Abstract: A hardware system for signature matching in a distributed network is disclosed. The hardware system comprises a network processor and a memory. The network processor is configured to perform horizontal compression on a state table using bitmaps, wherein the state table has a plurality of states and state transitions. The processor is also configured to perform a first grouping of states of the state table using the bitmaps to generate a first one or more sets of states, perform a second grouping of states of the state table based on the first one or more sets of states and a transition threshold to generate a second one or more sets of states, perform a conquer step grouping of the states of the state table based on the second one or more sets of states and conquer criteria to generate third one or more sets of states, and generate a two dimensioned compressed state table based on the third one or more sets of states. The memory circuit is configured to store the two dimensioned compressed state table.

Abstract: A given packet of the packetized data flow of packets is received. The given packet (145) is selectively discarded depending on at least one of the flow history of the packetized data flow and up pseudorandom test. In some embodiments, the selectively discarding is selectively executed of the given packet is at least partially overlapping with at least one further packet of the packetized data flow. Such techniques may find particular application in network-based intrusion prevention systems.

Abstract: Provided are an apparatus and method for allocating shared memory blocks to table entries to store in a memory device. A memory interface unit includes interface circuitry to connect to the blocks of the memory device. Requests are received to target addresses to access tables. For each request of the requests to a target address for a target table of the tables, the request is routed to a table block dedicated to the target table in response to the target address mapping to the table block and route the request to a shared memory block allocated to the target table in response to the target address mapping to the shared memory block allocated to the target table.

Abstract: A signature matching hardware accelerator systems and methods for deep packet inspection (DPI) applies two different compression processes to a deterministic finite automaton (DFA) used for content awareness application processing of packet flows in a communication network. Signatures related to awareness content are represented through simple strings or regular expressions in a database and are converted into a automaton, which is a state machine using the characters and state transitions to match data in incoming packets. The two compression processes include applying an alphabet compression process to reduce redundant characters and related state transitions, and then applying a two dimensional bitmap-based compression process to further reduce redundant state transitions.

Abstract: Provided are an apparatus and method for allocating shared memory blocks to table entries to store in a memory device. A memory interface unit includes interface circuitry to connect to the blocks of the memory device. Requests are received to target addresses to access tables. For each request of the requests to a target address for a target table of the tables, the request is routed to a table block dedicated to the target table in response to the target address mapping to the table block and route the request to a shared memory block allocated to the target table in response to the target address mapping to the shared memory block allocated to the target table.

Abstract: A signature matching hardware accelerator system comprising one or more hardware accelerator circuits, wherein each of the hardware accelerator circuit utilizes a compressed deterministic finite automata (DFA) comprising a state table representing a database of digital signatures defined by a plurality of states and a plurality of characters, wherein the plurality of states are divided into groups, each group comprising a leader state having a plurality of leader state transitions and one or more member states, each having a plurality of member state transitions is disclosed. The hardware accelerator circuit comprises a memory circuit configured to store a single occurrence of a most repeated leader state transition within each group, the unique leader state transitions comprising the leader state transitions that are different from the most repeated leader state transition within the respective group; and leader transition bitmasks associated respectively with the leader states within each group.

Abstract: A signature matching hardware accelerator system comprising one or more hardware accelerator circuits, wherein each of the hardware accelerator circuit utilizes a compressed deterministic finite automata (DFA) comprising a state table representing a database of digital signatures defined by a plurality of states and a plurality of characters, wherein the plurality of states are divided into groups, each group comprising a leader state having a plurality of leader state transitions and one or more member states, each having a plurality of member state transitions is disclosed. The hardware accelerator circuit comprises a memory circuit configured to store the leader state transitions within each group of the compressed DFA, only the member state transitions that are different from the leader state transitions for a respective character within each group of the compressed DFA and a plurality of member transition bitmasks associated respectively with the plurality of member state transitions.

Abstract: A given packet of the packetized data flow of packets is received. The given packet (145) is selectively discarded depending on at least one of the flow history of the packetized data flow and up pseudorandom test. In some embodiments, the selectively discarding is selectively executed of the given packet is at least partially overlapping with at least one further packet of the packetized data flow. Such techniques may find particular application in network-based intrusion prevention systems.

Abstract: A hardware system for signature matching in a distributed network is disclosed. The hardware system comprises a network processor and a memory. The network processor is configured to perform horizontal compression on a state table using bitmaps, wherein the state table has a plurality of states and state transitions. The processor is also configured to perform a first grouping of states of the state table using the bitmaps to generate a first one or more sets of states, perform a second grouping of states of the state table based on the first one or more sets of states and a transition threshold to generate a second one or more sets of states, perform a conquer step grouping of the states of the state table based on the second one or more sets of states and conquer criteria to generate third one or more sets of states, and generate a two dimensioned compressed state table based on the third one or more sets of states. The memory circuit is configured to store the two dimensioned compressed state table.

Abstract: A signature matching hardware accelerator system comprising one or more hardware accelerator circuits, wherein each of the hardware accelerator circuit utilizes a compressed deterministic finite automata (DFA) comprising a state table representing a database of digital signatures defined by a plurality of states and a plurality of characters, wherein the plurality of states are divided into groups, each group comprising a leader state having a plurality of leader state transitions and one or more member states, each having a plurality of member state transitions is disclosed. The hardware accelerator circuit comprises a memory circuit configured to store a single occurrence of a most repeated leader state transition within each group, the unique leader state transitions comprising the leader state transitions that are different from the most repeated leader state transition within the respective group; and leader transition bitmasks associated respectively with the leader states within each group.

Abstract: A signature matching hardware accelerator system comprising one or more hardware accelerator circuits, wherein each of the hardware accelerator circuit utilizes a compressed deterministic finite automata (DFA) comprising a state table representing a database of digital signatures defined by a plurality of states and a plurality of characters, wherein the plurality of states are divided into groups, each group comprising a leader state having a plurality of leader state transitions and one or more member states, each having a plurality of member state transitions is disclosed. The hardware accelerator circuit comprises a memory circuit configured to store the leader state transitions within each group of the compressed DFA, only the member state transitions that are different from the leader state transitions for a respective character within each group of the compressed DFA and a plurality of member transition bitmasks associated respectively with the plurality of member state transitions.