MATCH ENGINE FOR DETECTION OF MULTI-PATTERN RULES
First Claim
1. A method of recognizing a specified group of patterns in a data stream, the method comprising:
- identifying a multi-pattern rule for said specified group of patterns in the data stream;
using a first array of finite state machines, in a first, pattern scanner stage, to scan the data stream for at least some of the patterns in the specified group;
for patterns in the specified group that are found in the data stream by the first array of finite state machines, sending pattern identifiers to a second array of finite state machines, in a second, rule processor stage;
using the second array of finite state machines for determining if the specified group of patterns is in the data stream in accordance with the identified multi-pattern rule by, at least in part, using said pattern identifiers; and
using a compiler to distribute a function that matches an individual pattern over the first, pattern scanner stage and the second, rule processor stage.
1 Assignment
0 Petitions
Accused Products
Abstract
Methods, systems and computer program products are disclosed for detecting patterns in a data stream that match multi-pattern rules. One embodiment of the invention provides a method of recognizing a specified group of patterns in a data stream. The method comprises identifying a rule for said specified group of patterns in the data stream, and using a first array of finite state machines to scan the data stream for at least some of the patterns in the specified group. For patterns in the specified group that are found in the data stream by the first array of finite state machines, pattern identifiers are sent to a second array of finite state machines. The second array of finite state machines determines if the specified group of patterns is in the data stream in accordance with the identified rule by, at least in part, using said pattern identifiers.
0 Citations
20 Claims
-
1. A method of recognizing a specified group of patterns in a data stream, the method comprising:
-
identifying a multi-pattern rule for said specified group of patterns in the data stream; using a first array of finite state machines, in a first, pattern scanner stage, to scan the data stream for at least some of the patterns in the specified group; for patterns in the specified group that are found in the data stream by the first array of finite state machines, sending pattern identifiers to a second array of finite state machines, in a second, rule processor stage; using the second array of finite state machines for determining if the specified group of patterns is in the data stream in accordance with the identified multi-pattern rule by, at least in part, using said pattern identifiers; and using a compiler to distribute a function that matches an individual pattern over the first, pattern scanner stage and the second, rule processor stage. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A finite state machine engine for determining whether a multitude of specified groups of patterns are in a data stream, the machine comprising:
-
a context memory holding a multitude of thread context records; a transition rule memory holding a multitude of multi-pattern rules for transitioning between different states of the machine; a rule selector for selecting one or more of the multi-pattern rules from the transition rule memory; an array of finite state machines for receiving, in a first, pattern scanner stage, input data identifying patterns, of the specified groups of patterns, that are in the data stream, and for processing said input data and data from the context memory, in a second rule processor stage, to determine whether the multitude of specified groups of patterns are in the data stream in accordance with specified multi-pattern rules selected from the transition rule memory; and a compiler to distribute a function that matches an individual pattern over the first, pattern scanner stage and the second, rule processor stage. - View Dependent Claims (12, 13, 14, 15)
-
-
16. An article of manufacture comprising:
-
at least one computer usable medium having computer readable program code logic to execute a machine instruction in a processing unit for using a computer to for recognizing a specified group of patterns in a data stream in accordance with a defined multi-pattern rule, said computer readable program code logic, when executing, performing the following; using a first array of finite state machines to scan the data stream for at least some of the patterns in the specified group; for patterns in the specified group that are found in the data stream by the first array of finite state machines, sending pattern identifiers to a second array of finite state machines; and using the second array of finite state machines for determining if the specified group of patterns is in the data stream in accordance with the identified multi-pattern rule by, at least in part, using said pattern identifiers. - View Dependent Claims (17, 18, 19, 20)
-
Specification