Context-aware pattern matching accelerator

A method comprising:

• receiving, by a first stage of a context-aware pattern matching and parsing (CPMP) hardware accelerator of a network security device, a packet stream;
• identifying, by the first stage, a plurality of candidate packets within the packet stream that each satisfy one or more pre-match conditions relating to a set of Intrusion Prevention System (IPS) or Application Delivery Controller (ADC) rules by performing a pre-matching process on packets within the packet stream;
• emitting, by the first stage, information indicative of a candidate rule from the set of IPS or ADC rules for which a full-match process is to be performed with respect to a candidate packet of the plurality of candidate packets selected based on a correlation of results of the pre-matching process;
• tokenizing, by the first stage, packet data of the candidate packet to produce matching tokens and corresponding locations of the matching tokens within the candidate packet;
• performing, by a second stage of the CPMP hardware accelerator including a plurality of CPMP processors, the full-match process on the candidate packet to determine whether the candidate packet satisfies the candidate rule by fetching and executing special purpose CPMP instructions to perform one or more of (i) context-aware pattern matching on one or more packet field values of the candidate packet, (ii) context-aware string matching on packet data of the candidate packet and (iii) regular expression matching on the packet data based on a plurality of predefined conditions associated with the candidate rule, corresponding contextual information provided by the candidate rule, the matching tokens and the corresponding locations;
• and
• providing, by the second stage, results of the full-match process to a general purpose processor of the network security device.