Patent ID: 8448249

Claim:
A method for examining network traffic in an intrusion prevention system and identifying therein the presence of signature data patterns, the method comprising: providing a state-transition table representative of a predetermined data pattern, the state-transition table comprising a plurality of states, each state having a set of egress events, each egress event defining a transition from a current state to a next state; receiving a subject to be evaluated for the presence of the predetermined data pattern; evaluating, by a processor, the subject using the state-transition table for the presence of the predetermined data pattern, wherein the evaluating further includes transitioning into a first state having (a) a first egress event defining a transition to a second state, (b) a state count corresponding to a number of times the first state has been transitioned into, (c) a state-count threshold, and (d) a state-count condition; and after transitioning into the first state, incrementing the state count, and determining whether the state-count condition is satisfied by comparing the incremented state count with the state-count threshold; upon determining that the state-count condition is satisfied, transitioning to the second state; and upon determining that the state-count condition is not satisfied, returning a no-match result from the first state and decrementing the state count.