Importance

Loading Importance Indicators...

Abstract

An apparatus and method is described that allows for improved correlation of multiple signatures from an input datastream, reducing the complexity and memory size of the correlation operation by utilization of a multiple sequence indexing correlator. The multiple sequence indexing correlator keeps an index into each signature that indicates how many elements have been matched so that only the remaining portion of each signature must be compared to the input data stream. Because of this, no history of the input datastream is kept and only a small portion of each signature is compared at one time. Additionally, the multiple sequence indexing correlator allows for ease of signature modification or addition, pre-execution of functions, signatures with identical substrings but differing lengths to be detected, wild card signature elements, timeouts to determine signature end, null functions, execution hold off for extended signatures, and keystroke detection.

Loading the Abstract Image...

First Claim