Method and device for distributing patterns to scanning engines for scanning patterns in a packet stream

Abstract

A method and a device for distributing patterns to scanning engines for scanning packets in a packet stream are provided. The method includes providing a plurality of scanning engines and patterns, calculating a respective distance metric for every pair of patterns, and providing a plurality of distribution functions. Further, the method includes calculating a respective sum of the calculated distance metrics for distributing the patterns for each of the distribution functions, and utilizing the sums for selecting a distribution function of the D distribution functions for distributing the patterns to the M scanning engines. A device for implementing the method is also provided.

We claim: 
     
         1 . A computer implemented method for distributing patterns to scanning engines for scanning packets in a packet stream, the method comprising:
 providing a plurality of scanning engines;   providing a plurality of patterns, each pattern having a respective definite memory consumption when compiled onto a scanning engine;   calculating, using a computer device, a respective distance metric for every pair of patterns, wherein the respective distance metric represents a difference in memory consumption of two patterns of the pair when compiled between mutual compilation onto a single scanning engine and separate compilation onto two scanning engines;   providing a plurality of distribution functions, the respective distribution function mapping the patterns to the scanning engines;   calculating, for each of the distribution functions, a respective sum of a calculated distance metrics for distributing the patterns, the respective sum estimating the memory consumption for compiling the patterns to the scanning engines by accumulating the distance metrics of every pair of patterns being mapped to the same scanning engine for the respective distribution function; and   utilizing the sums for selecting a distribution function of the distribution functions for distributing the patterns to the scanning engines;   wherein a pattern is identified as an incompatible pattern in response to the pattern resulting in a respective memory consumption higher than a defined memory consumption threshold when compiled onto one scanning engine together with others of the patterns.   
     
     
         2 . The method of  claim 1 , further comprising the step of extracting the distribution functions of the distribution functions that fulfil constraints to provide a number of extracted distribution functions. 
     
     
         3 . The method of  claim 2 , further comprising the step of selecting the distribution function of the extracted distribution functions having a minimal calculated sum for distributing the patterns to the scanning engines. 
     
     
         4 . The method of  claim 1 , further comprising the step of identifying incompatible patterns within the plurality of provided patterns. 
     
     
         5 . The method of  claim 4 , wherein a pattern is identified as an incompatible pattern if it has a respective memory consumption higher than a defined memory consumption threshold when compiled onto one scanning engine. 
     
     
         6 . The method of  claim 4 , wherein identifying a pattern as an incompatible pattern comprises:
 calculating a sum value for the respective pattern by accumulating all distance metrics of the respective patterns to all other patterns;   calculating an average means value of the calculated sum values;   calculating a standard deviation value of the calculated sum values; and   identifying a respective pattern as an incompatible pattern in response to the calculated respective sum value being greater than a sum of the calculated average mean value and the calculated standard deviation value.   
     
     
         7 . The method of  claim 4 , further comprising:
 a pre-processing of a pattern for providing a pre-processed pattern is triggered by identifying the pattern as an incompatible pattern.   
     
     
         8 . The method of  claim 7 , wherein the pre-processing of the pattern includes rewriting the respective pattern as a semantically equivalent pattern. 
     
     
         9 . The method of  claim 8 , wherein the pre-processing of the respective pattern includes rewriting the respective pattern as a plurality of patterns, which together are semantically equivalent to the respective pattern. 
     
     
         10 . The method of  claim 4 , wherein a list of incompatible patterns is generated from the identified incompatible patterns wherein the provided patterns are automatically re-configured in dependence on the generated list of incompatible patterns. 
     
     
         11 . The method of  claim 4 , wherein:
 a list of incompatible patterns is generated from the identified incompatible patterns;   the generated list of incompatible patterns and configuration means are provided to a user; and   the user can re-configure the provided patterns by means of the configuration means and in dependence on the generated list of incompatible patterns.   
     
     
         12 . The method of  claim 1 , wherein a number of constraints and the respective constraint constraining the mapping of the patterns to the scanning engines may be are defined. 
     
     
         13 . The method of  claim 12 , wherein the constraints comprise:
 at least one first mapping condition, wherein the respective first mapping condition requires that a defined subset of the patterns is to be compiled onto one common scanning engine;   at least one second mapping condition, wherein the respective second mapping condition requires that a defined subset of the patterns is to be compiled onto different scanning engines; and   at least one third mapping condition, wherein the respective third mapping condition requires that at least two defined patterns of the patterns are to be compiled onto different groups of scanning engines.   
     
     
         14 . The method of  claim 12 , wherein the constraints comprise:
 at least one first mapping condition, wherein the respective first mapping condition requires that a defined subset of the patterns is to be compiled onto one common scanning engine;   at least one second mapping condition, wherein the respective second mapping condition requires that a defined subset of the patterns is to be compiled onto different scanning engines; and   at least one third mapping condition, wherein the respective third mapping condition requires that at least two defined patters of the patterns are to be compiled onto one common group of scanning engines;   
     
     
         15 . The method of  claim 12 , wherein the constraints comprise:
 at least one first mapping condition, wherein the respective first mapping condition requires that a defined subset of the patterns is to be compiled onto one common scanning engine;   at least one second mapping condition, wherein the respective second mapping condition requires that a defined subset of the patterns is to be compiled onto different scanning engines;   at least one third mapping condition, wherein the respective third mapping condition requires that at least two defined patters of the patterns are to be compiled onto one common group of scanning engines; and   at least one fourth mapping condition, the respective fourth mapping condition requiring that at least two defined patterns of the patterns are to be compiled onto different groups of scanning engines.   
     
     
         16 . The method of  claim 13 , wherein the patterns are provided in dependence on the constraints. 
     
     
         17 . A device for distributing patterns to scanning engines for scanning packets in a packet stream, the device comprising:
 a plurality of scanning engines;   a processor and memory with programming instructions configured to perform providing a plurality of patterns, each pattern having a respective definite memory consumption when compiled onto a scanning engine;   calculating, using a computer device, a respective distance metric for every pair of patterns, wherein the respective distance metric represents a difference in memory consumption of two patterns of the pair when compiled between mutual compilation onto a single scanning engine and separate compilation onto two scanning engines;   providing a plurality of distribution functions, the respective distribution function mapping the patterns to the scanning engines;   calculating, for each of the distribution functions, a respective sum of a calculated distance metrics for distributing the patterns, the respective sum estimating the memory consumption for compiling the patterns to the scanning engines by accumulating the distance metrics of every pair of patterns being mapped to the same scanning engine for the respective distribution function; and   utilizing the sums for selecting a distribution function of the distribution functions for distributing the patterns to the scanning engines;   wherein a pattern is identified as an incompatible pattern in response to the pattern resulting in a respective memory consumption higher than a defined memory consumption threshold when compiled onto one scanning engine together with others of the patterns.   
     
     
         18 . The device of  claim 17 , further comprising the step of extracting the distribution functions of the distribution functions that fulfil constraints to provide a number of extracted distribution functions. 
     
     
         19 . The device of  claim 18 , further comprising the step of selecting the distribution function of the extracted distribution functions having a minimal calculated sum for distributing the patterns to the scanning engines. 
     
     
         20 . A non-transitory computer readable storage medium for distributing patterns to scanning engines for scanning packets in a packet stream, the computer readable storage medium comprising instructions configured to perform a method comprising:
 providing a plurality of scanning engines;   providing a plurality of patterns, each pattern having a respective definite memory consumption when compiled onto a scanning engine;   calculating, using a computer device, a respective distance metric for every pair of patterns, wherein the respective distance metric represents a difference in memory consumption of two patterns of the pair when compiled between mutual compilation onto a single scanning engine and separate compilation onto two scanning engines;   providing a plurality of distribution functions, the respective distribution function mapping the patterns to the scanning engines;   calculating, for each of the distribution functions, a respective sum of a calculated distance metrics for distributing the patterns, the respective sum estimating the memory consumption for compiling the patterns to the scanning engines by accumulating the distance metrics of every pair of patterns being mapped to the same scanning engine for the respective distribution function; and   utilizing the sums for selecting a distribution function of the distribution functions for distributing the patterns to the scanning engines;   wherein a pattern is identified as an incompatible pattern in response to the pattern resulting in a respective memory consumption higher than a defined memory consumption threshold when compiled onto one scanning engine together with others of the patterns.