Patent ID: 7904961

Claim:
A method comprising: storing a set of full deterministic finite automaton (fDFA) nodes, wherein the fDFA nodes represent a full deterministic finite automaton fDFA that accepts symbol streams that conform to a symbol pattern, the symbol pattern being associated with a computer security threat; creating a set of pDFA nodes, wherein the pDFA nodes represent a partial deterministic finite automaton (pDFA), wherein each of the pDFA nodes has a corresponding node in the fDFA nodes that has a visitation level that exceeds a visitation threshold, wherein each node in the pDFA nodes specifies a transition for a symbol to a node in the pDFA nodes when the corresponding node in the fDFA nodes specifies a transition for the symbol to a node in the fDFA nodes that has a visitation level that exceeds the visitation threshold, and wherein each node in the pDFA nodes specifies a transition for a symbol to a failure node in the pDFA nodes when the corresponding node in the fDFA nodes specifies a transition for the symbol to a node in the fDFA nodes that has a visitation level that does not exceed the visitation threshold; receiving a symbol in a symbol stream; determining whether a current node of the pDFA nodes is a failure node; determining, when the current node of the pDFA nodes is not the failure node, whether the current node of the pDFA nodes specifies a transition for the symbol to the failure node; when the current node of the pDFA nodes specifies a transition for the symbol to the failure node, accessing the set of fDFA nodes to identify a node in the fDFA nodes that corresponds to the current node of the pDFA nodes as a current node of the fDFA nodes; and detecting a computer security threat when the current node of the pDFA nodes is the failure node and when the current node of the fDFA nodes specifies a transition for the symbol to an accepting node or when the current node of the pDFA nodes specifies a transition for the symbol to an accepting node.