MATERIAL DOCENTE

Output:vincludes the rule(F1∈S1)∧ ⋅⋅⋅ ∧(Fd∈Sd)→ ⟨dec⟩in its all-match structure.

/* F(v) =Fm and E(v) ={e1,⋅⋅⋅,ek} */

ifm=d+1then 1

Addito the end ofv’s label ;

2 return 3 end 4 else if(Sm−(I(e1)∪ ⋅⋅⋅ ∪I(ek)))∕=/0then 5

Add an outgoing edgeek+1with labelSm−(I(e1)∪ ⋅⋅⋅ ∪I(ek))tov;

6

Construct a decision path from(Fm+1∈Sm+1)∧ ⋅⋅⋅ ∧(Fd∈Sd)→ ⟨dec⟩, and makeek+1 7

point to the¿rst node in this path ;

Insertiaccording the sorted order of the label of the terminal node of this decision path ;

8 end 9 forj := 1 to kdo 10 ifI(ej)⊆Smthen 11

INSERT(ej’s target,(F1∈S1)∧ ⋅⋅⋅ ∧(Fd∈Sd)→ ⟨dec⟩,m+1,i);

12 end 13

Add one outgoing edgeetov, and labelewithI(ej)∩Sm;

14

Make a copy of the subgraph rooted at the target node ofej, and makeepoints to the

15

root of the copy ;

Replace the label ofejbyI(ej)−Sm;

16

INSERT(e’s target,(F1∈S1)∧ ⋅⋅⋅ ∧(Fd∈Sd)→ ⟨dec⟩,m+1,i);

17 return 18 end 19 Algorithm 13: INSERT

6.4.3 Rule Modi¿cation

For rule modi¿cation, we model it as a rule deletion plus a rule insertion. Suppose that we modify ruleri to beri′ in classi¿er f =⟨r1,⋅⋅⋅,ri,ri+1,⋅⋅⋅,rn⟩. We¿rst

get the all-match tree for the classi¿er f′_{=⟨r1,⋅⋅⋅,ri}

−1,ri+1,⋅⋅⋅,rn⟩ in the way

that we handle rule deletions. Second, we obtain the all-match tree for the classi¿er

f′′_{=⟨r1,⋅⋅⋅,ri−1,r}

i′,ri+1,⋅⋅⋅,rn⟩in the way that we handle rule insertion. Finally,

we rerun our all-match based redundancy removal algorithm to remove all redundant rules from f′′_.

6.5 Redundancy Analysis

In this section, we¿rst introduce the concept of redundancy analysis, the goal of which is to calculate the set of rules that causes a particular rule to be redundant. Then, we present an algorithm for redundancy analysis.

Redundancy analysis is very useful for system administrator to investigate the reason of a rule being redundant. Updates to rule lists often unintentional cause older rules to become redundant. Redundant rules also can indicate miscon¿guration within rule lists. For example, in the rule list in Figure 6.1, we have two redundant

70 6 All-Match Redundancy Removal

rules,r2andr3. For each of these rules, we can¿nd rules that make them redundant:

r2 is redundant because r1 precedes it, andr3 is redundant because r4 makes it ineffective.

Formally we de¿ne aredundancy cause set of rito be a set ofcausal setswhere

a causal setSis a set of rules such that removing all the rules inSwill makerinon-

redundant. In our example, the redundancy cause set ofr2is{{r1}}where{r1}is a causal set, and the redundancy cause set ofr3is{{r4}}where{r4}is a causal set.

We observe that the containment and residency lists in Figure 6.4 provide com- plete information for calculating the causal sets for any rule in a rule list. Recall from Theorem 6.1 that ariis redundant if none of its occurrences in the contain-

ment list’s terminal nodes appear at the front of a list or all of its occurrences at the front of a terminal node list are followed by a rule with the same decision. There- fore, each terminal node that containsriprovides a cause forri’s redundancy and

forms a causal set.

The redundancy cause sets provide a succinct list of causes for each rule’s redun- dancy, and we compute the redundancy cause set forriin the following manner: For

each entry jin the residency list, the algorithm enumerates out a single causal set forriat the terminal node jin the containment list. According to Theorem 6.1, re-

moving any one set of rules will preventrifrom becoming redundant. Algorithm 14

contains the psuedocode for computing the redundancy cause set ofrigiven a con-

tainment and residency list.

Input: A rule numberri, a containment listC[1...m], and a residency listR[1...n].

Output:Sis the redundancy cause set ofri.

S←/0 ;

1

for each j_∈R_[i_]do 2

ForeCause_←the set of all rules precedingriinC[j];

3

A f tCause_←the set of all rules betweenriand the¿rst rule that follows it with a

4

different decision inC_[j_];

if₍ForeCause_∪A f tCause_)∕=/0then 5

Add(ForeCause∪A f tCause)toS;

6 end 7 end 8 returnS 9

Algorithm 14: Find redundancy cause set ofri

Each causal set can be reviewed by a system administrator to determine if the cause is legitimate or not. Additional techniques can be used to further prune this list of causal set to assist the administrator. For example, we can eliminate causal sets that contain only rules that are older thanri; this¿ltering allows the administrator to

review the causal sets which have been changed or created during a recent rule list update. Conversely, by eliminating causal sets that contain only rules that are newer thanri, the administrator can review the original causal sets thatri had with the

classi¿er when it was originally added. By examining both types of¿ltered causal sets, the administrator can determine if the intent ofriis still being enforced.

Part II