Abstract: A programmable finite state machine (FSM) includes, in part, first and second memories, and a selection circuit coupled to each of the memories. Upon receiving a (k+m)-bit word representative of the k-bit input symbol and the m-bit current state, the first memory supplies one ore more matching transition rules stored therein. The selection circuit selects the most specific of the supplied rules. The transition rules are stored in the first memory in a ranking order of generality. The second memory receives the selected transition rule and supplies the next state of the FSM. The first memory may be a ternary content addressable memory and the second memory may be a static random access memory. The contents of both the content addressable memory and the static random memory is determined by an algorithm which minimizes the number of terms required to represent the next-state transition functions.

Abstract: A method and apparatus for transforming regular expressions into a less resource intensive representation is disclosed. The method and apparatus converts a collection of regular expressions into a multi-level representation in which the memory requirements of the lowest level representation is reduced when compared with a conventional finite state automaton representation. The method and apparatus converts a collection of regular expressions into a collection of segments and a higher level representation in a way that retains the semantics of the original set of regular expressions. This transformation is performed through the use of an intermediate form. The resulting representation and collection admit an implementation which avoids the potentially costly memory requirements of a traditional implementation of the original expressions.

Abstract: Incoming data streams are processed at relatively high speed for decoding, content inspection and classification. A multitude of processing channels process multiple data streams concurrently so as to allows networking based host systems to provide the data streams—as the packets carrying these data streams are received from the network—without requiring the data streams to be buffered. Moreover, host systems processing stored content, such as email messages and computer files, can process more than one stream at once and thereby make better utilization of the host system's CPU. Processing bottlenecks are alleviated by offloading the tasks of data extraction, inspection and classification from the host CPU. A content processing system which so processes the incoming data streams, is readily extensible to accommodate and perform additional data processing algorithms. The content processing system is configurable to enable additional data processing algorithms to be performed in parallel or in series.

Abstract: An architecture for an integrated circuit apparatus and method that allows significant performance improvements for signature based network applications. In various embodiments the architecture allows high throughput classification of packets into network streams, packet reassembly of such streams, filtering and pre-processing of such streams, pattern matching on header and payload content of such streams, and action execution based upon rule-based policy for multiple network applications, simultaneously at wire speed. The present invention is improved over the prior art designs, in performance, flexibility and pattern database size.

Abstract: A network data classifier statistically classifies received data at wire-speed by examining, in part, the payloads of packets in which such data are disposed and without having a priori knowledge of the classification of the data. The network data classifier includes a feature extractor that extract features from the packets it receives. Such features include, for example, textual or binary patterns within the data or profiling of the network traffic. The network data classifier further includes a statistical classifier that classifies the received data into one or more pre-defined categories using the numerical values representing the features extracted by the feature extractor. The statistical classifier may generate a probability distribution function for each of a multitude of classes for the received data. The data so classified are subsequently be processed by a policy engine. Depending on the policies, different categories may be treated differently.

Abstract: A programmable finite state machine (FSM) includes, in part, a first address calculation logic block, a first lookup table, a second address calculation logic block, and a second lookup table. The first address calculation logic block generates an address for the first lookup table based on the received input symbol and the current state. The data stored in first look-up table at the generated address is used by the second address calculation logic block to compute an address for the second lookup table. Data stored in the second lookup table is the next state to which the FSM transitions. The programmable FSMs uses redundant information of the transition table to compress these transitions and thus requires a smaller memory while maintaining a high data throughput. The data in the first and second lookup tables are coded and supplied by a compiler. The FSM operation may optionally be pipelined.

Abstract: The states associated with a programmable state machine are reordered to compress the storage of transitions which define the state machine. To reorder the states, a score is computed and assigned to each of the states. Next, the states are sorted according to their computed scores. In some embodiments, to compute the score for each current state based on the received input symbol, the number of times that the input symbol causes transition to similar states is added. The sum of the scores in each row of the table is representative of the score for the associated current state associated with that row. The states are sorted according to their score and a new state transition table is generated in accordance with the reordered states.