Patent ID: 8448234

Claim:
A network intrusion detection system for determining whether a data stream includes unauthorized data, the system comprising: a hardware filter, including: a storage unit to store a first set of data patterns, each one indicative of possible unauthorized data, and a comparator coupled to the storage unit to compare a portion of a packet in the data stream to the first set of data patterns to determine whether at least one pattern of the first set of data patterns is included in the portion of the packet; a switch coupled to the hardware filter to selectively direct the packet for further packet inspection based on i) a determination that at least one pattern of the first set of data patterns is included in the portion of the packet and ii) a determination that the packet is associated with at least one flow of a set of packet inspection enabled flows; and a packet inspection hardware module coupled to the switch to apply packet inspection rules to deeply inspect packets that include at least one pattern of the first set of data patterns and are associated with at least one flow of the packet inspection enabled flows, wherein the packet inspection module includes a memory to store a second set of data patterns and a plurality of rules indicative of logic for comparing combinations of data patterns to the packet, and a packet inspection engine to apply the plurality of rules to the packet, wherein the packet inspection engine applies the plurality of rules to the packet at least in part by determining whether a first data pattern is detected in the packet, in response to detecting the first data pattern, retrieving from the memory a rule associated with detecting a second data pattern when the first data pattern has been detected, determining whether the second data pattern is detected in the packet, determining whether the rule associated with detecting the second data pattern when the first data pattern has been detected is satisfied, maintaining a pattern status indicating whether the second data pattern has been detected, and maintaining a rule status indicating whether the rule associated with detecting the second data pattern when the first data pattern has been detected has been satisfied.