Fast signature scan

A processor-implemented method for improving one or more of processing speed and memory utilization when inspecting a string field and matching it with a targeted string signature, the method comprising:

• (a) receiving, by a processor, a plurality of incoming string fields;
• (b) finding, by the processor, a non-hashed fragment associated with an incoming string field of the plurality of incoming string fields, wherein:
• the finding comprises finding a non-hashed fragment at a first shifted scan location, the non-hashed fragment comprising a substring of the incoming string field, the non-hashed fragment is of a size that is smaller than the incoming string field;
• (c) deriving, by the processor, a hash value for the non-hashed fragment;
• (d) referencing, by the processor, a table stored in an on-chip memory to find a table value, wherein the table value is associated with an unhashed fingerprint of a targeted string signature, wherein:
• the targeted string signature is a targeted fixed-size signature, and the unhashed fingerprint is located within the targeted string signature and is of a size that is less than the size of the targeted string signature,
• (e) determining, by the processor, a potential match between the incoming string field and the targeted string signature based upon the hash value and the table value;
• and
• (f) based on the determining, comparing, by the processor, of at least one of the incoming string field or a substring of the incoming string field that is smaller in size than the incoming string field to a pattern representing a text string of the targeted string signature, to determine, based in whole or in part on the processor using a non-deterministic finite automaton (NFA) based-matching, whether the incoming string field matches in whole or in part the targeted string signature, wherein the pattern representing the text string of the targeted string signature is an expression comprising a combination of a first alphanumeric character, and of a second alphanumeric character or a wildcard symbol.

A processor-implemented method for improving one or more of processing speed and memory utilization when f inspecting a string field and matching it with a targeted string signature, comprising the following steps:

• (a) receiving, by a processor comprising on-chip memory, a plurality of incoming string fields;
• (b) finding, by the processor, a plurality of non-hashed fragments associated with an incoming string field of the plurality of incoming string fields for a plurality of shifted scan locations in the incoming string field, wherein:
• the finding comprises finding a first non-hashed fragment at a first shifted scan location, and a second non-hashed fragment at a second shifted scan location,
• the first non-hashed fragment and the second non-hashed fragment each comprising a substring of the incoming string field, and
• the first non-hashed fragment and the second non-hashed fragment is of a size that is smaller than the incoming string field;
• (c) deriving, by the processor, a hash value for the first non-hashed fragment;
• (d) looking up, by the processor, the on-chip memory of the processor to find a plurality of table values, at least one table value representing a hash value of an otherwise unhashed fingerprint of a targeted string signature, wherein:
• the targeted string signature is a targeted fixed-size signature or a targeted variable-size signature, the otherwise unhashed fingerprint is at a defined or undefined location within the targeted string signature, and is of a size that is less than the size of the targeted string signature,
• (e) determining, by a first engine of the processor, a potential match between the incoming string field and the targeted string signature based upon the hash value and the at least one table value;
• and
• (f) in response to the processor determining the potential match, a first processor engine passes the incoming string field to a second processor engine, the second processor engine comparing at least one of the incoming string field or a subpart thereof to a pattern representing a text string of the targeted string signature, to determine whether the incoming string field matches in whole or in part the targeted string signature, based in whole or in part on non-deterministic finite automaton (NFA) based-matching, wherein the pattern representing the text string of the targeted string signature is an expression comprising at least one of (i) a combination of at least two alphanumeric characters, and (ii) a combination of at least one alphanumeric character and a wildcard symbol.

A method of inspecting a string field and matching it with a targeted string signature, comprising the following steps in sequential or non-sequential order:

• (a) receiving, by a processor, a plurality of incoming string fields;
• (b) finding, by the processor, a plurality of non-hashed fragments associated with an incoming string field of the plurality of incoming string fields for a plurality of shifted scan locations in the incoming string field;
• wherein a non-hashed fragment of the plurality of non-hashed fragments has the same length as an otherwise unhashed fingerprint of the targeted string signature, wherein the targeted string signature is one of a targeted fixed-size string signature and a longest fixed-size substring of a targeted variable-size string signature;
• (c) deriving, by the processor, a hash value for the non-hashed fragment;
• (d) referencing, by the processor, a table to identify at least one table value representing a hash value of the otherwise unhashed fingerprint, wherein:
• to the extent the otherwise unhashed fingerprint is of the targeted fixed-size string signature, the otherwise unhashed fingerprint is located at a specified offset within the targeted fixed-size string signature and is of a size that is less than the size of the targeted fixed-size string signature;
• (e) based in whole or in part upon the hash value, determining, by the processor, a potential match between the incoming string field and at least one of the targeted fixed-size string signature and the longest fixed-size substring of the targeted variable-size string signature;
• and
• (f) based on the determining, comparing, by the processor, at least one of the incoming string field or a substring of the incoming string field that is smaller in size than the incoming string field to a pattern representing a text string of the targeted string signature, to determine whether the incoming string field contains the targeted string signature.