System, method, and computer program product for analyzing and decomposing a plurality of rules into a plurality of contexts

• US 8,868,563 B2
• Filed: 05/09/2011
• Issued: 10/21/2014
• Est. Priority Date: 01/07/2008
• Status: Expired due to Fees

• Current Assignee: Amdocs Development Limited (Amdocs Ltd.), Amdocs Software Systems Limited (Amdocs Ltd.)
• Original Assignee: Amdocs Software Systems Limited (Amdocs Ltd.)
• Inventors: Kariv, Adi
• Primary Examiner(s): Pulliam, Christyann
• Assistant Examiner(s): HOLLAND, SHERYL L
• Application Number:
  US13/103,981
• Publication Number:
  US 20110231412A1
• Time in Patent Office: 1,261 Days
• Field of Search: 707/999.101, 707/708, 707/740, 707/754
• US Class Current: 707/740
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

A system, method, and computer program product are provided for analyzing a plurality of rules in a textual rules structure. Further, the plurality of rules are decomposed into a plurality of contexts, based on the analysis. In addition, the plurality of contexts are stored in a table. Furthermore, a database associated with a device and/or any robot equipped with an operating system may be utilized.

Claims

1. A method, comprising:

analyzing a plurality of rules in a textual rules structure;

decomposing the plurality of rules into a plurality of contexts, based on the analysis, each of the plurality of contexts being identified as a heavy context or a light context based on a predetermined number of distinct occurrences of data in a data stream, and the light context being predetermined to have a fewer number of distinct occurrences in the data than a number of distinct occurrences included in the heavy context;

storing the plurality of contexts into a table;

processing the table by, for each context stored into the table;

determining whether the context is associated with a value or is associated with a plurality of values, and

when it is determined that the context is associated with a plurality of values, serializing the plurality of values into a value associated with the context;

generating a plurality of concatenated values, each concatenated value comprising one of the values associated with a context of the plurality of contexts joined with another one of the values associated with at least one other context of the plurality of contexts; and

storing the plurality of concatenated values in a plurality of filtering tables, the plurality of filtering tables including a light context filtering table storing at least one concatenated value representing a combination of light contexts, a heavy context filtering table storing at least one concatenated value representing a combination of heavy contexts, a heavy and light context filtering table storing at least one concatenated value representing a combination of at least one heavy context and at least one light context, and a not looping filtering table storing at least one negative context that is utilized for negatively filtering values.

2. The method of claim 1, wherein the textual rules structure includes a rules file.

3. The method of claim 2, wherein the rules file is application specific.

4. The method of claim 3, wherein the application specific rules file is analyzed by an interpreting module.

5. The method of claim 1, wherein each context in the plurality of contexts includes at least one value capable of being utilized for filtering.

6. The method of claim 1, wherein each context includes one of a source address, a source port, a source type, a destination address, a destination port, a destination type, a protocol, a service, a reason, a product, message information, an originating number, a destination number, a time, a date, a timestamp, a duration, a flag, a condition, a session record, and an attack.

7. The method of claim 1, further comprising determining if the plurality of contexts includes at least one duplicate context.

8. The method of claim 7, further comprising removing the at least one duplicate context from the plurality of contexts prior to the storing of the plurality of contexts, if it is determined that the plurality of contexts includes the at least one duplicate context.

9. The method of claim 1, further comprising identifying a corresponding table identifier associated with one of the plurality of contexts.

10. The method of claim 9, wherein the corresponding table identifier is stored in the table with the one of the plurality of contexts.

11. The method of claim 1, wherein the plurality of concatenated values are hashed.

12. The method of claim 1, wherein the plurality of filtering tables include a corresponding table identifier associated with the context of the plurality of contexts.

13. The method of claim 1, further comprising storing each of the plurality of rules in a rules table.

14. The method of claim 13, wherein each of the plurality of rules is associated with at least one of the plurality of contexts stored in the table.

15. The method of claim 1, wherein the analyzing of the plurality of rules includes reading the textual rules structure, determining a format of the textual rules structure, and examining the textual rules structure, and the analyzing of the textual rules structure determines how to decompose the plurality of rules into the plurality of contexts.

16. The method of claim 1, wherein for each context stored in the table associated with a plurality of values the serializing includes separating the plurality of values associated with the context into a series of single values associated with the context, wherein the table storing the plurality of contexts includes a header, and wherein serialization of the table arms a linker field in the header of the table.

17. A computer program product embodied on a non-transitory computer readable medium, comprising:

computer code for analyzing a plurality of rules in a textual rules structure;

computer code for decomposing the plurality of rules into a plurality of contexts, based on the analysis, each of the plurality of contexts being identified as a heavy context or a light context based on a predetermined number of distinct occurrences of data in a data stream, and the light context being predetermined to have a fewer number of distinct occurrences in the data than a number of distinct occurrences included in the heavy context;

computer code for storing the plurality of contexts in a table;

computer code for processing the table by, for each context stored into the table;

determining whether the context is associated with a value or is associated with a plurality of values, and

when it is determined that the context is associated with a plurality of values, serializing the plurality of values into a value associated with the context;

computer code for generating a plurality of concatenated values, each concatenated value comprising one of the values associated with a context of the plurality of contexts joined with another one of the values associated with at least one other context of the plurality of contexts; and

computer code for storing the plurality of concatenated values in a plurality of filtering tables, the plurality of filtering tables including a light context filtering table storing at least one concatenated value representing a combination of light contexts, a heavy context filtering table storing at least one concatenated value representing a combination of heavy contexts, a heavy and light context filtering table storing at least one concatenated value representing a combination of at least one heavy context and at least one light context, and a not looping filtering table storing at least one negative context that is utilized for negatively filtering values.

18. A system, comprising:

a processor for;

analyzing a plurality of rules in a textual rules structure,

decomposing the plurality of rules into a plurality of contexts, based on the analysis, each of the plurality of contexts being identified as a heavy context or a light context based on a predetermined number of distinct occurrences of data in a data stream, and the light context being predetermined to have a fewer number of distinct occurrences in the data than a number of distinct occurrences included in the heavy context,

processing a table containing the plurality of contexts by, for each context in the table;

determining whether the context is associated with a value or is associated with a plurality of values, and

when it is determined that the context is associated with a plurality of values, serializing the plurality of values into a value associated with the context, and

generating a plurality of concatenated values, each concatenated value comprising one of the values associated with a context of the plurality of contexts joined with another one of the values associated with at least one other context of the plurality of contexts; and

memory for storing the plurality of contexts in the table, and storing the plurality of concatenated values in a plurality of filtering tables, the plurality of filtering tables including a light context filtering table storing at least one concatenated value representing a combination of light contexts, a heavy context filtering table storing at least one concatenated value representing a combination of heavy contexts, a heavy and light context filtering table storing at least one concatenated value representing a combination of at least one heavy context and at least one light context, and a not looping filtering table storing at least one negative context that is utilized for negatively filtering values.

19. The system of claim 18, wherein the processor is coupled to the memory via a bus.