Complex pattern matching engine for matching patterns in IP data streams

Abstract

A pattern matching engine is describe for matching complex pattern in internet protocol (IP) data streams. The pattern matching engine compares the incoming IP data stream to a database of known signatures to determine if there is a match. The pattern matching engine first uses a rake engine to determine if there are any potential matches between a signature in the database and the incoming IP data stream. If a signature is determined to be a potential match, a ruler engine in the pattern matching engine is then used to determine if the signature and the incoming data stream are an exact match. When and exact match is found a conclusion is reached that determines the treatment for the incoming data stream. The pattern matching engine also includes a session memory that is used to maintain state for one or more of the flows contained in the IP data stream. The state stored by the session memory allows the pattern matching engine to match patterns across packet boundaries and to perform complex matches.

Dependencies are inferred from the claim text.