Decision Node Network Optimization via DNF Merging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network decision node optimization methods, such as those using the Rete matching algorithm, face challenges in managing disjunctive normal form (DNF) conversions, leading to an exponential increase in network size and memory usage, which hinders efficient malware detection and pattern matching.
Innovation Solution
The method involves constructing an initial network of decision nodes, converting rules to DNF, and then optimizing by merging nodes in a post-processing analysis, allowing multiple parents and performing local equivalence tests to reduce network complexity and share computational resources effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If rules are converted to disjunctive normal form (DNF) in conventional Rete networks, then the network can handle complex pattern matching, but the network size and memory usage increase exponentially
Solution Approach 1:
The patent merges decision nodes that perform identical actions or share identical child nodes after DNF conversion. By consolidating redundant nodes, the system maintains the full pattern matching capability of DNF while significantly reducing the network size. The merging process identifies and combines equivalent computational units, eliminating the exponential growth problem.
Solution Approach 2:
The patent discards redundant computational paths that arise from DNF conversion by performing post-processing analysis. The system identifies and removes duplicate nodes and edges that do not contribute unique computational value, thereby recovering memory resources while preserving the essential pattern matching functionality.
2Measurement precision
If DNF conversion is performed to enable comprehensive rule matching, then detection accuracy improves, but memory consumption increases significantly
Solution Approach 1:
The patent applies merging to decision nodes that perform identical actions or share identical child nodes. This consolidation maintains the comprehensive rule matching capability required for accurate malware detection while significantly reducing memory consumption by eliminating redundant node instances in the optimized network.
Solution Approach 2:
The patent creates universal decision nodes that can serve multiple parent nodes simultaneously. By allowing a single node to fulfill multiple matching functions, the system achieves comprehensive detection coverage without proportionally increasing memory usage, as one node performs the work of what would otherwise require multiple separate nodes.
3Adaptability or versatility
If the network structure is expanded to handle disjunctive rules, then rule coverage increases, but the complexity of network management increases
Solution Approach 1:
The patent merges decision nodes with identical characteristics to reduce network complexity. By consolidating redundant nodes, the system maintains comprehensive rule coverage while simplifying the network structure, making it easier to manage and less complex despite the expanded rule set.
Solution Approach 2:
The patent performs preliminary optimization by merging nodes before the network is fully utilized. This pre-optimization step establishes a more manageable network structure from the outset, reducing future management complexity while preserving full rule coverage capability.
Data Source
AI summary
A method for optimizing network decision nodes is described. In one embodiment, the method includes generating an initial network of decision nodes constructed according to one or more rules, rearranging one or more decision nodes of the initial network based at least in part on a conversion of the one or more rules to a disjunctive normal form, analyzing the rearranged network of decision nodes in an upstream direction, and optimizing the rearranged network by merging two or more decision nodes of the rearranged network based at least in part on the analysis of the rearranged network. In some cases, the decision nodes include one or more levels of parent nodes and child nodes, each level of child nodes being connected to respective parent nodes. In some cases, the upstream direction is in a direction from the child nodes to the parent nodes.