Patent ID: 8024802

Claim:
In an intrusion-prevention system for examining network traffic and identifying therein the presence of signature data patterns, a method comprising: providing a state-transition table representative of a predetermined data pattern, the state-transition table comprising a plurality of states, each state having a set of egress events, each egress event defining a transition from a current state to a next state; receiving a subject to be evaluated for the presence of the predetermined data pattern; while using the state-transition table to evaluate the subject for the presence of the predetermined data pattern, detecting in the subject the presence of a first egress event of a first state, the first egress event defining a transition from the first state to a second state, and responsively transitioning from the first state to the second state; calculating, by a processor, a second-state range, the second-state range being a range of positions in the subject in which to search for the presence of at least one of the second state's egress events; and searching, by the processor, the subject within the second-state range for the presence of at least one of the second state's egress events.