On-the fly pattern recognition with configurable bounds

摘要

Some embodiments of on-the-fly pattern recognition with configurable bounds have been presented. In one embodiment, a pattern matching engine is configured based on user input, which may include values of one or more user configurable bounds on searching. Then the configured pattern matching engine is used to search for a set of features in an incoming string. A set of scores is updated based on the presence of any of the features in the string while searching for the features. Each score may indicate a likelihood of the content of the string being in a category. The search is terminated if the end of the string is reached or if the user configurable bounds are met. After terminating the search, the scores are output.

主权项

1. A model-based content classification system for use in a firewall, comprising:
a user interface that receives from a user one or more user-configurable bounds on searching content; a pattern matching engine that receives the one or more user-configurable bounds from the user interface, wherein the pattern matching engine is stored in a memory associated with the firewall and wherein execution of the pattern matching engine by a processor associated with the firewall:
searches a string having known content, for a predetermined pattern, the search limited according to the received user-configurable bounds,computes a plurality of scores indicating a likelihood that the content of the string corresponds to one or more predetermined content categories, andupdates the scores using a plurality of weights associated with the predetermined pattern in response to detecting the predetermined pattern; a content classification model generator that receives the updated scores from the pattern matching engine, wherein the content classification model generator is stored in the memory associated with the firewall and wherein execution of the content classification model generator by the processor associated with the firewall:
generates a content classification model based on the updated scores, andtransmits the content classification model to a model repository stored in memory; a network interface of the firewall that receives subsequent content over a network connection, the subsequent content directed to a client computer that is communicatively coupled to the firewall; a content classification engine stored in the memory associated with the firewall, wherein execution of the content classification engine by the processor associated with the firewall:
accesses the content classification model stored in the model repository, andclassifies the subsequent content based on the content classification model; a content filter stored in the memory associated with the firewall, wherein execution of the content filter by the processor associated with the firewall transmits at least a subset of the subsequent content to the client computer, the subset selected based on the classification of the subsequent content.