Memory management for finite automata processing
First Claim
1. A security appliance operatively coupled to a network, the security appliance comprising:
- at least one memory configured to store a first finite automaton, at least one second finite automaton, and a run stack; and
at least one processor operatively coupled to the at least one memory and configured to search for at least one regular expression pattern in a flow, the search including;
initializing a search context in the run stack based on (i) partial match results determined from walking segments of a payload of the flow through the first finite automaton and (ii) a historical search context associated with the flow;
modifying the search context via push or pop operations to direct the at least one processor to walk segments of the payload through the at least one second finite automaton to explore whether at least one partial match of at least one regular expression pattern identified via the first automaton advances along at least one path of the at least one second finite automaton; and
maintaining the search context in a manner obviating overflow of the search context and obviating stalling of the push or pop operations.
6 Assignments
0 Petitions
Accused Products
Abstract
Matching at least one regular expression pattern in an input stream may be optimized by initializing a search context in a run stack based on (i) partial match results determined from walking segments of a payload of a flow through a first finite automation and (ii) a historical search context associated with the flow. The search context may be modified via push or pop operations to direct at least one processor to walk segments of the payload through the at least one second finite automation. The search context may be maintained in a manner that obviates overflow of the search context and obviating stalling of the push or pop operations to increase match performance.
149 Citations
39 Claims
-
1. A security appliance operatively coupled to a network, the security appliance comprising:
-
at least one memory configured to store a first finite automaton, at least one second finite automaton, and a run stack; and at least one processor operatively coupled to the at least one memory and configured to search for at least one regular expression pattern in a flow, the search including; initializing a search context in the run stack based on (i) partial match results determined from walking segments of a payload of the flow through the first finite automaton and (ii) a historical search context associated with the flow; modifying the search context via push or pop operations to direct the at least one processor to walk segments of the payload through the at least one second finite automaton to explore whether at least one partial match of at least one regular expression pattern identified via the first automaton advances along at least one path of the at least one second finite automaton; and maintaining the search context in a manner obviating overflow of the search context and obviating stalling of the push or pop operations. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19)
-
-
20. A method comprising:
-
operatively coupling at least one processor to at least one memory in a security appliance operatively coupled to a network, the least one memory configured to store a first finite automaton, at least one second finite automaton, and a run stack, the at least one processor configured to search for at least one regular expression pattern in a flow, the search including; initializing a search context in the run stack based on (i) partial match results determined from walking segments of a payload of the flow through the first finite automaton and (ii) a historical search context associated with the flow; modifying the search context via push or pop operations to direct the at least one processor to walk segments of the payload through the at least one second finite automaton to explore whether at least one partial match of at least one regular expression pattern identified via the first automaton advances along at least one path of the at least one second finite automaton; and maintaining the search context in a manner obviating overflow of the search context and obviating stalling of the push or pop operations. - View Dependent Claims (21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38)
-
-
39. A non-transitory computer-readable medium having stored thereon a sequence of instructions which, when loaded and executed by a processor, causes the processor to:
-
initialize a search context in the run stack based on (i) partial match results determined from walking segments of a payload of the flow through a first finite automaton and (ii) a historical search context associated with the flow; modify the search context via push or pop operations to direct the at least one processor to walk segments of the payload through the at least one second finite automaton to explore whether at least one partial match of at least one regular expression pattern identified via the first automaton advances along at least one path of the at least one second finite automaton; and maintain the search context in a manner obviating overflow of the search context and obviating stalling of the push or pop operations.
-
Specification