Patent ID: 8458796
Filing Date: 2013-06-04
Classification: G06F,H04L

Abstract:
1. A method of examining a subject data word, the subject data word comprising a plurality of subject-data blocks, and identifying a full match between the subject data word and a signature data pattern, the signature data pattern comprising a plurality of signature-data blocks, wherein each of the subject-data blocks and each of the signature-data blocks has (i) a respective value and (ii) a respective position, the method carried out by an intrusion-prevention system (IPS) comprising at least one processor, at least one network interface, partial-match hardware having at least part of the signature data pattern stored therein, and full-match hardware having the signature data pattern stored therein, the method comprising: the IPS receiving the subject data word via the at least one network interface; the IPS making a partial-match determination comprising a determination that a partial-match number of the subject-data blocks respectively match the same partial-match number of the signature-data blocks stored in the partial-match hardware with respect to both value and position, wherein the partial-match number is (i) greater than or equal to two and (ii) less than a total number of the subject-data blocks; subsequent to making the partial-match determination, the IPS making a full-match determination comprising a determination that all of the subject-data blocks respectively match all of the signature-data blocks stored in the full-match hardware with respect to both value and position; and the IPS storing a full-match indicator, the full-match indicator indicating that the full-match determination has been made.