Full regular expression search of network traffic
AssigneeIntel Corporation
InventorsAlok Mathur, Boris Beylin
Life of this patent
Estimating the term…
Abstract
An embodiment of a system, method and apparatus is disclosed. The system comprises a first processor that is in communication with a root existence table. The first processor is to check the root existence table to determine if a character is a root character. A second processor is in communication with a root active list. The second processor is to retrieve an entry that corresponds to the character and to associate a pointer with the entry. A third processor is in communication with the second processor and a tree structure. The third processor is to receive the pointer from the second processor and to maintain the tree and table structure.
Claims20
A system comprising:
- a first processor in communication with a root existence table, the first processor to check the root existence table to determine if a string of characters includes a root character;
- a second processor coupled with the first processor, the second processor in communication with a root active list, the second processor to retrieve an entry corresponding to the root character, and associate a pointer with the entry;
- and
- a third processor coupled with the first and second processors, the third processor in communication with the second processor and a tree structure, the third processor to
- receive the pointer from the second processor, and
- maintain the tree structure, wherein the tree structure represents the string of characters, the string of characters having a data stream character that is compared with a root node of the free structure, activate a state machine if the data stream character matches the root node of the tree structure, and compare subsequent data stream characters to subsequent nodes of the tree structure.
A method comprising:
- checking a root existence table to determine if a string of characters includes a root character;
- retrieving an entry corresponding to the root character;
- associating a pointer with the entry;
- receiving the pointer from a processor;
- and
- maintaining a tree structure, wherein the tree structure represents the string of characters, the string of characters having a data stream character that is compared with a root node of the tree structure, activating a state machine if the data stream character matches the root node of the tree structure, and comparing subsequent data stream characters to subsequent nodes of the tree structure.
A machine-readable storage medium comprising instructions which, when executed, cause a machine to:
- check a root existence table to determine if a string of characters includes a root character;
- retrieve an entry corresponding to the root character;
- associate a pointer with the entry;
- receive the pointer from a processor;
- and
- maintain a tree structure, wherein the tree structure represents the string of characters, the string of characters having a data stream character that is compared with a root node of the tree structure, activate a state machine if the data stream character matches the root node of the tree structure, and compare subsequent data stream characters to subsequent nodes of the tree structure.
Dependencies are inferred from the claim text.