Method and apparatus for network security

A method for determining which groups of instructions from a plurality of groups of instructions are to be executed when a specific symbol pattern is detected in a data stream, each group of instructions being associated with one specific user defined rule, the method comprising the steps of:

• a) receiving an identification of said specific symbol pattern which has been detected in said data stream;
• b) retrieving at least one group of instructions associated with said specific symbol pattern, said at least one group of instructions being executable only when said specific symbol pattern has been detected;
• c) retrieving state information associated with specific user defined rules, said specific user defined rules being associated with said at least one group of instructions retrieved in step b);
• d) for each group of instructions retrieved in step b), determining if said group of instructions are to be executed based on state information retrieved in step c);
• and
• e) for each group of instructions retrieved in step b), executing said group of instructions in the event said group of instructions are to be executed based on results of step d).

A method of organizing groups of instructions, each group being executable only if a specific symbol pattern is detected, each group being associated with a specific symbol pattern and with one predefined rule, the method comprising the steps of:

• a) receiving a plurality of rules, each rule having at least one group of instructions;
• b) determining which symbol patterns are associated with multiple groups of instructions;
• c) for each symbol pattern, gathering groups of instructions associated with said symbol pattern from said plurality of rules;
• and
• d) for each symbol pattern, storing said groups of instructions as a set of groups associated with said symbol pattern.