Patent ID: 8272057

Claim:
A method, comprising: a network access device receiving a data packet of a data stream containing a file segment of a file originated from an external host and destined to a protected host of a local area network (LAN), the file being transmitted via multiple file segments contained in multiple data packets of the data stream; a data analysis module performing a data pattern analysis on a payload of the received data packet to determine whether the payload of the received data packet contains at least one but not all elements of a plurality of elements of a predetermined data pattern, without waiting for a remainder of the data stream to arrive, wherein the predetermined data pattern is a content data pattern and the predetermined data pattern is defined via a data structure having a sequence of states, wherein each of the states indicates that one of the plurality of elements of the predetermined data pattern corresponding to the respective state has been satisfied; and the network access module preventing the data packet from reaching the protected host if the payload of the received data packet contains the at least one but not all elements of a plurality of elements of a predetermined data pattern and the at least one but not all elements of a plurality of elements of a predetermined data pattern is the remaining element of the predetermined data pattern received by the network access device.