Hierarchical pattern matching devices and methods

A method for performing hardware-based pattern matching in a network device, the network device including a substring indicatory memory including a first search block and a second search block, the first search block is configured for detection of signature pattern substrings of a first substring length, the second search block is configured for detection of signature pattern substrings of a second substring length that is less than the first substring length, the method comprising:

• receiving the stream of network traffic, the stream of network traffic including a window of bytes equal to the first substring length;
• identifying a first subject substring that includes all of the bytes of the window of bytes;
• identifying a second subject substring of a length equal to the second substring length and that includes a subset of bytes of the window of bytes;
• searching the first search block to determine whether a first signature substring is present in the stream of network traffic;
• searching the second search block to determine whether a second signature substring is present in the stream of network traffic;
• and
• generating an indication that the signature pattern may be present in the stream of network traffic based on the searches.

A network interface card for performing hardware-based pattern matching in a network device, the network interface card comprising:

• a connector configured to allow the network interface card to electronically couple with the network device;
• one or more ports configured to receive a stream of network traffic;
• a substring indicator memory;
• and
• a signature search hardware module for detecting a signature pattern within the stream of network traffic, the signature search hardware module is configured to:
• receive the stream of network traffic, the stream of network traffic including a window of bytes equal to the first substring length;
• identify a first subject substring that includes all of the bytes of the window of bytes;
• identify a second subject substring of a length equal to the second substring length and that includes a subset of bytes of the window of bytes;
• search the first search block to determine whether a first signature substring is present in the stream of network traffic;
• search the second search block to determine whether a second signature substring is present in the stream of network traffic;
• and
• generate an indication that the signature pattern may be present in the stream of network traffic based on the searches.