Attribute-based linked tries for rule evaluation

摘要

An embodiment for evaluating rules pertaining to an event includes providing a rule trie comprising multiple nodes, wherein match conditions must be met to trigger a given rule, and each match condition corresponds to a different node. An attribute trie is provided for a string attribute, which includes a node sequence having a value. The string attribute is extracted from the event and also has a value. The value of the extracted string attribute and the value of the node sequence are compared, by traversing a path extending along the node sequence. Responsive to determining that the values of the extracted string attribute and the node sequence are the same, notice is provided that the match condition of a particular node of the rule trie has been met by an attribute of the received event.

主权项

1. A computer program product comprising instructions stored in a non-transitory storage medium and executable by a data processor for evaluating one or more rules that pertain to an event having a string attribute, said instructions comprising:
instructions for providing a rule trie comprising a number of nodes, wherein one or more match conditions must be met to trigger a given rule, and each match condition corresponds to a different node of the rule trie; instructions for providing a string attribute trie for the string attribute, wherein the string attribute trie includes a node sequence that is associated with a particular value that is a match condition of a particular node of the rule trie; instructions for configuring a link between a specified node of the node sequence of the string attribute trie, and the particular node of the rule trie; instructions responsive to receiving the event, for extracting the string attribute from the event, wherein the extracted string attribute has a value; instructions for comparing the value of the extracted string attribute with the associated value of the node sequence by traversing a path that extends along the node sequence; and instructions responsive to determining that the value of the extracted string attribute and the associated value of the node sequence are the same for using the configured link to send notice that the match condition of the particular node of the rule trie has been met by the extracted string attribute of the received event.