Flexible Deterministic Finite Automata (DFA) Tokenizer for AI-Based Malicious Traffic Detection

ChangeBridge: Patent Grants - Networking (H04L)

Published March 31st, 2026

Detected March 31st, 2026

Summary

The USPTO granted Intel Corporation Patent US12592958B2 for a flexible DFA tokenizer system that enables AI-based malicious traffic detection. The system uses deterministic finite automata to convert input strings into token sequences, extracts features, and classifies network traffic as benign or malicious using machine learning models. The patent includes 20 claims and names 8 inventors.

View original document View source feed page

What changed

The USPTO granted Intel Corporation Patent US12592958B2 on March 31, 2026, covering a flexible DFA tokenizer for AI-based malicious traffic detection. The patent describes methods where a DFA compiler processes SQLi, HTML5, XSS, and user-defined profiles to generate DFA transition tables. The DFA engine tokenizes input strings from network traffic into sequences, which are converted to feature vectors for training a machine learning binary classification model. The technology enables real-time classification of network input as benign or malicious.

Patent grants do not impose compliance obligations on regulated entities. Technology companies developing network security, intrusion detection, or AI-based traffic analysis solutions should review the patent claims to understand potential intellectual property considerations. The patent claims priority to Application No. 17744463 filed May 13, 2022.

Source document (simplified)

← USPTO Patent Grants

Flexible deterministic finite automata (DFA) tokenizer for AI-based malicious traffic detection

Grant US12592958B2 Kind: B2 Mar 31, 2026

Assignee

Intel Corporation

Inventors

Kun Qiu, Hao Chang, Ying Wang, Wenjun Zhu, Xiahui Yu, Yingqi Liu, Baoqian Li, Weigang Li

Abstract

Methods and apparatus for a flexible Deterministic Finite Automata (DFA) tokenizer for AI-based malicious traffic detection. A DFA compiler is used to process profiles, such as SQLi, HTML5 and XSS profiles, as well as user-defined profiles, to generate corresponding DFA transition tables. The DFA tokenizer includes a DFA engine that employs the DFA transition table(s) to generate token sequences derived from input strings. The token sequences are converted into feature vectors using a feature extraction engine, and the feature vectors are used for training a machine learning/Artificial Intelligence (AI) model configured to perform binary classification (benign or malicious). During run-time, strings are extracted from input received via a network and tokenized with the DFA tokenizer to generate token sequences that are converted into feature vectors. The feature vectors are then classified using the AI model to determine whether the input is benign or malicious.