Memory reduction by intermediate result value encoding for content-based classification

Abstract

A method for content-based classification using results from a string search and a layer 3-4 lookup is proposed. Encoding of the intermediate result value enables wire-speed processing while reducing the memory by over 70% compared to the dependent search scheme. Rule partitioning by range types helps to encode ranges within a minute for an intrusion-detection rule set having about 1000 rules.