Abstract: A pattern matching accelerator (PMA) for assisting software threads to find the presence and location of strings in an input data stream that match a given pattern. The patterns are defined using regular expressions that are compiled into a data structure comprised of rules subsequently processed by the PMA. The patterns to be searched in the input stream are defined by the user as a set of regular expressions. The patterns to be searched are grouped in pattern context sets. The sets of regular expressions which define the pattern context sets are compiled to generate a rules structure used by the PMA hardware. The rules are compiled before search run time and stored in main memory, in rule cache memory within the PMA or a combination thereof. For each input character, the PMA executes the search and returns the search results.

Abstract: A pattern matching accelerator (PMA) for assisting software threads to find the presence and location of strings in an input data stream that match a given pattern. The patterns are defined using regular expressions that are compiled into a data structure comprised of rules subsequently processed by the PMA. The patterns to be searched in the input stream are defined by the user as a set of regular expressions. The patterns to be searched are grouped in pattern context sets. The sets of regular expressions which define the pattern context sets are compiled to generate a rules structure used by the PMA hardware. The rules are compiled before search run time and stored in main memory, in rule cache memory within the PMA or a combination thereof. For each input character, the PMA executes the search and returns the search results.

Abstract: A method of operating a packet parser in a computing system includes providing a configurable packet pointer by the packet parser, the packet pointer configured to index a configurable number of atomic parsing elements, the atomic parsing elements having a configurable size, in a data stream received by the computing system for extraction, wherein the indexed atomic parsing elements are non-contiguous in the data stream; and receiving the extracted indexed atomic parsing elements from the data stream by the packet parser.

Abstract: A state machine includes a rule selector. The rule selector receives input data, and one or more transition rules. The one or more transition rules including a next state. The state machine also includes a character classifier communicatively coupled to the rule selector. The character classifier includes a plurality of base classes. The character classifier receiving the input data, and sending one or more of the plurality of base classes to the rule selector in response to receiving the input data. The rule selector selects one of the one or more transition rules in response to determining that the input data and one of the plurality of base classes correspond to the transition rule. The current state of the state machine is then set to the next state of the selected one of the one or more transition rules.

Abstract: A data path for streaming data includes a plurality of sequential data registers, each of the plurality of sequential data registers comprising a plurality of data fields, wherein the streaming data moves sequentially through the sequential data registers; and a multiplexing unit, the multiplexing unit configured such that the multiplexing unit has access to each of the plurality of data fields of the plurality of sequential data registers, and wherein the multiplexing unit is configured to extract data from the streaming data as the streaming data moves through the sequential data registers in response to a data request.

Abstract: A data processing method comprises receiving an electronically parseable document, scanning the document according to at least one predefined rule to determine if the document is suspicious, and, if the document is determined not to be suspicious, parsing the document with a first parser, and, if the document is determined to be suspicious, parsing the document with a second parser.

Abstract: A mechanism is provided with an address generator that is operative to receive a current state vector and a current input value, and the address generator is operative to generate a memory address corresponding to a transition rule in response to the current state vector and the current input value. A transition rule memory includes a memory addresses, and the memory address is a location in the transition rule memory. The transition rule is a transition rule vector that includes a short state tag field. The short state tag field includes fewer bits than the current state vector.

Abstract: Apparatus for detecting a pattern in a data stream comprises a pattern matching device for receiving the data stream. The pattern matching device comprises one or more rule engines, each rule engine operating under a plurality of state transition rules encoding a plurality of patterns, a first state transition rule including a wildcard state component and a wildcard input component, a second state transition rule including a wildcard state component and a specified input component, and a third state transition rule including a specified state component and a specified input component, the first, second and third rules having differing priorities, and at least one state transition rule including an output component indicating a pattern match. The apparatus is arranged to pass the data stream to each rule engine, and is further arranged to output a signal indicating a pattern match when a state transition rule indicates a pattern match.

Abstract: An apparatus for classifying a data packet includes an interface for receiving the data packet; a classification controller for parsing the data packet to identify a plurality of data items required for classifying the data packet; memory for storing a set of range identifiers for each data item in the data packet corresponding to a rule range defined in the rule sets; and a controller for performing a preliminary test of at least one of the data items to determine whether any of the data item's values match known frequently-occurring values for that data item.

Abstract: Methods, systems and computer program products are disclosed for detecting patterns in a data stream that match multi-pattern rules. One embodiment of the invention provides a method of recognizing a specified group of patterns in a data stream. The method comprises identifying a rule for said specified group of patterns in the data stream, and using a first array of finite state machines to scan the data stream for at least some of the patterns in the specified group. For patterns in the specified group that are found in the data stream by the first array of finite state machines, pattern identifiers are sent to a second array of finite state machines. The second array of finite state machines determines if the specified group of patterns is in the data stream in accordance with the identified rule by, at least in part, using said pattern identifiers.

Abstract: A processor subunit for a processor for processing data. The processor subunit includes registers, and at least one functional unit for executing instructions on data. One or more registers of the registers are connected to an input of the at least one functional unit, where each register connected to the input of the at least one functional unit which has an input multiplexer. One or more registers of the registers are connected to an output of the at least one functional unit, where each register connected to the output of the at least one functional unit which has an input multiplexer. At least one output bus is connected to at least one register. At least one input bus is connected to at least one register. The processor subunit may be used in a processor, which may be used in a data streaming accelerator.

Abstract: A method and a device for distributing patterns to scanning engines for scanning packets in a packet stream are provided. The method includes providing a plurality of scanning engines and patterns, calculating a respective distance metric for every pair of patterns, and providing a plurality of distribution functions. Further, the method includes calculating a respective sum of the calculated distance metrics for distributing the patterns for each of the distribution functions, and utilizing the sums for selecting a distribution function of the D distribution functions for distributing the patterns to the M scanning engines. A device for implementing the method is also provided.

Abstract: The invention relates to a method of optimizing a state transition function specification for a state machine engine based on a probability distribution for the state transitions. For the preferred embodiment of the invention, a B-FSM state machine engine accesses a transition rule memory using a processor cache. The invention allows improving the cache hit rate by exploiting the probability distribution. The N transition rules that comprise a hash table entry will be loaded in a burst mode from the main memory, from which the N transition rules are transferred to the processor cache. Because the comparison of the actual state and input values against each of the transition rules can immediately start after each of these rules has been received, the overall performance is improved as the transition rule that is most likely to be selected is the first to be transferred as part of the burst access.

Abstract: A method and apparatus for deep packet processing including a parsing and a searching method supported by a data structure storing the state-transition rules in the state-transition rule tables of a programmable state machine for parsing. The state-transition rule table is then compressed using the BaRT compression algorithm. Each transition rule comprises a test value, a test mask and a next state field. In a second embodiment the state-transition rule table is split into more than one state-transition rule table corresponding to disjoints state spaces, thus allowing more flexibility in the use of storage space. Finally a parsing and searching method can be implemented using the same hardware. The searching and parsing methods can be implemented alternatively or in any combination at wire-speed.

Abstract: A result processor access a result table for an entry associated with a predetermined sub-expression of a regular expression in response to a finite state machine finding the predetermined sub-expression in the input stream. The result processor executes an instruction associated with the entry, the instruction including one or more operations to be performed on one or more bits in a bit vector register, and determines as a function of the one or more bits in the bit vector register whether the complex regular expression has been found in the input stream.

Abstract: A method and computer program product for running state machines by the steps of running at least a first and a second state machine in parallel, observing at least the first state machine for at least one first synchronization rule, and changing the state of the second state machine when the first synchronization rule applies.

Abstract: An XML parsing system includes a pattern-matching system 1 that receives an input stream 2 of characters corresponding to the XML document to be parsed, and provides an output 3 for subsequent processing in software by a processor 4. The pattern matching system 1 includes two main components, a controller in the form of a programmable state machine 5, which is programmed with an appropriate state transition diagram 6, and a character processing unit 7 in the form of a token and character handler. The programmable state machine 5 controls the character processing unit 7 to, e.g., compare characters in the input character stream 2 with other received or stored characters. The character processing unit 7 then provides feedback to the programmable state machine controller 5, e.g., as to whether the compared characters match, so that the programmable state machine controller 5 can then parse the received document accordingly.

Abstract: The invention relates to a method and system for the design and implementation of state machine engines. A first constraints checking step checks a state transition function created by a designer against constraints imposed by the implementation technology in order to detect all portions of the state transition function that are in conflict with the constraints. A subsequent conflict resolution step tries to determine one or more suggested ways to meet the conflicting constraints, by investigating how the original state transition function can be modified such that all constraints are met. A final presentation and selection step provides the designer textual and/or graphically results of the constraints check and suggested modifications. The modifications can be accepted interactively, or the state transition function can be changed manually. In the latter case, the modified state transition function will be processed starting again with the constraints checking step.

Abstract: The invention relates to an apparatus for analysing a network flow, comprising—a parser for extracting flow identification information from the network flow, —a flow metering unit for metering the network flow, —a programmable controller for controlling the flow metering unit and the parser.

Abstract: An apparatus for classifying a data packet includes an interface for receiving the data packet; a classification controller for parsing the data packet to identify a plurality of data items required for classifying the data packet; memory for storing a set of range identifiers for each data item in the data packet corresponding to a rule range defined in the rule sets; and a controller for performing a preliminary test of at least one of the data items to determine whether any of the data item's values match known frequently-occurring values for that data item.