Match engine for detection of multi-pattern rules

A finite state machine engine for recognizing specified groups of patterns in a data stream, wherein at least a first pattern of the specified groups of patterns is comprised of a plurality of subpatterns, the first state machine engine comprising:

• a rule memory holding a multitude of multi-pattern rules for identifying each group of said specified groups of patterns;
• a first array of finite state machines to scan the data stream, in a first, pattern scanner stage, for at least some of the patterns in the specified groups, including scanning the data stream for the subpatterns of said first pattern;
• and
• a second array of finite state machines for checking if the subpatterns of the first pattern are found in the data stream in a specified order, and for determining, in a second, rule processor stage, if any of the specified groups of patterns is in the data stream in accordance with the identified multi-pattern rule;
• and wherein:
• for each of the patterns in the specified groups of patterns that are found in the data stream, the first array of finite state machines sends a pattern identifier identifying said each pattern to the second array of finite state machines.

An article of manufacture comprising:

• at least one computer usable hardware medium having computer readable program code logic to execute a machine instruction in a processing unit for using a computer for recognizing specified groups of patterns in a data stream in accordance with defined multi-pattern rules, said computer readable program code logic, when executing, performing the following:
• using a first array of finite state machines, in a first, pattern scanner stage, to scan the data stream for at least some of the patterns in the specified groups, including
• splitting at least a first pattern of the specified groups of patterns into a plurality of subpatterns,
• using the first array of finite state machines to scan the data stream for the subpatterns of said first pattern, and
• using a second array of finite state machines to check if the supatterns are found in the data stream in a specified order;
• for each of the patterns in the specified groups of patterns that are found in the data stream by the first array of finite state machines, sending a pattern identifier identifying said each pattern to the second array of finite state machines, in a second, rule processor stage;
• and
• using the second array of finite state machines for determining if any of the specified groups of patterns is in the data stream in accordance with the identified multi-pattern rule.