Netlogic Microsystems, Inc

Redberry Systems, Inc.

Broadcom Corporation

Quality Semiconductor Inc.

Other

Varadarajan Srinivasan

Sandeep Khanna

Bindiganavale S Nataraj

Jose Pio Pereira

Maheshwaran Srinivasan

Madhavan Bakthavatchalam

Sachin Joshi

Mark Birman

Chetan Deshpande

Michael E Ichiriu

Rupesh Ranen Roy

Nilesh A Gharia

Hok F Wong

Greg Watson

Carl Gyllenhammer

Venkat Gaddam

Dimitri Argyres

Alexei Starovoitov

Venkat Rajendher Reddy Gaddam

Charles C Huse

Ramagopal R Madamala

Ketan K Mehta

Sanjay V Gala

William G Nurge

De Cai Li

Ruchir P Shah

This disclosure provides systems, methods and apparatuses for classifying traffic flow using a plurality of learning machines arranged in multiple hierarchical levels. A first learning machine may classify a first portion of the input stream as malicious based on a match with first classification rules, and a second learning machine may classify at least part of the first portion of the input stream as malicious based on a match with second classification rules. The at least part of the first portion of the input stream may be classified as malicious based on the matches in the first and second learning machines.

Network traffic classification system

Upon receiving malware detection rules that are to be identified with respect to an input traffic stream, a rule database that requires less storage capacity than the malware detection rules is generated by substituting tokens for selected symbol strings within the malware detection rules. A compressed traffic stream is generated by substituting the tokens for instances of the selected symbol strings within the input traffic stream, and then compared with the rule database to determine whether the input traffic stream contains one or more symbol sequences that correspond to any of the malware detection rules.

Real-time malware detection

In a malware detection device, first characters in a network traffic flow are compared with a plurality of entries within a ternary content addressable memory (TCAM), the plurality of entries including a first entry that constitutes a first segment of a malware signature. In response to an output from the first TCAM indicating that the first characters match the first entry, a variable-character expression engine determines whether second characters in the network traffic flow match a first variable-length regular expression, the variable-length regular expression corresponding to a second segment of the malware signature. A comparand value is generated that includes third characters in the network traffic flow and an expression-match value that indicates whether the second characters match the first variable-length regular expression. The TCAM compares the first comparand value with the plurality of entries therein as part of a determination whether the network traffic flow contains the malware signature.

Real-time regular expression search engine

Upon receiving malware detection rules that are to be identified with respect to an input traffic stream, a sequence of state definitions are generated for each of the rules. The state definitions for each rule correspond to respective segments of the rule and specify conditions under which a state machine is to transition between search states corresponding to those segments, at least one of the segments corresponding to multiple characters within the input traffic stream. A state machine transitions between search states corresponding to one or more of the rules in accordance with contents of the input traffic stream and the conditions specified by the sequence of state definitions.

A content addressable memory (CAM) device can include a plurality of CAM cells each formed within a cell area of a substrate. Each cell area can have a cell length dimension in a first direction parallel to a substrate surface. The CAM device can also include at least one common line comprising a contiguous region of the substrate doped to a first conductivity type and formed in a base semiconductor region doped to a second conductivity type. The common line can extend in the first direction for more than one cell length and can be commonly coupled to non-power supply connections to the plurality of CAM cells.

Content addressable memory (CAM) device having substrate array line structure

A CAM device including a CAM array, multiple match resolution (MMR) circuitry, and a priority encoder allows the addresses of multiple matching locations resulting from a first search operation to be generated without losing the match results generated in second search operation initiated prior to detection of the multiple match condition for the first search operation. When the multiple match condition is detected, the MMR circuitry asserts a stall signal that stalls search operations in the CAM array. The asserted stall signal also causes the match results of the first and second search operations to be stored in separate memory elements so that the addresses of all matching locations for the first search operation can be generated without disturbing the match results of the second search operation.

Multiple match detection for multiple flows in a content addressable memory

A CAM device includes a CAM array that can implement column redundancy in which a defective column segment in a selected block can be functionally replaced by a selected column segment of the same block, and/or by a spare column segment of the same block.

Content addressable memory having column segment redundancy

A content addressable memory (CAM) device having any number of rows, each of the rows including a match line connected to a plurality of CAM cells, a match line detector circuit, and an incremental match line charge circuit. The detector circuit generates a feedback signal based on a detected match line voltage. The charge circuit partially pre-charges the match line to an intermediate voltage during a pre-charge phase of a compare operation, and then selectively charges the match line higher towards a supply voltage in response to the feedback signal.

Incremental adaptive match line charging with calibration

Growing community of inventors

Los Altos Hills, CA, United States of America

Varadarajan Srinivasan