Anchored patterns

• US 9,514,246 B2
• Filed: 02/26/2015
• Issued: 12/06/2016
• Est. Priority Date: 06/24/2011
• Status: Active Grant

• Current Assignee: Marvell Asia Pte Limited (Marvell Technology Group Limited)
• Original Assignee: Cavium, LLC (Marvell Technology Group Limited)
• Inventors: Billa, Satyanarayana Lakshmipathi, Goyal, Rajan
• Primary Examiner(s): Fleurantin, Jean B
• Application Number:
  US14/632,448
• Publication Number:
  US 20160070818A1
• Time in Patent Office: 649 Days
• Field of Search: 707/794, 707/797
• US Class Current: 1/1
• CPC Class Codes: G06F 16/2246 Trees, e.g. B+trees
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 16/9027 Trees
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A method and apparatus relate to recognizing anchored patterns from an input stream. Patterns from a plurality of given patterns are marked as anchored patterns. An anchored state tree for the anchored patterns of the plurality of given patterns is built, including nodes representing a state of the anchored state tree. For each node of the anchored state tree, a failure value equivalent to a node representing a state in an unanchored state tree representing unanchored patterns of the plurality of given patterns is determined.

Claims

1. A method comprising:

in a processor;

building an unanchored state graph for unanchored patterns of a plurality of given patterns, the unanchored state graph including nodes representing a state of the unanchored state graph;

building a separate anchored state graph for given patterns, of the plurality of given patterns, marked as anchored patterns, the anchored state graph including nodes representing a state of the anchored state graph;

for each node of the anchored state graph, determining a failure value equivalent to a node representing a state in an unanchored state graph representing unanchored patterns of the plurality of given patterns; and

including a failure value of a root node of the anchored state graph, the failure value being equivalent to a root node of the unanchored state graph.

2. The method of claim 1, wherein the anchored state graph includes a root node that is set as a start node for processing anchored and unanchored patterns in an input payload.

3. The method of claim 1, further comprising marking the given patterns, of the plurality of given patterns, as the anchored patterns.

4. The method of claim 3, wherein marking includes adding a reference indicating a location within an input of a string of text to begin searching for the respective anchored pattern.

5. A method comprising:

in a processor;

building an unanchored state graph for unanchored patterns of a plurality of given patterns, the unanchored state graph including nodes representing a state of the unanchored state graph;

building a separate anchored state graph for given patterns, of the plurality of given patterns, marked as anchored patterns, the anchored state graph including nodes representing a state of the anchored state graph;

for each node of the anchored state graph, determining a failure value equivalent to a node representing a state in an unanchored state graph representing unanchored patterns of the plurality of given patterns;

wherein each node of the anchored state graph includes an output function, the output function of each node is calculated as a function of both the anchored patterns and unanchored patterns.

6. The method of claim 5, further comprising marking the given patterns, of the plurality of given patterns, as the anchored patterns.

7. A method comprising:

in a processor;

building an unanchored state graph for unanchored patterns of a plurality of given patterns, the unanchored state graph including nodes representing a state of the unanchored state graph;

building a separate anchored state graph for given patterns, of the plurality of given patterns, marked as anchored patterns, the anchored state graph including nodes representing a state of the anchored state graph;

for each node of the anchored state graph, determining a failure value equivalent to a node representing a state in an unanchored state graph representing unanchored patterns of the plurality of given patterns;

wherein building the anchored state graph and building the separate unanchored state graph includes determining a number of states and transitions from one state to another.

8. The method of claim 7, further comprising marking the given patterns, of the plurality of given patterns, as the anchored patterns.

9. A method comprising:

in a processor;

building an unanchored state graph for unanchored patterns of a plurality of given patterns, the unanchored state graph including nodes representing a state of the unanchored state graph;

building a separate anchored state graph for given patterns of the plurality of given patterns, marked as anchored patterns, the anchored state graph including nodes representing a state of the anchored state graph;

for each node of the anchored state graph, determining a failure value equivalent to a node representing a state in an unanchored state graph representing unanchored patterns of the plurality of given patterns;

upon receiving an input string of text, processing the input string of text through the anchored state graph; and

transitioning processing of the input string of text to a node of the unanchored state graph if a character of the input string of text results in one of the determined failure values on one of the nodes of the anchored state graph, the resulting failure value determining the node of the unanchored state graph to transition processing.

10. The method of claim 9, further comprising marking the given patterns, of the plurality of given patterns, as the anchored patterns.

11. An apparatus comprising a processor configured to implement a compiler, the compiler configured to:

build an unanchored state graph for unanchored patterns of a plurality of given patterns, the unanchored state graph including nodes representing a state of the unanchored state graph;

build a separate anchored state graph for given patterns, of the plurality of given patterns, marked as anchored patterns, the anchored state graph including nodes representing a state of the anchored state graph;

for each node of the anchored state graph, determine a failure value equivalent to a node representing a state in an unanchored state graph representing unanchored patterns of the plurality of given patterns; and

determine a failure value of a root node of the anchored state graph, the failure value being equivalent to a root node of the unanchored state graph.

12. The apparatus of claim 11, wherein the compiler is further configured to mark the given patterns, of the plurality of given patterns, as the anchored patterns.

13. The apparatus of claim 11, wherein the anchored state graph includes a root node that is set as a start node for processing anchored and unanchored patterns in an input payload.

14. An apparatus comprising a processor configured to implement a compiler, the compiler configured to:

build an unanchored state graph for unanchored patterns of a plurality of given patterns, the unanchored state graph including nodes representing a state of the unanchored state graph;

build a separate anchored state graph for given patterns, of the plurality of given patterns, marked as anchored patterns, the anchored state graph including nodes representing a state of the anchored state graph;

for each node of the anchored state graph, determine a failure value equivalent to a node representing a state in an unanchored state graph representing unanchored patterns of the plurality of given patterns;

wherein each node of the anchored state graph includes an output function, the output function of each node is calculated as a function of both the anchored patterns and unanchored patterns.

15. The apparatus of claim 14, wherein the compiler is further configured to mark the given patterns, of the plurality of given patterns, as the anchored patterns.

16. The apparatus of claim 14, wherein the compiler is further configured to mark the given patterns by adding a reference indicating a location within an input of a string of text to begin searching for the respective anchored pattern.

17. An apparatus comprising a processor configured to implement a compiler, the compiler configured to:

build an unanchored state graph for unanchored patterns of a plurality of given patterns, the unanchored state graph including nodes representing a state of the unanchored state graph;

build a separate anchored state graph for given patterns, of the plurality of given patterns, marked as anchored patterns, the anchored state graph including nodes representing a state of the anchored state graph;

for each node of the anchored state graph, determine a failure value equivalent to a node representing a state in an unanchored state graph representing unanchored patterns of the plurality of given patterns;

wherein the compiler is further configured to build the anchored state graph and the separate unanchored state graph by determining a number of states and transitions from one state to another.

18. The apparatus of claim 17, wherein the compiler is further configured to mark the given patterns, of the plurality of given patterns, as the anchored patterns.

19. An apparatus comprising a processor configured to implement a compiler, the compiler configured to:

build an unanchored state graph for unanchored patterns of a plurality of given patterns, the unanchored state graph including nodes representing a state of the unanchored state graph;

build a separate anchored state graph for given patterns, of the plurality of given patterns, marked as anchored patterns, the anchored state graph including nodes representing a state of the anchored state graph;

for each node of the anchored state graph, determine a failure value equivalent to a node representing a state in an unanchored state graph representing unanchored patterns of the plurality of given patterns;

wherein the compiler is further configured to;

upon receiving an input string of text, process the input string of text through the anchored state graph; and

transition processing of the input string of text to a node of the unanchored state graph if a character of the input string of text results in one of the determined failure values of one of the nodes of the anchored state graph, the resulting failure value determining the node of the unanchored state graph to transition processing.

20. The apparatus of claim 19, wherein the compiler is further configured to mark the given patterns, of the plurality of given patterns, as the anchored patterns.

21. A method comprising:

in a processor;

building an unanchored state graph for unanchored patterns of a plurality of given patterns, the unanchored state graph including nodes representing a state of the unanchored state graph;

building a separate anchored state graph for given patterns, of the plurality of given patterns, marked as anchored patterns, the anchored state graph including nodes representing a state of the anchored state graph; and

for each node of the anchored state graph, determining a failure value equivalent to a node representing a state in an unanchored state graph representing unanchored patterns of the plurality of given patterns, wherein the failure value equivalent to the root node of the unanchored state graph enables tracking of the unanchored patterns of the plurality of given patterns in an event none of the anchored patterns of the plurality of given patterns are matched.

22. The method of claim 21, further comprising marking the given patterns, of the plurality of given patterns, as the anchored patterns.