Systems and methods are provided, such as those that enable identification of data flows and corresponding results in a pattern-recognition processor. In one embodiment, a system may include the pattern-recognition processor and a flow identification register, wherein a unique flow identifier for each data flow is stored in the register. The system may include a results buffer that stores the results data and the flow identifier for each data flow, so that the results data may be related to a specific data flow.

Techniques recognize reducible contents in data to be written. The techniques involve receiving information related to data to be written, the information indicating that the data to be written comprises reducible contents, the reducible contents comprising data with a first reduction pattern. The techniques further involve recognizing the reducible contents in the data to be written based on the information. The techniques further involve reducing the reducible contents based on the first reduction pattern. With such techniques, active I/O pattern recognition with communication between applications and storage devices may be accomplished. In addition, with such techniques, it is easy/simple to expand recognizable new patterns, and I/O pattern limitations in standard approaches no longer exist.

Some embodiments of on-the-fly pattern recognition with configurable bounds have been presented. In one embodiment, a pattern matching engine is configured based on user input, which may include values of one or more user configurable bounds on searching. Then the configured pattern matching engine is used to search for a set of features in an incoming string. A set of scores is updated based on the presence of any of the features in the string while searching for the features. Each score may indicate a likelihood of the content of the string being in a category. The search is terminated if the end of the string is reached or if the user configurable bounds are met. After terminating the search, the scores are output.

A processor is described having an instruction execution pipeline having a functional unit to execute an instruction that compares vector elements against an input value. Each of the vector elements and the input value have a first respective section identifying a location within data and a second respective section having a byte sequence of the data. The functional unit has comparison circuitry to compare respective byte sequences of the input vector elements against the input value's byte sequence to identify a number of matching bytes for each comparison. The functional unit also has difference circuitry to determine respective distances between the input vector's elements' byte sequences and the input value's byte sequence within the data.

Pre-processing before precise pattern matching of a target pattern from a stream of patterns. Including acquiring occurrence numbers of target elements in the target pattern, initializing the buffer, the buffer indicating a section in the stream of patterns, determining whether occurrence numbers of the target elements in the buffer reach the occurrence numbers of the target elements in the target pattern, updating the buffer and then returning to the determining step, in response to determining that the occurrence numbers of the target elements in the buffer do not reach the occurrence numbers of the target elements in the target pattern, and outputting the elements in the buffer for subsequent processing, in response to determining that the occurrence numbers of the target elements in the buffer reach the occurrence numbers of the target elements in the target pattern.

Methods and systems are provided for hardware-based pattern matching. In an embodiment, an intrusion-prevention system (IPS) identifies a full match between a subject data word comprising subject-data blocks and a signature data pattern comprising signature-data blocks. The IPS receives the subject data word via a network interface, and thereafter makes a partial-match determination that two or more but less than all of the subject-data blocks respectively match the same number of the signature-data blocks stored in partial-match hardware with respect to both value and position. Thereafter, the IPS makes a full-match determination that all of the subject-data blocks respectively match all of the signature-data blocks stored in the IPS's full-match hardware with respect to both value and position. The IPS then stores an indicator that the full-match determination has been made, and may carry out one or more additional intrusion-prevention responses as well.

A system includes a multi-port random-access memory (RAM) configured to store an instruction table. The instruction table specifies a regular expression for application to a data stream. The system includes a regular expression engine configured to process the data stream based on the instruction table. The regular expression engine includes a decoder circuit configured to determine validity of active states output from the RAM, a plurality of active states memories operating concurrently, wherein each active states memory is configured to initiate a read from a different port of the RAM using an address formed of an active state output from the active states memory and a portion of the data stream, and switching circuitry configured to route the active states to the plurality of active states memories according, at least in part, to a load balancing technique and validity of the active states.

Disclosed are methods and systems, among which is a system that includes a pattern-recognition processor, a central processing unit (CPU) coupled to the pattern-recognition processor via a pattern-recognition bus, and memory coupled to the CPU via a memory bus. In some embodiments, the pattern-recognition bus and the memory bus form about the same number of connections to the pattern-recognition processor and the memory, respectively.

A natural language recognizing apparatus including an input device, a processing device and a storage device is provided. The input device is configured to provide a natural language data. The storage device is configured to store a plurality of program modules. The program modules include a grammar analysis module. The processing device executes the grammar analysis module to analyze the natural language data through a formal grammar model, and generate a plurality of string data. When at least one of the string data conforms to a preset grammar condition, the processing device judges the at least one of the string data is an intention data, and the processing device outputs a corresponding response signal according to the intention data. In addition, a natural language recognizing method is also provided.

Methods and apparatus to perform string matching for network packet inspection are disclosed. In some embodiments there is a set of string matching slice circuits, each slice circuit of the set being configured to perform string matching steps in parallel with other slice circuits. Each slice circuit may include an input window storing some number of bytes of data from an input data steam. The input window of data may be padded if necessary, and then multiplied by a polynomial modulo an irreducible Galois-field polynomial to generate a hash index. A storage location of a memory corresponding to the hash index may be accessed to generate a slice-hit signal of a set of H slice-hit signals. The slice-hit signal may be provided to an AND-OR logic array where the set of H slice-hit signals is logically combined into a match result.