Patent ID: 9589073
Date: 2017-03-07
CPC Classifications: G06F,G06N,H04L

Claim:
1. A method for identifying textual phrases of interest in input data, the method being performed by an apparatus comprising a network interface card (NIC) and a processor, the method comprising: receiving, by the NIC, input communication traffic from a communication network, the input communication traffic comprising multiple flows of network packets exchanged in the communication network, the input communication traffic being received to be searched for occurrences of a set of patterns, wherein each pattern of the set of patterns comprises one or more textual phrases; configuring, by the processor, a data splitter comprising at least one import port and at least a first and second output port, wherein the at least one input port is configured to receive the input communication traffic from the NIC, wherein the data splitter is configured by the processor to assign the input communication traffic and the patterns to multiple different pattern matching algorithms by at least directing certain segments of the multiple flows to the first output port and directing other segments of the multiple flows to the second output port in accordance with an initial splitting configuration policy, wherein the first output port is associated with a first pattern matching algorithm and wherein the second output port is associated with a second pattern matching algorithm, wherein the at least a first pattern of the set of patterns is assigned to first pattern matching algorithm and wherein at least a second pattern of the set of patterns is assigned to the second pattern matching algorithm; executing, by the processor, the first and second pattern matching algorithms to identify occurrences of the textual phrases of the assigned patterns in the network packets, wherein the execution comprises the first pattern matching algorithm searching within the segments sent from the first output port for the one or more textual phrases of the first assigned pattern and the second pattern matching algorithm searching within the segments sent from the second output port for the one or more textual phases of the second assigned pattern; monitoring, by the processor, performance of the first and second pattern matching algorithms by evaluating a predetermined metric for each of the first and second pattern matching algorithms; generating, by the processor, an updated splitting policy configuration for the data splitter based on the monitored performance that reassigns which segments of the multiple flows of the input communication traffic are assigned to which output ports of the data splitter and which pattern of the set of patterns are assigned to which pattern matching algorithms; and configuring the data splitter in accordance with the updated splitting policy configuration.