Methods and systems for full pattern matching in hardware

A method of intrusion prevention for protecting a computer network, the method comprising:

• generating, via an intrusion-prevention system (IPS), a plurality of pre-processing-signature-pattern-hash results for a signature data pattern, wherein the IPS includes a processor and hardware;
• mapping, via the IPS, the signature data pattern to a first pre-processing memory address of a first memory device and a second pre-processing memory address of a second memory device based on the pre-processing-signature-pattern-hash results;
• flagging, via the IPS, the first pre-processing memory address of the first memory device and the second pre-processing memory address of the second memory device;
• receiving, via a network interface of the IPS, a subject data word;
• generating, via the IPS, a plurality of pre-processing-subject-hash results for the subject data word;
• mapping, via the IPS, the subject data word to a first subject data word pre-processing memory address of the first memory device and a second subject data word pre-processing memory address of the second memory device based on the corresponding pre-processing-subject-hash results;
• performing, via the IPS, subsequent to a determination that the first subject data word pre-processing memory address of the first memory device is the same as the flagged first pre-processing memory address and the second subject data word pre-processing memory address of the second memory device is the same as the flagged second pre-processing memory address, a partial-match determination including determining that a partial-match number of a plurality of subject-data blocks of the subject data word respectively have a same block value at a same block position as the same partial-match number of a plurality of signature-data blocks of the signature data pattern;
• performing, via the IPS, subsequent to making the partial-match determination, a full-match determination comprising a determination that all of the subject-data blocks respectively have a same block value at a same block position as all of the signature data blocks;
• and
• subsequent to making the full-match determination, indicating that the subject data word comprises a known threat to the computer network.