Method and system for analyzing a data flow

A system for analyzing a data flow, the system comprising:

• one or more processors, which alone or in combination, are configured to provide for execution of the following steps:
• extracting packet information of a packet of the data flow, and
• determining a status of the packet and a status of the data flow based on the extracted packet information by applying at least one probabilistic filter to the packet;
• and
• memory operable to store the packet for later inspection based on the status of the packet indicating that the packet is out-of sequence,
• wherein the one or more processors are further operable to inspect the stored packet based on inspection rules, wherein upon a partial match of at least one of the inspection rules with the extracted packet information the result of the packet inspection of the packet is temporarily stored, wherein already stored packets are inspected based on the already stored packets being in-order with already inspected packets, and wherein upon a total match of at least one of the inspection rules a predetermined action is performed and the stored result is deleted,
• wherein the at least one probabilistic filter comprises a connection Bloom filter and a sequence Bloom filter.