Patent ID: 8261352

Claim:
A method comprising: receiving, by a device, a data unit; determining, by the device, whether a current state, associated with a deterministic finite automata (DFA) that includes a first portion of states in a bitmap and a second portion of states in a DFA table, is a bitmap state; determining, by the device, whether a value corresponding to the data unit is greater than a threshold value when the current state is not the bitmap state; determining, by the device, whether the current state is insensitive when the value corresponding to the data unit is greater than the threshold value, the current state being insensitive when each next state is a same state for the current state; selecting, by the device, a default state, as a next state for the current state, when the current state is insensitive; selecting, by the device, a different state, as the next state for the current state, when the current state is not insensitive or when the value corresponding to the data unit is less than the threshold value; and dropping, by the device, the data unit when the different state is a final state that indicates that the data unit is malicious.