Patent ID: 8272056

Claim:
A method for network intrusion detection, comprising: compressing an unoptimized Aho-Corasick automaton, wherein compressing the unoptimized Aho-Corasick automaton comprises: classifying states of the unoptimized Aho-Corasick automaton by the number of non-null success pointers in a state into three categories, wherein the three categories represent low degree, middle degree and high degree states; and storing each state of the unoptimized automaton in a plurality of memory blocks in a storage media, wherein a first memory block in the plurality of memory blocks is a bitmap node for states classified in the high degree category, wherein a second memory block in the plurality of memory blocks is a low degree node for states classified in the middle degree state category, and wherein a third memory block in the plurality of memory blocks is a path compressed node for states classified in the low degree category, wherein the bitmap node comprises multiple levels of summaries for performing popcount computation, wherein the bitmap node comprises three levels of summaries, wherein a first level comprises blocks of bits, wherein a second level comprises sub-blocks of bits, and wherein a third level comprises sub-sub-blocks of bits.