IP Library Granted Patent US 12684020
Granted Patent B2
US 12684020 · App. 18/964,905 · Granted Jul 14, 2026

Policy set feature guided node level partitioning for policy search tree optimization

Inventors: Shushan Wen (Pleasant Hill, CA); Tianrui Wei (Santa Clara, CA); Kevin Juncheng Xu (Sunnyvale, VA)
Assignee: Fortinet, Inc.
H04L63/20
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12684020
App. No.
18/964,905
Granted
Jul 14, 2026
Kind
B2
Abstract

Approaches policy set feature guided node level partitioning for policy search tree optimization are disclosed. A set of policy bins is generated by creating equal-width bins on a given dimension. An original policy set is scanned to determine a number of policies falling into each policy bin in the set of policy bins. An original policy set characteristic is measured based on the number of policies falling into each policy bin. Parameters that represent relationships between the policy set and another policy set are determined based on a number of policies falling into each policy bin and the policy set characteristic. A new policy set is generated based on the parameters. A new policy search tree is generated based on a new policy set. The new policy search tree provides improved build cost or improved search cost as compared a search tree based on the original policy set.

Claims (46)

1 . A method for reducing policy search tree build costs and search costs by improving node level partitioning with policy set features, the method comprising:

determining a node-level partitioning based use of a policy set function;

generating a set of policy bins by creating a number of equal-width bins on a given dimension;

scanning an original policy set to determine a number of policies falling into each policy bin in the set of policy bins;

measuring an original policy set characteristic based on the number of policies falling into each policy bin;

determining one or more parameters that represent relationships between the policy set and another policy set based at least on a number of policies falling into each policy bin and the policy set characteristic;

selecting the appropriate node level partitioning for the original policy set based on a similarity of the original policy set and other policy sets;

generating a new policy search tree using the selected node level partitioning scheme; and

deploying the new policy search tree.

2 . The method of claim 1 , wherein the new policy search tree provides improved build cost or improved search sit as compared to a search tree based on a one-size-fits-all partitioning scheme.

3 . The method of claim 1 , wherein the policy set function maps one or more policy sets to values in a value set.

4 . The method of claim 1 , wherein the policy set characteristic comprises an entropy calculation, wherein the entropy calculation captures a feature of the policy distribution with a single value.

5 . The method of claim 1 , wherein the policy set characteristic comprises a variance calculation, wherein the variance calculation captures a feature of the policy distribution with a single value.

6 . The method of claim 1 , wherein the one or more parameters comprise at least sets of {PSF, BEST_NLP} value pairs.

7 . The method of claim 1 , wherein scanning an original policy set to determine a number of policies falling into each policy bin in the set of policy bins comprises utilizing a node-level partitioning (NLP) function to map a sum of policy counts for all child nodes to an NLP value.

8 . A non-transitory computer readable storage medium having stored therein instructions that, when executed by one or more processors, cause the one or more processors to:

determine a node-level partitioning based use of a policy set function;

generate a set of policy bins by creating a number of equal-width bins on a given dimension;

scan an original policy set to determine a number of policies falling into each policy bin in the set of policy bins;

measure an original policy set characteristic based on the number of policies falling into each policy bin;

determine one or more parameters that represent relationships between the policy set and another policy set based at least on a number of policies falling into each policy bin and the policy set characteristic;

select the appropriate node level partitioning for the original policy set based on a similarity of the original policy set and other policy sets;

generate a new policy search tree using the selected node level partitioning scheme; and

deploy the new policy search tree.

9 . The non-transitory computer readable storage medium of claim 8 , wherein scanning an original policy set to determine a number of policies falling into each policy bin in the set of policy bins comprises utilizing a node-level partitioning (NLP) function to map a sum of policy counts for all child nodes to an NLP value.

10 . The non-transitory computer readable storage medium of claim 8 , wherein the policy set function maps one or more policy sets to values in a value set.

11 . The non-transitory computer readable storage medium of claim 8 , wherein the policy set characteristic comprises an entropy calculation, wherein the entropy calculation captures a feature of the policy distribution with a single value.

12 . The non-transitory computer readable storage medium of claim 8 , wherein the policy set characteristic comprises a variance calculation, wherein the variance calculation captures a feature of the policy distribution with a single value.

13 . The non-transitory computer readable storage medium of claim 8 , wherein the one or more parameters comprise at least sets of {PSF, BEST_NLP} value pairs.

14 . The non-transitory computer readable storage medium of claim 8 , wherein the new policy search tree provides improved build cost or improved search sit as compared to a search tree based on a one-size-fits-all partitioning scheme.

15 . A system comprising:

a storage subsystem having a plurality of data storage devices;

one or more hardware processors coupled with the storage subsystem, the one or more hardware processors configurable to:

determine a node-level partitioning based use of a policy set function;

generate a set of policy bins by creating a number of equal-width bins on a given dimension;

scan an original policy set to determine a number of policies falling into each policy bin in the set of policy bins;

measure an original policy set characteristic based on the number of policies falling into each policy bin;

determine one or more parameters that represent relationships between the policy set and another policy set based at least on a number of policies falling into each policy bin and the policy set characteristic;

select the appropriate node level partitioning for the original policy set based on a similarity of the original policy set and other policy sets;

generate a new policy search tree using the selected node level partitioning scheme; and

deploy the new policy search tree.

16 . The system of claim 15 , wherein the policy set function maps one or more policy sets to values in a value set.

17 . The system of claim 15 , wherein the policy set characteristic comprises an entropy calculation, wherein the entropy calculation captures a feature of the policy distribution with a single value.

18 . The system of claim 15 , wherein the policy set characteristic comprises a variance calculation, wherein the variance calculation provides at least a mean value of all bins.

19 . The system of claim 15 , wherein the one or more parameters comprise at least sets of {PSF, BEST_NLP} value pairs.

20 . The system of claim 15 , wherein the new policy search tree provides improved build cost or improved search sit as compared to a search tree based on a one-size-fits-all partitioning scheme.