Patent ID: 8321939

Claim:
A method comprising: representing a plurality of attack patterns to be matched in a plurality of deterministic finite automata, wherein a plurality of data packets are compared with one or more of the plurality of deterministic finite automata; receiving the plurality of data packets at an intrusion detection/prevention system (IPS), each of the plurality of data packets containing a portion of a data pattern; determining, for each of the plurality of data packets, whether a corresponding data packet is out of order; if the corresponding data packet is out of order, making and storing a local copy of the corresponding data packet, wherein the local copy is to be used in pattern matching to scan for an attack pattern of the plurality of attack patterns so that at least one of a plurality of packets containing portions of that attack pattern is blocked, passing the corresponding data packet, and performing pattern matching on the local copy and a subsequently received one of the plurality of data packets against at least a portion of the attack pattern to determine whether these data packets received so far contain the attack data pattern, wherein the local copy and the subsequently received one of the plurality of data packets are in a same sequence of data packets; and if the corresponding data packet is in order, performing pattern matching on the corresponding data packet against at least a portion of the attack pattern to determine whether one or more of the data packets received so far contain the attack data, and passing the corresponding data packet if the one or more data packets compared partially match, but do not fully match, the attack pattern.