Methods, systems and computer program products are disclosed for detecting patterns in a data stream that match multi-pattern rules. One embodiment of the invention provides a method of recognizing a specified group of patterns in a data stream. The method comprises identifying a rule for said specified group of patterns in the data stream, and using a first array of finite state machines to scan the data stream for at least some of the patterns in the specified group. For patterns in the specified group that are found in the data stream by the first array of finite state machines, pattern identifiers are sent to a second array of finite state machines. The second array of finite state machines determines if the specified group of patterns is in the data stream in accordance with the identified rule by, at least in part, using said pattern identifiers.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method of recognizing specified groups of patterns in a data stream, the method comprising: identifying a multi-pattern rule for each group of said specified groups of patterns; using a first array of finite state machines, in a first, pattern scanner stage, to scan the data stream for at least some of the patterns in the specified groups, including splitting at least a first pattern of the specified groups of patterns into a plurality of subpatterns, using the first array of finite state machines to scan the data stream for the subpatterns of said first pattern, and using a second array of finite state machines to check if the supatterns are found in the data stream in a specified order; for each of the patterns in the specified groups of patterns that are found in the data stream by the first array of finite state machines, sending a pattern identifier identifying said each pattern to the second array of finite state machines, in a second, rule processor stage; and using the second array of finite state machines for determining if any of the specified groups of patterns is in the data stream in accordance with the identified multi-pattern rule. 2. The method according to claim 1, wherein the using a second array of finite state machines to check if the subpatterns are found in the data stream in a specified order includes using the second array of finite state machines to check if the subpatterns are found in the data stream in an order corresponding to a given original pattern. 3. The method according to claim 1, wherein the using a second array of finite state machines to check if the subpatterns are found in the data stream in a specified order includes using the second array of finite state machines to check if the subpatterns are found at adjacent locations in the data stream. 4. The method according to claim 1, wherein the using the second array of finite state machines for determining if any of the specified groups of patterns is in the data stream in accordance with the identified multi-pattern rule includes: running a multitude of threads on the second array of finite state machines, each of the threads having a thread ID identifying said each thread, and using said multitude of threads to determine whether any of the of specified groups of patterns is in the data stream. 5. The method according to claim 4, wherein: the sending a pattern identifier identifying said each pattern includes including in said pattern identifier one of the thread IDs identifying one of said threads; and the using said multitude of threads includes using said identified one of the threads to determine if said each pattern is part of one of the specified groups of patterns. 6. The method according to claim 5, wherein the using said multitude of threads includes using each of the threads to determine if a respective one of the specified groups of patterns is in the data stream. 7. The method according to claim 6, wherein the including in said pattern identifier one of the thread IDS, includes including in said pattern identifier a plurality of the thread IDs. 8. The method according to claim 7, wherein the sending the pattern identifier identifying said each pattern to a second array of finite state machines includes sending said each pattern to all the threads identified by the thread identifiers included in said pattern identifier. 9. The method according to claim 8, wherein the sending the pattern identifier identifying said each pattern to a second array of finite state machines further includes sending said each pattern to only the threads identified by the thread identifiers included in said pattern identifier. 10. The method according to claim 9, wherein the sending a pattern identifier identifying said each pattern to a second array of finite state machines includes sending said each pattern to the thread identified by the thread identifier included in said pattern identifier. 11. A finite state machine engine for recognizing specified groups of patterns in a data stream, wherein at least a first pattern of the specified groups of patterns is comprised of a plurality of subpatterns, the first state machine engine comprising: a rule memory holding a multitude of multi-pattern rules for identifying each group of said specified groups of patterns; a first array of finite state machines to scan the data stream, in a first, pattern scanner stage, for at least some of the patterns in the specified groups, including scanning the data stream for the subpatterns of said first pattern; and a second array of finite state machines for checking if the subpatterns of the first pattern are found in the data stream in a specified order, and for determining, in a second, rule processor stage, if any of the specified groups of patterns is in the data stream in accordance with the identified multi-pattern rule; and wherein: for each of the patterns in the specified groups of patterns that are found in the data stream, the first array of finite state machines sends a pattern identifier identifying said each pattern to the second array of finite state machines. 12. The finite state machine engine according to claim 11, wherein the second array of finite state machines checks if the subpatterns are found in the data stream in an order corresponding to a given original pattern. 13. The finite state machine engine according to claim 11, wherein the second array of finite state machines check if the subpatterns are found at adjacent locations in the data stream. 14. The finite state machine engine according to claim 11, wherein the determining if any of the specified groups of patterns is in the data stream in accordance with the identified multipattern rule includes running a multitude of threads on the second array of finite state machines, each of the threads having a thread ID identifying said each thread, and using said multitude of threads to determine whether any of the of specified groups of patterns is in the data stream. 15. The finite state machine engine according to claim 11, wherein: the pattern identifier identifying said each pattern includes one of the thread IDs identifying one of said threads; and the second array of finite state machines uses said identified one of the threads to determine if said each pattern is part of one of the specified groups of patterns. 16. An article of manufacture comprising: at least one computer usable hardware medium having computer readable program code logic to execute a machine instruction in a processing unit for using a computer for recognizing specified groups of patterns in a data stream in accordance with defined multi-pattern rules, said computer readable program code logic, when executing, performing the following: using a first array of finite state machines, in a first, pattern scanner stage, to scan the data stream for at least some of the patterns in the specified groups, including splitting at least a first pattern of the specified groups of patterns into a plurality of subpatterns, using the first array of finite state machines to scan the data stream for the subpatterns of said first pattern, and using a second array of finite state machines to check if the supatterns are found in the data stream in a specified order; for each of the patterns in the specified groups of patterns that are found in the data stream by the first array of finite state machines, sending a pattern identifier identifying said each pattern to the second array of finite state machines, in a second, rule processor stage; and using the second array of finite state machines for determining if any of the specified groups of patterns is in the data stream in accordance with the identified multi-pattern rule. 17. The article of manufacture according to claim 16, wherein the using a second array of finite state machines to check if the subpatterns are found in the data stream in a specified order includes using the second array of finite state machines to check if the subpatterns are found in the data stream in an order corresponding to a given original pattern. 18. The article of manufacture according to claim 16, wherein the using a second array of finite state machines to check if the subpatterns are found in the data stream in a specified order includes using the second array of finite state machines to check if the subpatterns are found at adjacent locations in the data stream. 19. The article of manufacture according to claim 16, wherein the using the second array of finite state machines for determining if any of the specified groups of patterns is in the data stream in accordance with the identified multi-pattern rule includes: running a multitude of threads on the second array of finite state machines, each of the threads having a thread ID identifying said each thread, and using said multitude of threads to determine whether any of the of specified groups of patterns is in the data stream. 20. The article of manufacture according to claim 19, wherein: the sending a pattern identifier identifying said each pattern includes including in said pattern identifier one of the thread IDs identifying one of said threads; and the using said multitude of threads includes using said identified one of the threads to determine if said each pattern is part of one of the specified groups of patterns.