Pattern recognition in data communications using predictive parsers

摘要

Data communication packets are processed to determined whether they match network protocols using a parser table and a predictive parser. The parser table is encoded from production rules derived from a network protocol definition. Packets comprise data elements each having an offset from the beginning of the packet and a data value. The parser table is indexed by these offsets and data values, each location in the table containing a value indicating whether a data element at the offset and having the data value is a valid element for the network protocol definition. Once encoded, the parser table is used with the predictive parser which receives data elements of a data packet from a network source. The predictive parser uses the offset and data value of each data element to obtain the encoded value in the parser table. The predictive parser updates a parser stack according to the value from the parser table and the current value of the parser stack. The parser table indicates which offset, value pairs are associated with the end of the data packet or other portion of interest. When the end is reached, the parser stack indicates whether the data packet matched the network protocol definition.