10. The method of claim 1 , wherein said performing, by the first stage, a pre-matching process further comprises performing active matching of overflow patterns that occur between at least two characters within packet data of the packets within the packet stream.
1. A method comprising: receiving, by a first stage of a context-aware hardware accelerator of a network security device, a packet stream; identifying, by the first stage, a plurality of candidate packets within the packet stream that each satisfy one or more pre-match conditions relating to a set of access control rules by performing a pre-matching process on packets within the packet stream; emitting, by the first stage, information indicative of a candidate rule from the set of access control rules for which a full-match process is to be performed with respect to a candidate packet of the plurality of candidate packets selected based on a correlation of results of the pre-matching process; tokenizing, by the first stage, packet data of the candidate packet to produce matching tokens and corresponding locations of the matching tokens within the candidate packet; determining, by a second stage of the context-aware hardware accelerator, whether the candidate packet satisfies the candidate rule by performing the full-match process on the candidate packet including fetching and executing special purpose pattern matching instructions with reference to the candidate packet based on a plurality of predefined conditions associated with the candidate rule, corresponding contextual information provided by the candidate rule, the matching tokens and the corresponding locations; and providing, by the second stage, results of the full-match process to a general purpose processor of the network security device.