1. A method comprising: receiving, by a first stage of a context-aware hardware accelerator of a network security device, a packet stream; identifying, by the first stage, a plurality of candidate packets within the packet stream that each satisfy one or more pre-match conditions relating to a set of access control rules by performing a pre-matching process on packets within the packet stream; emitting, by the first stage, information indicative of a candidate rule from the set of access control rules for which a full-match process is to be performed with respect to a candidate packet of the plurality of candidate packets selected based on a correlation of results of the pre-matching process; tokenizing, by the first stage, packet data of the candidate packet to produce matching tokens and corresponding locations of the matching tokens within the candidate packet; determining, by a second stage of the context-aware hardware accelerator, whether the candidate packet satisfies the candidate rule by performing the full-match process on the candidate packet including fetching and executing special purpose pattern matching instructions with reference to the candidate packet based on a plurality of predefined conditions associated with the candidate rule, corresponding contextual information provided by the candidate rule, the matching tokens and the corresponding locations; and providing, by the second stage, results of the full-match process to a general purpose processor of the network security device.
1. A method comprising: receiving, by a first stage of a context-aware hardware accelerator of a network security device, a packet stream; identifying, by the first stage, a plurality of candidate packets within the packet stream that each satisfy one or more pre-match conditions relating to a set of access control rules by performing a pre-matching process on packets within the packet stream; emitting, by the first stage, information indicative of a candidate rule from the set of access control rules for which a full-match process is to be performed with respect to a candidate packet of the plurality of candidate packets selected based on a correlation of results of the pre-matching process; tokenizing, by the first stage, packet data of the candidate packet to produce matching tokens and corresponding locations of the matching tokens within the candidate packet; determining, by a second stage of the context-aware hardware accelerator, whether the candidate packet satisfies the candidate rule by performing the full-match process on the candidate packet including fetching and executing special purpose pattern matching instructions with reference to the candidate packet based on a plurality of predefined conditions associated with the candidate rule, corresponding contextual information provided by the candidate rule, the matching tokens and the corresponding locations; and providing, by the second stage, results of the full-match process to a general purpose processor of the network security device. 4. The method of claim 1 , wherein said identifying, by the first stage, a plurality of candidate packets within the packet stream that each satisfy one or more pre-match conditions relating to a set of access control rules comprises performing string matching and overflow pattern matching on the packets to identify the plurality of candidate packets, wherein the plurality of candidate packets match one or more strings or over-flow patterns associated with the set of access control rules.