins as the preferred method of payment, as it grants anonymity to its users. This lucrative threat became more widespread and powerful in the first half of 2016, targeting individual and enterprise users with a high success rate [29]. The recent worldwide infection of WannaCry [30] corroborates the ascension of this kind of malware. As this type of malware depends on a private key to conclude the encryption, DPI can be used to detect and drop suspected egress traffic, matching ransomware's communication protocols.