Abstract: A method for multicategory classification of streaming data records includes receiving a list of signature rules, each comprising a Boolean expression of a set of atomic recognizers (ARs) of one or more input fields of an input record and an assignment of a signature if the Boolean expression evaluates to TRUE, generating a list of all signature contexts from the list of signature rules, generating a context lookup table for each context, and processing a stream of input records on which signature detection is performed by using said ARs, said list of signature contexts, and said context lookup table for each context, wherein each input record in the stream of input records is classified into one of a plurality of categories based on the signature detection result, wherein an amount of processing grows sublinearly with a number of signature rules being processed.

Abstract: A mechanism is provided in a data processing system for matching data to a dynamic set of signatures. The mechanism creates a state transition, result, and mask (STR&M) table based on a set of signatures. The mechanism executes scanner code in each of a plurality of hardware devices in parallel to form a plurality of matching engines. The mechanism loads the STR&M table into each of the plurality of matching engines. Responsive to receiving a plurality of input records, the mechanism distributes input strings from the plurality of input records among the plurality of matching engines and receiving signature set match results from the plurality of matching engines.

Abstract: A mechanism is provided in a data processing system for matching data to a dynamic set of signatures. The mechanism creates a state transition, result, and mask (STR&M) table based on a set of signatures. The mechanism executes scanner code in each of a plurality of hardware devices in parallel to form a plurality of matching engines. The mechanism loads the STR&M table into each of the plurality of matching engines. Responsive to receiving a plurality of input records, the mechanism distributes input strings from the plurality of input records among the plurality of matching engines and receiving signature set match results from the plurality of matching engines.

Abstract: A method for multicategory classification of streaming data records includes receiving a list of signature rules, each comprising a Boolean expression of a set of atomic recognizers (ARs) of one or more input fields of an input record and an assignment of a signature if the Boolean expression evaluates to TRUE, generating a list of all signature contexts from the list of signature rules, generating a context lookup table for each context, and processing a stream of input records on which signature detection is performed by using said ARs, said list of signature contexts, and said context lookup table for each context, wherein each input record in the stream of input records is classified into one of a plurality of categories based on the signature detection result, wherein an amount of processing grows sublinearly with a number of signature rules being processed.

Abstract: A mechanism is provided in a data processing system for matching data to a dynamic set of signatures. The mechanism creates a state transition, result, and mask (STR&M) table based on a set of signatures. The mechanism executes scanner code in each of a plurality of hardware devices in parallel to form a plurality of matching engines. The mechanism loads the STR&M table into each of the plurality of matching engines. Responsive to receiving a plurality of input records, the mechanism distributes input strings from the plurality of input records among the plurality of matching engines and receiving signature set match results from the plurality of matching engines.

Abstract: A mechanism is provided in a data processing system for matching data to a dynamic set of signatures. The mechanism creates a state transition, result, and mask (STR&M) table based on a set of signatures. The mechanism executes scanner code in each of a plurality of hardware devices in parallel to form a plurality of matching engines. The mechanism loads the STR&M table into each of the plurality of matching engines. Responsive to receiving a plurality of input records, the mechanism distributes input strings from the plurality of input records among the plurality of matching engines and receiving signature set match results from the plurality of matching engines.