The present invention provides a method and apparatus for searching
multiple strings within a packet data using deterministic finite
automata. The apparatus includes means for updating memory tables stored
in a layered memory architecture comprising a BRAM, an SRAM and a DRAM; a
mechanism to strategically store the relevant data structure in the three
memories based on the characteristics of data, size/capacity of the data
structure, and frequency of access. The apparatus intelligently and
efficiently places the associated data in different memories based on the
observed fact that density of most rule-sets is around 10% for common
data in typical network intrusion prevention systems. The methodology and
layered memory architecture enable the apparatus implementing the present
invention to achieve data processing line rates over 2 Gbps.