Method and apparatus for performing complex pattern matching in a data stream within a computer network

• US 20040190506A1
• Filed: 03/24/2003
• Published: 09/30/2004
• Est. Priority Date: 03/24/2003
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Lingafelt, Charles Steven, Davis, Gordon Taylor, Strole, Norman Clark
• Application Number:
  US10/395,722
• Publication Number:
  US 20040190506A1
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

An apparatus for performing complex pattern matching in a data stream within a computer network is disclosed. The apparatus includes a serial array register and a content-addressable memory (CAM). The CAM includes multiple CAM entries, and each of the CAM entries includes a k-byte pattern concatenated with an n-byte mask. The positions of the k-byte pattern and n-byte mask in each of the CAM entries offset from those in other CAM entries by one byte. Preferably, the k-byte pattern is each of the CAM entries represents a known computer virus pattern. After the capture of a data pattern from a data stream by the serial array register, the CAM register performs a comparison operation between the captured data pattern and all the CAM entries. If there is a match between the captured data pattern and one of the CAM entries, the CAM signals that the data stream contains information that are potentially harmful to the computer network.

Claims

1. An apparatus for performing complex pattern matching in a data stream within a computer network, said apparatus comprising:

a serial array register for receiving a data stream; and

a content-addressable memory (CAM), coupled to said serial array register, for performing comparison operations between a data pattern within said serial array register and a plurality of CAM entries within said CAM, wherein said plurality of CAM entries includes a k-byte pattern of concatenated with an n-byte mask, wherein the positions of said k-byte pattern and n-byte mask in each of said plurality of CAM entries offset from other CAM entries by an offset.

2. The apparatus of claim 1, wherein said apparatus further includes means for shifting data stream in said serial array register n+1 bytes after each comparison operation.

3. The apparatus of claim 1, wherein said apparatus further includes means for signaling said data stream contains information that are potentially harmful to said computer network when there is a match between said data pattern within said serial array register and one of said CAM entries within said CAM.

4. An apparatus for performing complex pattern matching in a data stream within a computer network, said apparatus comprising:

a serial array register for receiving a data stream; and

a content-addressable memory (CAM), coupled to said serial array register, for performing comparison operations between a data pattern within said serial array register and a plurality of CAM entries within said CAM, wherein said plurality of CAM entries are divided into multiple groups, each group includes a pattern of variable width concatenated with a mask of variable width, wherein the positions of said variable width pattern and said variable width mask in each CAM entries within each of said groups offset from other CAM entries within said each of said groups by an offset, wherein the total width of said variable width pattern and said variable width mask are identical within each of said groups.

5. The apparatus of claim 4, wherein said apparatus further includes means for shifting data stream in said serial array register by said offset after each comparison operation.

6. The apparatus of claim 4, wherein said apparatus further includes means for signaling said data stream contains information that are potentially harmful to said computer network when there is a match between said data pattern within said serial array register and one of said CAM entries within said CAM.

7. A method for performing complex pattern matching in a data stream within a computer network, said method comprising:

receiving a data stream by a serial array register; and

performing comparison operations between a data pattern within said received data stream and a plurality of content-addressable memory (CAM) entries within a CAM, wherein said plurality of CAM entries includes a k-byte pattern concatenated with an n-byte mask, wherein the positions of said k-byte pattern and n-byte mask in each of said plurality of CAM entries offset from other CAM entries by an offset.

8. The method of claim 7, wherein said method further includes shifting data stream in said serial array register n+1 bytes after each comparison operation.

9. The method of claim 7, wherein said method further includes signaling said data stream contains information that are potentially harmful to said computer network when there is a match between said data pattern within said data stream and one of said CAM entries within said CAM.