RULE PARSER
9 Assignments
0 Petitions
Accused Products
Abstract
In one embodiment of the present invention, a rule compiler can compress a plurality of rules to be parsed over a block of data into one state table tree structure. In one embodiment of the present invention, rue parsing over the block of data includes selecting a unit of the block of data, indexing into a state table of the state table tree using the selected unit. The state table indexed into can be used for determining whether a decision regarding the block of data can be reached based on the indexed entry, and for selecting a next state table indicated by the indexed entry if the decision regarding the block of data cannot be reached.
-
Citations
55 Claims
-
1-30. -30. (canceled)
-
31. A non-transitory machine-readable medium having stored thereon data representing instructions that, when executed by at least one processor, cause the at least one processor to perform operations comprising:
-
constructing a state table chain for each capture rule of a plurality of capture rules used to determine whether intercepted objects are to be stored; generating a state table tree using the plurality of state table chains; intercepting packets being transmitted on a network, the packets associated with a flow that includes a particular intercepted object; and parsing the plurality of capture rules by traversing the state table tree using a tag that comprises a data structure containing meta-data associated with the particular intercepted object, wherein the particular intercepted object is stored in response to traversing the state table tree using the tag and matching the tag to a capture rule of the plurality of capture rules in the state table tree. - View Dependent Claims (32, 33, 34, 35, 36, 37, 38, 39)
-
-
40. A capture device, comprising:
-
a rule compiler configured to generate a state table tree from a plurality of capture rules used to determine whether intercepted objects are to be stored; a capture module for capturing packets being transmitted on a network, wherein the packets are associated with a flow that includes a particular intercepted object; and a rule parser configured to parse the plurality of capture rules by traversing the state table tree using a tag that comprises a data structure containing meta-data associated with the particular intercepted object, wherein the particular intercepted object is stored in response to traversing the state table tree using the tag and matching the tag to a capture rule of the plurality of capture rules in the state table tree. - View Dependent Claims (41, 42, 43, 44, 45)
-
-
46. A method comprising:
-
constructing a state table chain for each capture rule of a plurality of capture rules used to determine whether intercepted objects are to be stored; generating a state table tree using the plurality of state table chains; intercepting packets being transmitted on a network, the packets associated with a flow that includes a particular intercepted object; and parsing the plurality of capture rules by traversing the state table tree using a tag that comprises a data structure containing meta-data associated with the particular intercepted object, wherein the particular intercepted object is stored in response to traversing the state table tree using the tag and matching the tag to a capture rule of the plurality of capture rules in the state table tree. - View Dependent Claims (47, 48, 49, 50)
-
-
51. An apparatus, comprising:
-
a rule compiler configured to generate a state table tree from a plurality of capture rules used to determine whether objects are to be stored; and a rule parser configured to parse the plurality of capture rules to determine whether to store a particular object included in a flow that includes the objects, wherein the flow is associated with packets being transmitted on a network, wherein the rule parser is configured to parse the plurality of capture rules by traversing the state table tree using a tag containing meta-data associated with the particular object, and wherein the particular object is stored in response to traversing the state table tree using the tag and matching the tag to a capture rule of the plurality of capture rules in the state table tree. - View Dependent Claims (52, 53, 54, 55)
-
Specification