Patent attributes
Systems and methods for high performance IDS/IPS with efficient metadata filtering are provided. According to one embodiment, a signature database of an IDS/IPS is configured with multiple metadata signatures. A pre-match engine identifies a candidate packet of network traffic received by the IDS/IPS for full-feature match processing by: (i) categorizing the metadata signatures based on characteristics thereof; and (ii) processing and filtering a first set of the metadata signatures that forms part of a hash key based metadata signature category. The hash key based metadata signature category represents a category resulting from the categorization and each of the first set of metadata signatures is associated with a fixed unique hash key based on which respective metadata signatures are matched with the received network traffic to identify the candidate packet. Finally, a potential intrusion is identified by performing the full-feature match processing on the candidate packet based on full-feature match signatures.
