Abstract: Processing units (PUs) are coupled with a gated bi-directional bus structure that allows the PUs to be cascaded. Each PUn has communication logic and function logic. Each PUn is physically coupled to two other PUs, a PUp and a PUf. The communication logic receives Link Out data from a PUp and sends Link In data to a PUf. The communication logic has register bits for enabling and disabling the data transmission. The communication logic couples the Link Out data from a PUp to the function logic and couples Link In data to the PUp from the function logic in response to the register bits. The function logic receives output data from the PUn and Link In data from the communication logic and forms Link Out data which is coupled to the PUf. The function logic couples Link In data from the PUf to the PUn and to the communication logic.

Abstract: An intrusion detection system (IDS) comprises a network processor (NP) coupled to a memory unit for storing programs and data. The NP is also coupled to one or more parallel pattern detection engines (PPDE) which provide high speed parallel detection of patterns in an input data stream. Each PPDE comprises many processing units (PUs) each designed to store intrusion signatures as a sequence of data with selected operation codes. The PUs have configuration registers for selecting modes of pattern recognition. Each PU compares a byte at each clock cycle. If a sequence of bytes from the input pattern match a stored pattern, the identification of the PU detecting the pattern is outputted with any applicable comparison data. By storing intrusion signatures in many parallel PUs, the IDS can process network data at the NP processing speed. PUs may be cascaded to increase intrusion coverage or to detect long intrusion signatures.

Abstract: A method and apparatus for compressing a reference pattern (RP) with repeated substrings by encoding produce compressed reference patterns (CRPs) with reduce storage requirements. Operation codes and a flag are stored with the CRPs. During comparison of reference elements of the CRP to input elements (IEs) of an input pattern (IP), the operation codes are read and the reference pattern is decoded allowing all reference elements including those of the repeated substrings to be compared to IEs in the IP to determine if the RP appears within the IP.

Abstract: A method and apparatus for finding a reference pattern (RP) with K elements imbedded in an input pattern IP with repeating substrings uses dual pointers to point to elements in the RP to compare with input elements sequentially clocked from the IP. The dual pointers are loaded with a pointer address corresponding to the first reference element in the RP and the pointer addresses are either incremented to the next position or are reset back to the address of the first reference element in response to results of comparing the reference element they access to the presently clocked input element and results of comparing their respective pointer addresses.

Abstract: A method and apparatus for determining a closest match of N input patterns relative to R reference patterns using K processing units. Each of a set of input patterns are loaded into the K processing units. One of the Reference patterns is sequentially loaded into each of the processing units and a distance defining the similarity between the reference pattern and each of the input patterns is calculated. A present calculated distance replaces its corresponding stored present minimum distance if it is has a smaller value. After the R reference patterns have been processed the minimum distance and its corresponding identification for all N input patterns is determined without merging outputs. The minimum distances and the identifications may be read either in parallel or serially. The apparatus is easily scalable by adding processors. The number of reference patterns may be easily increased without altering system configuration.