Patent Document ID: 20120221497
Application ID: 13168395
Patent Flag: 0

Claim One:
1. A method comprising: in a processor of a security appliance coupled to a network: generating an initial NFA for a set of patterns; generating an initial DFA for the set of patterns, the initial DFA generated having states representing a subset of the set of patterns, having a number of states less than a number of states of a complete DFA having states representing the set of patterns, completely, and having at least one end-state, where each end-state maps to one or more states of the initial NFA for the set of patterns and represents a transition from processing the set of patterns as DFA to processing the set of patterns as NFA; adding states to the initial DFA, extending from the at least one end-state, to form an extended DFA for the set of patterns, the states added to satisfy one or more following conditions: i) reduce a number of instances the set of patterns transition from being processed as DFA to being processed as NFA, ii) reduce a number of states of the NFA to track when the set of patterns transition from being processed as DFA to being processed as NFA, and iii) a number of states of the extended DFA is less than the number of states of the complete DFA, the extended DFA represents a portion of the set of patterns to be processed as DFA, the portion of the set of patterns being of at least a predefined size; mapping at least one of the added DFA states to one or more states of the NFA to form an end-state of the extended DFA, which when processed, transitions run time processing for finding the set of patterns in an input stream from DFA to NFA so that the portion of the set of patterns is found using DFA while a remaining portion of the set of patterns is found using the NFA.