Abstract: Methods, systems and computer program products are disclosed for detecting patterns in a data stream that match multi-pattern rules. One embodiment of the invention provides a method of recognizing a specified group of patterns in a data stream. The method comprises identifying a rule for said specified group of patterns in the data stream, and using a first array of finite state machines to scan the data stream for at least some of the patterns in the specified group. For patterns in the specified group that are found in the data stream by the first array of finite state machines, pattern identifiers are sent to a second array of finite state machines. The second array of finite state machines determines if the specified group of patterns is in the data stream in accordance with the identified rule by, at least in part, using said pattern identifiers.

Abstract: Deterministic finite automaton (DFA) minimization includes representing a DFA as a data structure including a plurality of states, incoming transitions for each state, and outgoing transitions for each state. A state of the plurality of states is selected as a selected state. The incoming transitions are analyzed for the selected state. A computer determines whether source states of the incoming transitions for the selected state include a pair of equivalent states. The pair of equivalent states is merged based on determining that two of the source states of the incoming transitions for the selected state form the pair of equivalent states.

Abstract: Deterministic finite automaton (DFA) minimization includes representing a DFA as a data structure including a plurality of states, incoming transitions for each state, and outgoing transitions for each state. A state of the plurality of states is selected as a selected state. The incoming transitions are analyzed for the selected state. A computer determines whether source states of the incoming transitions for the selected state include a pair of equivalent states. The pair of equivalent states is merged based on determining that two of the source states of the incoming transitions for the selected state form the pair of equivalent states.

Abstract: A computer-implemented method for transforming a finite state automaton (FSA) of a regular expression includes determining, by a computer, a first subexpression R1 and a second subexpression R2 in the regular expression; calculating an overlap FSA, the overlap FSA configured to determine the existence of a partial overlap or a full overlap between the first subexpression R1 and the second subexpression R2; determining whether the overlap FSA has an accepting state; and in the event the overlap FSA is determined not to have an accepting state, determining that the transformation of the regular expression is safe, and constructing a transformed FSA of the regular expression comprising a first FSA for the first subexpression R1 and a second FSA for the second subexpression R2.

Abstract: A computer program product comprising a computer readable storage medium containing computer code that, when executed by a computer, implements a method for transforming a finite state automaton (FSA) of a regular expression, wherein the method includes determining, by a computer, a first subexpression R1 and a second subexpression R2 in the regular expression; calculating an overlap FSA, the overlap FSA configured to determine the existence of a partial overlap or a full overlap between the first subexpression R1 and the second subexpression R2; determining whether the overlap FSA has an accepting state; and in the event the overlap FSA is determined not to have an accepting state, determining that the transformation of the regular expression is safe, and constructing a transformed FSA of the regular expression comprising a first FSA for the first subexpression R1 and a second FSA for the second subexpression R2.

Abstract: A mechanism is provided with an address generator that is operative to receive a current state vector and a current input value, and the address generator is operative to generate a memory address corresponding to a transition rule in response to the current state vector and the current input value. A transition rule memory includes a memory addresses, and the memory address is a location in the transition rule memory. The transition rule is a transition rule vector that includes a short state tag field. The short state tag field includes fewer bits than the current state vector.

Abstract: An apparatus and method for analyzing a network flow. The apparatus includes a parser for extracting flow identification information from the network flow, a flow metering unit, and a programmable controller and the parser, wherein the parser and flow metering unit are controlled in parallel by the programmable controller, wherein the programmable controller is implemented as state machine, and wherein the state machine includes a transition rule memory, a rule selector, and a state register, wherein the rule selector is configured for receiving an external input signal and an internal input signal from the state register and wherein the rule selector is configured for observing the internal and external input signal by means of the transition rule memory for transition rules and for changing the state of the state register and generation of an output signal having parsing or flow metering instructions when a transition rule applies.

Abstract: A pattern matching accelerator (PMA) for assisting software threads to find the presence and location of strings in an input data stream that match a given pattern. The patterns are defined using regular expressions that are compiled into a data structure comprised of rules subsequently processed by the PMA. The patterns to be searched in the input stream are defined by the user as a set of regular expressions. The patterns to be searched are grouped in pattern context sets. The sets of regular expressions which define the pattern context sets are compiled to generate a rules structure used by the PMA hardware. The rules are compiled before search run time and stored in main memory, in rule cache memory within the PMA or a combination thereof. For each input character, the PMA executes the search and returns the search results.

Abstract: A pattern matching accelerator (PMA) for assisting software threads to find the presence and location of strings in an input data stream that match a given pattern. The patterns are defined using regular expressions that are compiled into a data structure comprised of rules subsequently processed by the PMA. The patterns to be searched in the input stream are defined by the user as a set of regular expressions. The patterns to be searched are grouped in pattern context sets. The sets of regular expressions which define the pattern context sets are compiled to generate a rules structure used by the PMA hardware. The rules are compiled before search run time and stored in main memory, in rule cache memory within the PMA or a combination thereof. For each input character, the PMA executes the search and returns the search results.

Abstract: A pattern matching accelerator (PMA) for assisting software threads to find the presence and location of strings in an input data stream that match a given pattern. The patterns are defined using regular expressions that are compiled into a data structure comprised of rules subsequently processed by the PMA. The patterns to be searched in the input stream are defined by the user as a set of regular expressions. The patterns to be searched are grouped in pattern context sets. The sets of regular expressions which define the pattern context sets are compiled to generate a rules structure used by the PMA hardware. The rules are compiled before search run time and stored in main memory, in rule cache memory within the PMA or a combination thereof. For each input character, the PMA executes the search and returns the search results.

Abstract: A system includes a register, a first logical function portion, the first logical function portion operative to receive a first numerical value from the register, perform a first logical function with the first numerical value, and output a second numerical value, a second logical function portion, the second logical function portion operative to receive the first numerical value from the register, perform a second logical function with the first numerical value, and output a third numerical value, and a control logic portion, the control logic portion operative to receive the first numerical value from the register, determine whether the first numerical value includes a code associated with either the first logical function or the second logical function, and responsive to determining that the code is associated with the first logical function, and direct the output of the second numerical value to an input of the register.

Abstract: A pattern matching accelerator (PMA) for assisting software threads to find the presence and location of strings in an input data stream that match a given pattern. The patterns are defined using regular expressions that are compiled into a data structure comprised of rules subsequently processed by the PMA. The patterns to be searched in the input stream are defined by the user as a set of regular expressions. The patterns to be searched are grouped in pattern context sets. The sets of regular expressions which define the pattern context sets are compiled to generate a rules structure used by the PMA hardware. The rules are compiled before search run time and stored in main memory, in rule cache memory within the PMA or a combination thereof. For each input character, the PMA executes the search and returns the search results.

Abstract: A pattern matching accelerator (PMA) for assisting software threads to find the presence and location of strings in an input data stream that match a given pattern. The patterns are defined using regular expressions that are compiled into a data structure comprised of rules subsequently processed by the PMA. The patterns to be searched in the input stream are defined by the user as a set of regular expressions. The patterns to be searched are grouped in pattern context sets. The sets of regular expressions which define the pattern context sets are compiled to generate a rules structure used by the PMA hardware. The rules are compiled before search run time and stored in main memory, in rule cache memory within the PMA or a combination thereof. For each input character, the PMA executes the search and returns the search results.

Abstract: A pattern matching accelerator (PMA) for assisting software threads to find the presence and location of strings in an input data stream that match a given pattern. The patterns are defined using regular expressions that are compiled into a data structure comprised of rules subsequently processed by the PMA. The patterns to be searched in the input stream are defined by the user as a set of regular expressions. The patterns to be searched are grouped in pattern context sets. The sets of regular expressions which define the pattern context sets are compiled to generate a rules structure used by the PMA hardware. The rules are compiled before search run time and stored in main memory, in rule cache memory within the PMA or a combination thereof. For each input character, the PMA executes the search and returns the search results.

Abstract: A method and a device for distributing patterns to scanning engines for scanning packets in a packet stream are provided. The method includes providing a plurality of scanning engines and patterns, calculating a respective distance metric for every pair of patterns, and providing a plurality of distribution functions. Further, the method includes calculating a respective sum of the calculated distance metrics for distributing the patterns for each of the distribution functions, and utilizing the sums for selecting a distribution function of the D distribution functions for distributing the patterns to the M scanning engines. A device for implementing the method is also provided.

Abstract: A technique for determining scan lanes is provided. For a set of patterns, a number of scan lanes is estimated to be utilized on an accelerator. The number of the scan lanes estimated for the set of patterns is iteratively incremented to optimize a throughput of the accelerator. The set of patterns is distributed to the number of the scan lanes as a distribution, and each one of the scan lanes has a predetermined number of engines. A size of a memory space is evaluated that is needed for the distribution to distribute the set of patterns onto the number of scan lanes.

Abstract: A system includes a register, a first logical function portion, the first logical function portion operative to receive a first numerical value from the register, perform a first logical function with the first numerical value, and output a second numerical value, a second logical function portion, the second logical function portion operative to receive the first numerical value from the register, perform a second logical function with the first numerical value, and output a third numerical value, and a control logic portion, the control logic portion operative to receive the first numerical value from the register, determine whether the first numerical value includes a code associated with either the first logical function or the second logical function, and responsive to determining that the code is associated with the first logical function, and direct the output of the second numerical value to an input of the register.

Abstract: A pattern matching accelerator (PMA) for assisting software threads to find the presence and location of strings in an input data stream that match a given pattern. The patterns are defined using regular expressions that are compiled into a data structure comprised of rules subsequently processed by the PMA. The patterns to be searched in the input stream are defined by the user as a set of regular expressions. The patterns to be searched are grouped in pattern context sets. The sets of regular expressions which define the pattern context sets are compiled to generate a rules structure used by the PMA hardware. The rules are compiled before search run time and stored in main memory, in rule cache memory within the PMA or a combination thereof. For each input character, the PMA executes the search and returns the search results.

Abstract: A pattern matching accelerator (PMA) for assisting software threads to find the presence and location of strings in an input data stream that match a given pattern. The patterns are defined using regular expressions that are compiled into a data structure comprised of rules subsequently processed by the PMA. The patterns to be searched in the input stream are defined by the user as a set of regular expressions. The patterns to be searched are grouped in pattern context sets. The sets of regular expressions which define the pattern context sets are compiled to generate a rules structure used by the PMA hardware. The rules are compiled before search run time and stored in main memory, in rule cache memory within the PMA or a combination thereof. For each input character, the PMA executes the search and returns the search results.

Abstract: A pattern matching accelerator (PMA) for assisting software threads to find the presence and location of strings in an input data stream that match a given pattern. The patterns are defined using regular expressions that are compiled into a data structure comprised of rules subsequently processed by the PMA. The patterns to be searched in the input stream are defined by the user as a set of regular expressions. The patterns to be searched are grouped in pattern context sets. The sets of regular expressions which define the pattern context sets are compiled to generate a rules structure used by the PMA hardware. The rules are compiled before search run time and stored in main memory, in rule cache memory within the PMA or a combination thereof. For each input character, the PMA executes the search and returns the search results.