Policy Search Tree Prioritized Dimension Selection for Faster Lookup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for selecting dimensions in policy search trees in network gateways and firewalls create large trees and poor search performance due to fixed-order traversal, which is inefficient for diverse policy sets with varying range counts and widths.
Innovation Solution
Implement prioritized dimension selection based on configurable thresholds and priority levels to optimize the security policy search tree, reducing tree depth and node count by selecting dimensions with specific criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If fixed-order dimension traversal is used to select dimensions for policy search tree, then the method is simple to implement, but the policy search tree becomes large and search performance deteriorates
Solution Approach 1:
The patent changes the parameter of dimension selection from fixed-order traversal to dynamic selection based on unique range count. The system calculates the unique range count for each dimension and selects the dimension with the maximum unique range count, transforming the selection criterion from static to dynamic based on data characteristics.
Solution Approach 2:
The patent performs preliminary analysis of dimension characteristics before building the policy search tree. By pre-calculating the unique range count for each dimension and identifying the optimal cutting dimension in advance, the system prepares the best structure before actual packet classification, reducing subsequent search operations.
2Ease of operation
If all dimensions are traversed in fixed order to find the dimension with maximum unique range count, then the selection process is systematic, but the policy search tree depth increases and creation complexity increases
Solution Approach 1:
The system performs preliminary calculation of unique range counts for all dimensions before tree construction. This pre-computation identifies the optimal cutting dimension in advance, allowing the tree to be built with the best possible structure without repeated traversal during creation.
Solution Approach 2:
The patent applies different selection strategies at different stages of tree construction. At each node, the system locally determines the optimal dimension to cut based on the unique range count of dimensions in the current policy set, rather than applying a global fixed-order traversal throughout the entire tree construction process.
3Productivity
If the dimension with maximum unique range count is selected without considering range width diversity, then the selection process is simple, but the policy search tree does not optimize for diverse policy sets
Solution Approach 1:
The patent extends the selection criterion from considering only unique range count to also considering range width diversity. The system evaluates dimensions based on both the number of unique ranges and the distribution of range widths, selecting the dimension that provides the best overall optimization for diverse policy sets with varying range characteristics.
Data Source
AI summary
Various embodiments provide systems and methods for a heuristic policy search tree optimization using a prioritized dimension selection. A computer-implemented method for optimizing a policy search tree includes differentiating, with a network appliance, dimensions based on multiple priority levels of a priority dimension configurable setting, determining whether a first dimension having a first priority level for a node of the policy search tree satisfies configurable thresholds for characteristics of a policy set, and selecting the first dimension having the first priority level if no configurable threshold violation for the first dimension.