ernal details of these algorithms here. Several research groups also maintain web sites where these algorithms are explained online through tutorials. 26,27 Their behavior can be visualized with custom-made simulation applets or tools. Some string classification systems are based on a brute-force approach that tries all possible posi- tions for a pattern before it can make a decision. This idea may work well with simple patterns when parsing a string, but it is not conducive to high performance for more complex tasks. Some other clas- sification systems may be using much more complex and powerful algorithms such as the Boyer- Moore or even the Aho-Corasick, which work better with multiple string patterns. Boyer-Moore, for example, has the interesting, albeit bizarre, characteristic that it performs better when the pattern to be searched becomes longer.2 28 In addition, an algorithm such as Aho-Corasick may have to preprocess many patterns in which case it usually builds a state graph that can be used to simultaneously check multiple rules. This approach lends itself easily to hardware implementations using PSMs with the policies stored in com- modity-priced synchronous static random access memory (SSRAM). From a performance standpoint, this definitely beats the CAM approach. The downside is the setup time of policy rules in the exter- nal memory. Other types of algorithms may be more suitable for other aspects of layer 7 classification, such as suffix automaton or deterministic context-dependent parsers (as used in some advanced spam filters). Other types such as probabilistic Hidden Markov-Model (HMM)-based algorithms may also be used for something completely different such as making parsing decisions in a law-enforcement context on a subset of a collection of text-based intercepted files based on other pertinent but ancillary infor- mation, which may not necessarily be applicable to the entire collection of files under inspection. This subject is very broad and extremely dynamic, but it lies mostly outside the 