Optimizing networks of decision nodes

A computing device configured for optimizing a network of decision nodes for a pattern matching system, comprising:

• one or more processors;
• and
• memory in electronic communication with the one or more processors, wherein the memory stores computer executable instructions that when executed by the one or more processors cause the one or more processors to perform the steps of:
• generating, by one or more computing devices each comprising at least one processor, an initial network of decision nodes constructed according to one or more rules, the decision nodes comprising one or more levels of parent nodes and child nodes, each level of child nodes being connected to respective parent nodes;
• rearranging, by the one or more computing devices, one or more decision nodes of the initial network based at least in part on a conversion of the one or more rules to a disjunctive normal form;
• analyzing, by the one or more computing devices, the rearranged network of decision nodes in an upstream direction, the upstream direction being in a direction from the child nodes to the parent nodes;
• identifying a set of decision nodes based at least in part on analyzing the rearranged network, a first decision node of the set comprising a first parent node and a first child node and a second decision node of the set comprising a second parent node and a second child node, wherein the first parent node and the second parent node each perform a same test and the first child is identical to the second child node;
• optimizing, by the one or more computing devices, the rearranged network by merging the set of decision nodes based at least in part on the analysis of the rearranged network and the identifying, wherein optimizing the rearranged network causes at least one child node of the first child node and the second child node to be connected upstream to at least two alpha parent nodes or at least two beta parent nodes at a decision level;
• and
• performing a security action based at least in part on the optimizing of the rearranged network.

A non-transitory computer-readable storage medium storing computer executable instructions for optimizing a network of decision nodes for a pattern matching system that when executed by one or more processors cause the one or more processors to perform the steps of:

• generating, by one or more computing devices each comprising at least one processor, an initial network of decision nodes constructed according to one or more rules, the decision nodes comprising one or more levels of parent nodes and child nodes, each level of child nodes being connected to respective parent nodes;
• rearranging, by the one or more computing devices, one or more decision nodes of the initial network based at least in part on a conversion of the one or more rules to a disjunctive normal form;
• analyzing, by the one or more computing devices, the rearranged network of decision nodes in an upstream direction, the upstream direction being in a direction from the child nodes to the parent nodes;
• identifying a set of decision nodes based at least in part on analyzing the rearranged network, a first decision node of the set comprising a first parent node and a first child node and a second decision node of the set comprising a second parent node and a second child node, wherein the first parent node and the second parent node each perform a same test and the first child is identical to the second child node;
• optimizing, by the one or more computing devices, the rearranged network by merging the set of decision nodes based at least in part on the analysis of the rearranged network and the identifying, wherein optimizing the rearranged network causes at least one child node of the first child node and the second child node to be connected upstream to at least two alpha parent nodes or at least two beta parent nodes at a decision level;
• and
• performing a security action based at least in part on the optimizing of the rearranged network.