Patent ID: 8347384

Claim:
In an intrusion-prevention system for examining network traffic and identifying therein the presence of signature data patterns, a method comprising: storing, in a data storage, a state-transition table representative of a predetermined data pattern, the state-transition table comprising a plurality of states, each state having a set of egress events, each egress event defining a transition from a current state to a next state; receiving a first portion of a subject at the intrusion-prevention network device, wherein the subject is to be evaluated for the presence of the predetermined data pattern; transitioning to a first state at a position in the first portion of the subject corresponding to a cursor location and using the state-transition table to evaluate the first portion of the subject for the presence of the predetermined data pattern; determining, after transitioning to the first state, to save a set of restart information for the first state, wherein saving the set of restart information includes: calculating a first-state range, the first-state range being a range of positions in the first portion of the subject, starting at the cursor location, in which to search for the presence of at least one of the first state's egress events; identifying a first-state actual tail from an end of the first portion of the subject, wherein the first-state actual tail comprises a portion of the first portion of the subject between an end of the first-state range and an end of the first portion of the subject; and saving at least the first-state actual tail in the data storage.