SYSTEMS AND METHODS FOR KEYWORD SPOTTING USING ALTERNATING SEARCH ALGORITHMS

• US 20150213126A1
• Filed: 01/23/2015
• Published: 07/30/2015
• Est. Priority Date: 01/30/2014
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Yishay, Yitshak
• Granted Patent: US 9,785,701 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Systems and methods for spotting keywords in data packets are provided. In particular, input data is received to be searched for occurrences of a set of patterns, the input data being divided into multiple segments. Then the input data and the patterns are assigned to first and second pattern matching algorithms, the first pattern matching algorithm is configured to search only within each of the segments, and the second pattern matching algorithm is configured to search across boundaries between adjacent segments. Then the input data is searched using the first and second pattern matching algorithms.

Claims

1. A method, comprising:

receiving input data that is divided into multiple segments, to be searched for occurrences of a set of patterns;

assigning the input data and the patterns to first and second pattern matching algorithms, wherein the first pattern matching algorithm is configured to search only within each of the segments, and the second pattern matching algorithm is configured to search across boundaries between adjacent segments; and

searching the input data using the first and second pattern matching algorithms;

2. The method according to claim 1, wherein the first pattern matching algorithm is faster than the second pattern matching algorithm.

3. The method according to claim 1, wherein the first and second pattern matching algorithms comprise respective first and second searching states, wherein the first searching state is larger than the second searching state.

4. The method according to claim 3, wherein searching the input data comprises initializing the first searching state when starting to analyze a given segment, and clearing the first searching state when concluding analysis of the given segment.

5. The method according to claim 3, wherein searching the input data comprises storing the second searching state when concluding analyzing a given segment, and recovering the stored second searching state when starting analysis of a following segment.

6. The method according to claim 3, wherein at least part of the first pattern matching algorithm, including the first searching state, is implemented in a hardware accelerator, and wherein the first searching state is not retained across segment boundaries.

7. The method according to claim 1, wherein searching the input data comprises applying the second pattern matching algorithm to a region, which begins in a first segment and ends in a second segment that follows the first segment, wherein a size of the region in each of the first and second segments at least matches a longest pattern among the set of patterns.

8. The method according to claim 1, wherein one or more of the patterns comprise at least one wildcard character, and wherein each of the first and second pattern matching algorithms skips matching the wildcard character by suspending the respective first or second searching state until matching a non-wildcard character.

9. The method according to claim 8, wherein searching the input data comprises dividing a pattern containing the wildcard character into multiple sub-patterns that do not contain any wildcard character, searching the input data for the sub-patterns to obtain sub-pattern results, and combining the sub-pattern results.

10. The method according to claim 1, wherein assigning the input data comprises assigning a first set of patterns to the first and second pattern matching algorithms, and, upon receiving an instruction to switch to a second set of patterns, which is different from the first set, assigning the second set of patterns to the second pattern matching algorithm while analyzing a given segment using the first pattern matching algorithm, prior to restarting the second pattern matching algorithm.

11. An apparatus, comprising:

an input circuit, which is configured to receive input data that is divided into multiple segments, to be searched for occurrences of a set of patterns; and

a processor, which is configured to assign the input data and the patterns to first and second pattern matching algorithms, wherein the first pattern matching algorithm is configured to search only within each of the segments, and the second pattern matching algorithm is configured to search across boundaries between adjacent segments, and to search the input data using the first and second pattern matching algorithms.

12. The apparatus according to claim 11, wherein the first pattern matching algorithm is faster than the second pattern matching algorithm.

13. The apparatus according to claim 11, wherein the first and second pattern matching algorithms comprise respective first and second searching states, wherein the first searching state is larger than the second searching state.

14. The apparatus according to claim 13, wherein the processor is configured to initialize the first searching state when starting to analyze a given segment, and to clear the first searching state when concluding analysis of the given segment.

15. The apparatus according to claim 13, wherein the processor is configured to store the second searching state when concluding analyzing a given segment, and to recover the stored second searching state when starting analysis of a following segment.

16. The apparatus according to claim 13, wherein at least part of the first pattern matching algorithm, including the first searching state, is implemented in a hardware accelerator, and wherein the first searching state is not retained across segment boundaries.

17. The apparatus according to claim 11, wherein the processor is configured to apply the second pattern matching algorithm to a region, which begins in a first segment and ends in a second segment that follows the first segment, wherein a size of the region in each of the first and second segments at least matches a longest pattern among the set of patterns.

18. The apparatus according to claim 11, wherein one or more of the patterns comprise at least one wildcard character, and wherein the processor is configured to skip matching the wildcard character by suspending the respective first or second searching state until matching a non-wildcard character.

19. The apparatus according to claim 18, wherein the processor is configured to search the input data by dividing a pattern containing the wildcard character into multiple sub-patterns that do not contain any wildcard character, searching the input data for the sub-patterns to obtain sub-pattern results, and combining the sub-pattern results.

20. The apparatus according to claim 11, wherein the processor is configured to assign a first set of patterns to the first and second pattern matching algorithms, and, upon receiving an instruction to switch to a second set of patterns, which is different from the first set, to assign the second set of patterns to the second pattern matching algorithm while analyzing a given segment using the first pattern matching algorithm, prior to restarting the second pattern matching algorithm.