Rapid Searching and Matching of Data to a Dynamic Set of Signatures Facilitating Parallel Processing and Hardware Acceleration

Patent metadata

Field	Value
Publication number	US-2016188664-A1
Application number	US-201414584516-A
Country	US
Kind code	A1
Filing date	Dec 29, 2014
Priority date	Dec 29, 2014
Publication date	Jun 30, 2016
Grant date	—

Abstract

A mechanism is provided in a data processing system for matching data to a dynamic set of signatures. The mechanism creates a state transition, result, and mask (STR&M) table based on a set of signatures. The mechanism executes scanner code in each of a plurality of hardware devices in parallel to form a plurality of matching engines. The mechanism loads the STR&M table into each of the plurality of matching engines. Responsive to receiving a plurality of input records, the mechanism distributes input strings from the plurality of input records among the plurality of matching engines and receiving signature set match results from the plurality of matching engines.

First claim

1 - 14 . (canceled)

15 . A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to:
create a state transition, result, and mask (STR&M) table based on a set of signatures; execute scanner code in each of a plurality of hardware devices in parallel to form a plurality of matching engines; load the STR&M table into each of the plurality of matching engines; responsive to receiving a plurality of input records, extract input strings from the plurality of input records; and receive signature set match results from the plurality of matching engines.

16 . The computer program product of claim 15 , wherein creating the STR&M table comprises:
receiving a signature set specification; parsing and analyzing the signature set specification; generating a Finite State Machine (FSM) table based on a result of the parsing and analyzing of the signature set specification; and converting the FSM table to the STR&M table.

17 . The computer program product of claim 16 , wherein creating the STR&M table further comprises translating the STR&M table to a binary format.

18 . The computer program product of claim 15 , wherein the scanner code in each matching engine receives a given input string, gets an input symbol from the given input string, sets a working result using result and mask columns of the STR&M table, sets a next state based a current state and the input symbol using the STR&M table, and advances input to a next input symbol until an end of the given input string is reached or a NO_MATCH state is reached, wherein the scanner code uses the mask and result column values to determine a matching result without use of branching logic.

19 . The computer program product of claim 15 , wherein responsive to a given matching engine receiving a new STR&M table in binary form, the given matching engine loads the new STR&M table.

20 . An apparatus comprising:
a processor; and a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to: create a state transition, result, and mask (STR&M) table based on a set of signatures; execute scanner code in each of a plurality of hardware devices in parallel to form a plurality of matching engines; load the STR&M table into each of the plurality of matching engines; responsive to receiving a plurality of input records, distribute input strings from the plurality of input records among the plurality of matching engines; and receive signature set match results from the plurality of matching engines.

21 . The apparatus of claim 20 , wherein creating the STR&M table comprises:
receiving a signature set specification; parsing and analyzing the signature set specification; generating a Finite State Machine (FSM) table based on a result of the parsing and analyzing of the signature set specification; and converting the FSM table to the STR&M table.

22 . The apparatus of claim 21 , wherein creating the STR&M table further comprises translating the STR&M table to a binary format.

23 . The apparatus of claim 20 , wherein the scanner code in each matching engine receives a given input string, gets an input symbol from the given input string, sets a working result using result and mask columns of the STR&M table, sets a next state based on a current state and the input symbol using the STR&M table, and advances input to a next input symbol until an end of the given input string is reached or a NO_MATCH state is reached, wherein the scanner code uses the mask and result column values to determine a matching result without use of branching logic.

24 . The apparatus of claim 20 , wherein responsive to a given matching engine receiving a new STR&M table in binary form, the given matching engine loads the new STR&M table.

Assignees

• IBM

Inventors

• Agrawal Dakshi
• Bhatti Rashed Z
• Parr Francis N

Classifications

• G06F16/90344

  by using string matching techniques · CPC title

• G06F16/245 Primary

  Query processing · CPC title

• G06F16/24568

  Data stream processing; Continuous queries · CPC title

• G06F16/2282

  Tablespace storage structures; Management thereof · CPC title

• G06F16/9017

  using directory or table look-up (use of a directory or look-up table in file systems G06F16/13) · CPC title