Pattern detection

Patent metadata

Field	Value
Publication number	US-9342709-B2
Application number	US-201013876586-A
Country	US
Kind code	B2
Filing date	Oct 27, 2010
Priority date	Oct 27, 2010
Publication date	May 17, 2016
Grant date	May 17, 2016

Abstract

Data is moved through a pipeline as processing of the data unrelated to detection of pattern is performed. The detector detects the pattern within the data at a predetermined location or based on a predetermined reference as the data is moved through the pipeline, in parallel with the processing of the data as the data is moved through the pipeline. The detector detects the pattern within the data as the data is moved through the pipeline without delaying movement of the data into, through, and out of the pipeline.

First claim

We claim:

1. A device, comprising:
a pipeline implemented at least in hardware, through which data is moved to perform processing of the data unrelated to pattern detection; and
a detector implemented at least in hardware, to:
detect a first pattern at a first location within the data, in parallel with the processing of the data as the data is moved through the pipeline and without delaying movement of the data through the pipeline;
access a reference parameter that specifies a location that is relative to a location of the first pattern;
determine a second location based on the reference parameter and the information identifying the first location; and
detect a second pattern at the determined second location in the data.

2. The device of claim 1 , further comprising:
a storage to store the first pattern and a bitmask associated with the first pattern, the bitmask identifying do-not-care bits of the associated first pattern, wherein the detector is to detect the first pattern based on bits other than the do-not-care bits.

3. The device of claim 1 , wherein the detector is to store, in response to detecting the second pattern, information identifying the second location of the second pattern.

4. The device of claim 3 , wherein the detector is to store packet identifying information identifying a packet when the first pattern was detected.

5. The device of claim 1 , wherein the detector includes logic to perform an operation based on the detection of the first pattern and the detection of the second pattern.

6. The device of claim 1 , wherein the processing of the data performed in parallel with the detecting of the first pattern includes modifying a network address of the data.

7. The device of claim 1 , further comprising:
a storage to store the information identifying the first location in response to the detecting of the first pattern, the storage to further store the reference parameter and a further reference parameter providing an indication of a starting point in the data to look for the first pattern.

8. The device of claim 7 , wherein the further reference parameter indicates the starting point in a header of a data packet to look for the first pattern.

9. The device of claim 1 , wherein the data includes a data packet, and wherein the detecting of the first pattern and the detecting of the second pattern are performed in the data packet.

10. A method, comprising:
detecting, by a detector implemented at least in hardware, a first pattern within input data in a pipeline, the detecting being performed in parallel with processing of the input data as the input data is moved through the pipeline and without delaying movement of the input data into, through and out of the pipeline;
in response to the detecting, storing information identifying a first location of the first pattern in the input data;
accessing, by the detector, a reference parameter that specifies a location in data that is relative to a location of the first pattern;
determining, by the detector, a second location based on the reference parameter and the information identifying the first location; and
detecting, by the detector, a second pattern at the determined second location in the input data.

11. The method of claim 10 , further comprising accessing, by the detector, a further reference parameter indicating a location in the input data to look for the first pattern, the indicated location located in a header of a data packet.

12. The method of claim 11 , further comprising:
associating with the first pattern a starting point in relation to the location indicated by the further reference parameter and a stopping point in relation to the starting point to identify a window of data where the detector is to look for the first pattern.

13. The method of claim 10 , further comprising:
performing a logical operation based on the detection of the first pattern and the second pattern.

14. The device of claim 9 , wherein the detector is to indicate detection of at least one of a virus, a trojan, a worm, or spam in response to the detecting of the first pattern and the second pattern in the data packet.

15. The method of claim 10 , wherein the processing of the input data performed in parallel with the detecting of the first pattern includes modifying a network address of the input data.

16. The method of claim 10 , wherein the input data includes a data packet, and wherein the detecting of the first pattern and the detecting of the second pattern are performed in the data packet.

17. The method of claim 16 , further comprising:
indicating detection of at least one of a virus, a trojan, a worm, or spam in response to detecting of the first pattern and the second pattern in the data packet.

18. A device, comprising:
a storage device to store
a plurality of patterns having a length of a predetermined number of bytes; and
a plurality of parameters, associated with the plurality of patterns, each of the plurality of parameters including a reference, a start and a stop identifying where to detect the associated each of the plurality of patterns; and

a plurality of correlators implemented in hardware and equal in number to a number of bytes of each row of a plurality of rows of a pipeline,
each correlator is to provide a number of bytes of data that have been matched to one or more of the plurality of patterns, and
each correlator having a unique offset to detect one or more of the plurality of patterns beginning at a different starting byte position of data within a given row of the pipeline; and

wherein one of the plurality of patterns is indicated as having been detected within the data based on the number of bytes of the data that have been matched to the respective pattern by each correlator.

19. The device of claim 18 , wherein the reference identifies one of a plurality of layer headers, a packet payload, and a match location of a second one of the plurality of patterns, and wherein the start represents a starting point in a packet in relation to the reference, and the stop represents a stopping point in relation to the starting point to identify a window of bytes where each of the plurality of patterns may be detected.

20. The device of claim 19 , further including logic to perform an operation based on the detected patterns.

Assignees

• Warren David A
• Lavigne Bruce E
• Hewlett Packard Entpr Dev Lp

Inventors

• Warren David A
• Lavigne Bruce E

Classifications

• H04L29/06585

  Electricity · mapped topic

• G06F11/30

  Monitoring · CPC title

• G06F11/00

  Error detection; Error correction; Monitoring (error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00) · CPC title

• H04L9/06

  the encryption apparatus using shift registers or memories for block-wise {or stream} coding, e.g. DES systems {or RC4; Hash functions; Pseudorandom sequence generators} · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title