Apparatus and Methods for Processing Filter Rules

• US 20070039044A1
• Filed: 08/11/2005
• Published: 02/15/2007
• Est. Priority Date: 08/11/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Moonen, Scott
• Granted Patent: US 8,407,778 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

Techniques for processing filter rules are disclosed. To this end, filter rules having one or more attributes where each attribute indicates a condition to qualify whether a filter rule applies to a subsequent event are received. Summary rules are generated where each summary rule has a number of summary conditions. Some filter rules become associated with the generated summary rules. The summary conditions are extended to span the attributes of the associated filter rules.

Claims

1. A method for processing filter rules comprising:

receiving a plurality of filter rules having one or more attributes, each attribute having a value indicating a condition to qualify whether a filter rule applies to an event;

generating a plurality of summary rules, each summary rule having a plurality of summary conditions;

associating a first portion of the plurality of filter rules to a first one of the plurality of summary rules; and

extending the plurality of summary conditions of the first one of the plurality of summary rules to span the attributes of the first portion of the plurality of filter rules.

2. The method of claim 1 wherein the first portion of the plurality of filter rules have a directional attribute, wherein the associating step further comprises:

normalizing the directional attribute.

3. The method of claim 1 wherein the associating step further comprises:

determining whether said first portion of the plurality of filter rules are within a scope of the first one of the plurality of summary rules.

4. The method of claim 3 wherein each received filter rule is expressed in simple form, wherein a common attribute of said first portion of the plurality of filter rules defines the scope of the first one of the plurality of summary rules.

5. The method of claim 3 wherein a calculated distance metric between attributes of a filter rule and attributes of the first one of the plurality of summary rules defines the scope of the first one of the plurality of summary rules.

6. The method of claim 3 wherein a threshold valued based on substantially equal distribution of filter rules across the plurality of summary rules defines the scope of the first one of the plurality of summary rules.

7. The method of claim 1 further comprising:

receiving an event having attributes;

determining whether attributes of the event meet the corresponding summary conditions of the first one of the plurality of summary rules; and

determining whether attributes of the event meet the summary conditions of a second one of the plurality of summary rules, if the attributes of the event do not meet the summary conditions the first one of the plurality of summary rules.

8. The method of claim 7 wherein the event is a packet.

9. An apparatus for processing filter rules comprising:

a memory comprising;

computer code;

a summary structure having a plurality of associated summary rules, each associated summary rule having a plurality of summary conditions and a plurality of filter rules having corresponding attributes;

each summary condition being at least a union of the corresponding attributes of the plurality of filter rules; and

a processor for executing computer code which, when executed, perform the steps of receiving the plurality of filter rules,

generating the summary structure,

associating a first portion of the plurality of filter rules to a first one of the plurality of associated summary rules, and

extending the plurality of summary conditions of a summary rule to span the attributes of the first portion of the plurality of filter rules.

10. The apparatus of claim 9 wherein the plurality of filter rules are received in order from a most restrictive filter rule to a least restrictive filter rule.

11. The apparatus of claim 9 wherein the associating step further comprises:

determining whether said first portion of the plurality of filter rules are within a scope of the first one of the plurality of summary rules.

12. The apparatus of claim 11 wherein each received filter rule is expressed in simple form, wherein a common attribute of said first portion of the plurality of filter rules defines the scope of the first one of the plurality of summary rules.

13. The apparatus of claim 11 wherein a calculated distance metric between attributes of a filter rule and attributes of the first one of the plurality of summary rules defines the scope of the first one of the plurality of summary rules.

14. A computer-readable medium whose contents cause a computer system to perform filter rule processing by performing the steps of:

receiving a plurality of filter rules having one or more attributes, each attribute having a value indicating a condition to qualify whether a filter rule applies to an event;

generating a plurality of summary rules, each summary rule having a plurality of summary conditions;

associating a first portion of the plurality of filter rules to a first one of the plurality of summary rules; and

extending the plurality of summary conditions of the first one of the plurality of summary rules to span the attributes of the first portion of the plurality of filter rules.

15. The computer-readable medium of claim 14 wherein the first portion of the plurality of filter rules have a directional attribute, wherein the associating step further comprises:

normalizing the directional attribute.

16. The computer-readable medium of claim 14 wherein the associating step further comprises:

determining whether said first portion of the plurality of filter rules are within a scope of the first one of the plurality of summary rules.

17. The computer-readable medium of claim 16 wherein each received filter rule is expressed in simple form, wherein a common attribute of said first portion of the plurality of filter rules defines the scope of the first one of the plurality of summary rules.

18. The computer-readable medium of claim 16 wherein a calculated distance metric between attributes of a filter rule and attributes of the first one of the plurality of summary rules defines the scope of the first one of the plurality of summary rules.

19. The computer-readable medium of claim 16 wherein a threshold valued based on substantially equal distribution of filter rules across the plurality of summary rules defines the scope of the first one of the plurality of summary rules.

20. The computer-readable medium of claim 14 further comprising:

receiving an event having attributes;

determining whether attributes of the event meet the corresponding summary conditions of the first one of the plurality of summary rules; and

determining whether attributes of the event meet the summary conditions of a second one of the plurality of summary rules, if the attributes of the event do not meet the summary conditions the first one of the plurality of summary rules.