Abstract: A method for analyzing a data flow includes: (a) extracting packet information of a packet, (b) determining a status of the packet based on the extracted packet information by applying at least one probabilistic filter to the packet and storing the packet for later inspection based on the status of the packet indicating that the packet is out-of sequence, and (c) inspecting the stored packet based on inspection rules. Upon a partial match of an inspection rule with the extracted packet information, a result of the inspection is temporarily stored. Already stored packets are inspected based on the already stored packets being in-order with already inspected packets. Upon a total match of at least one of the inspection rules, a predetermined action is performed and the stored result is deleted. The at least one probabilistic filter includes a connection Bloom filter and a sequence Bloom filter.

Abstract: A method for analyzing a data flow includes: (a) extracting packet information of a packet, (b) determining a status of the packet based on the extracted packet information by applying at least one probabilistic filter to the packet and storing the packet for later inspection based on the status of the packet indicating that the packet is out-of sequence, and (c) inspecting the stored packet based on inspection rules. Upon a partial match of an inspection rule with the extracted packet information, a result of the inspection is temporarily stored. Already stored packets are inspected based on the already stored packets being in-order with already inspected packets. Upon a total match of at least one of the inspection rules, a predetermined action is performed and the stored result is deleted. The at least one probabilistic filter includes a connection Bloom filter and a sequence Bloom filter.

Abstract: A method for analyzing a data flow includes extracting packet information of a packet of the data flow, determining the status of the packet and the status of the data flow based on the extracted packet information and storing the packet for later inspection when the status of the packet and/or the status of the data flow indicate that the packet is out-of sequence, and inspecting the packet and/or the stored packet based on inspection rules. Upon a partial match of at least one of the inspection rules with the extracted packet information, a result of the inspection of the packet is temporarily stored. Already stored packets are inspected when they are in-order with already inspected packets. Upon a total match of at least one of the inspection rules, a predetermined action is performed and the stored result is deleted.

Abstract: A method for analyzing a data flow includes extracting packet information of a packet of the data flow, determining the status of the packet and the status of the data flow based on the extracted packet information arid storing the packet for later inspection when the status of the packet and/or the status of the data flow indicate that the packet is out-of sequence, and inspecting the packet and/or the stored packet based on inspection rules. Upon a partial match of at least one of the inspection rules with the extracted packet information, a result of the inspection of the packet is temporarily stored. Already stored packets are inspected when they are in-order with already inspected packets. Upon a total match of at least one of the inspection rules, a predetermined action is performed and the stored result is deleted.