International Business Machines Corporation

Jan M Slyfield

Ali Ghassan Saidi

Pascal R Tannhof

Kerry A Kravec

Clark Debs Jeffries

Ravinder Kumar Sabhikhi

Marc A Boulanger

C Marcel Kinard

Matthew Lee Helsley

An intrusion detection system (IDS) comprises a network processor (NP) coupled to a memory unit for storing programs and data. The NP is also coupled to one or more parallel pattern detection engines (PPDE) which provide high speed parallel detection of patterns in an input data stream. Each PPDE comprises many processing units (PUs) each designed to store intrusion signatures as a sequence of data with selected operation codes. The PUs have configuration registers for selecting modes of pattern recognition. Each PU compares a byte at each clock cycle. If a sequence of bytes from the input pattern match a stored pattern, the identification of the PU detecting the pattern is outputted with any applicable comparison data. By storing intrusion signatures in many parallel PUs, the IDS can process network data at the NP processing speed. PUs may be cascaded to increase intrusion coverage or to detect long intrusion signatures.

Intrusion detection using a network processor and a parallel pattern detection engine

A method and apparatus for determining a closest match of N input patterns relative to R reference patterns using K processing units. Each of a set of input patterns are loaded into the K processing units. One of the Reference patterns is sequentially loaded into each of the processing units and a distance defining the similarity between the reference pattern and each of the input patterns is calculated. A present calculated distance replaces its corresponding stored present minimum distance if it is has a smaller value. After the R reference patterns have been processed the minimum distance and its corresponding identification for all N input patterns is determined without merging outputs. The minimum distances and the identifications may be read either in parallel or serially. The apparatus is easily scalable by adding processors. The number of reference patterns may be easily increased without altering system configuration.

Apparatus for performing fast closest match in pattern recognition

A parallel pattern detection engine (PPDE) comprise multiple processing units (PUs) customized to do various modes of pattern recognition. The PUs are loaded with different patterns and the input data to be matched is provided to the PUs in parallel. Each pattern has an Opcode that defines what action to take when a particular data in the input data stream either matches or does not match the corresponding data being compared during a clock cycle. Each of the PUs communicate selected information so that PUs may be cascaded to enable longer patterns to be matched or to allow more patterns to be processed in parallel for a particular input data stream.

Parallel pattern detection engine

Method and apparatus for performing fast closest match in pattern recognition

A method and apparatus for finding a reference pattern (RP) with K elements imbedded in an input pattern IP with repeating substrings uses dual pointers to point to elements in the RP to compare with input elements sequentially clocked from the IP. The dual pointers are loaded with a pointer address corresponding to the first reference element in the RP and the pointer addresses are either incremented to the next position or are reset back to the address of the first reference element in response to results of comparing the reference element they access to the presently clocked input element and results of comparing their respective pointer addresses.

Method and apparatus for imbedded pattern recognition using dual alternating pointers

Processing units (PUs) are coupled with a gated bi-directional bus structure that allows the PUs to be cascaded. Each PUn has communication logic and function logic. Each PUn is physically coupled to two other PUs, a PUp and a PUf. The communication logic receives Link Out data from a PUp and sends Link In data to a PUf. The communication logic has register bits for enabling and disabling the data transmission. The communication logic couples the Link Out data from a PUp to the function logic and couples Link In data to the PUp from the function logic in response to the register bits. The function logic receives output data from the PUn and Link In data from the communication logic and forms Link Out data which is coupled to the PUf. The function logic couples Link In data from the PUf to the PUn and to the communication logic.

Configurable bi-directional bus for communicating between autonomous units

A method and apparatus for compressing a reference pattern (RP) with repeated substrings by encoding produce compressed reference patterns (CRPs) with reduce storage requirements. Operation codes and a flag are stored with the CRPs. During comparison of reference elements of the CRP to input elements (IEs) of an input pattern (IP), the operation codes are read and the reference pattern is decoded allowing all reference elements including those of the repeated substrings to be compared to IEs in the IP to determine if the RP appears within the IP.

Growing community of inventors

San Jose, CA, United States of America

Jan M Slyfield