Graph structures for event matching

摘要

A system for matching a system event to a rule is disclosed. The system includes a computer-readable data structure comprising a plurality of system event rules organizable as a partially ordered set. The system also includes a processor configured to analyze the computer-readable data structure to determine whether an event matches a description set of at least one rule from the plurality of system event rules. Methods and machine-readable mediums are also disclosed.

主权项

1. A system for matching a system event to a rule, the system comprising:
a computer-readable data structure comprising a plurality of system event rules organized as a graph having a plurality of nodes, at least one node corresponding to a field in a rule and having a weight value; a processor configured to analyze the computer-readable data structure to determine whether an event comprising at least one field matches a description set of at least one rule from the plurality of system event rules by:
for a node in the graph, comparing the field corresponding to the node to each field in the event;in the event of a match between the compared fields, adding the field to a list of matches; andsorting the list of matching fields according to the weight associated with each matching field.