SCANNING DATA STREAMS IN REAL-TIME AGAINST LARGE PATTERN COLLECTIONS

Embodiments of the disclosure include a method for partitioning a deterministic finite automaton (DFA) into a plurality of groups. The method includes selecting, with a processing device, a subset of the plurality of states and mapping each state of the subset onto a group of the plurality of groups by assigning one or more transition rules associated with each state to a rule line of the group, wherein each rule line is assigned at most two transition rules and an extended address associated with one of the at most two transition rules. The method also includes iteratively processing each state of the subset mapped onto the group by removing the extended address from each rule line in the group with transition rules referring to a current state if the transition rules in the rule line branch within the group.