Rule processing optimization by content routing using decision trees

1. A computer implemented system for correlating events within a data stream, comprising:

an input for receiving the data stream;

and a processor comprising machine executable instructions stored on machine executable media, the instructions providing a correlation engine comprising at least one set of rules, the rules comprising event selectors having logical expressions corresponding to a plurality of attributes for the events within the data stream; the engine also comprising a decision tree built by the engine using an offline analysis of rule predicates for providing an index of the rules, wherein the engine references the decision tree to access selected rules corresponding to the events and applies the selected rules to correlate the events, wherein the rules are selected to provide a balance in performance determined according to selected attributes from the plurality of attributes;

and an output for providing correlated events to a user.

2. The computer implemented system as in claim 1 , wherein an intersection between logical expressions in multiple rules is represented as a node in the decision tree.

3. The computer implemented system as in claim 2 , wherein each rule within each set of rules is maintained as a leaf of a respective node for the set of rules.

4. A method for correlating events within a data stream, comprising:

selecting the data stream for categorizing of the events therein, each of the events comprising at least one attribute;

selecting a correlation engine adapted for building a decision tree and correlating the events;

evaluating a set of rules loaded in the correlation engine to determine a set of event attributes for the decision tree, wherein the set of rules is selected to provide a balance in performance determined according to at least one selected attribute for each of the events;

building a decision tree for indexing the at least one set of rules;

using the correlation engine, referencing the decision tree to access selected rules corresponding to the events; and

applying the selected rules for correlating the events; and

providing correlated events to a user as a result.

5. The method as in claim 4 , wherein building the decision tree comprises evaluating a plurality of attributes for each rule.

6. The method as in claim 4 , wherein the engine applies at least one algorithm to build the decision tree.

7. The method as in claim 4 , wherein referencing the decision tree comprises evaluating at least one of a logical AND operation, an OR operation and a NOT operation.

8. The method as in claim 4 , wherein building the decision tree comprises evaluating a logical predicate of a respective rule.

9. The method as in claim 8 , wherein evaluating a logical predicate comprises determining one of a true condition and a false condition.

10. A computer program product stored on machine readable media, the product comprising machine executable instructions for correlating events within a data stream, by:

selecting the data stream for correlation of the events therein;

selecting a correlation engine adapted for building a decision tree and classifying the events;

evaluating a set of rules loaded in the correlation engine to determine a set of event attributes for the decision tree, wherein the set of rules is selected to provide a balance in performance determined according to at least one selected attribute for each of the events;

building a decision tree for indexing the at least one set of rules, wherein building the decision tree comprises evaluating a plurality of attributes for each event in the at least a portion of the data stream;

using the correlation engine, referencing the decision tree to access selected rules corresponding to the events, wherein referencing the decision tree comprises evaluating at least one of a logical AND operation, an OR operation and a NOT operation; and

applying the selected rules for correlating the events; and

outputting correlated events to a user.

11. The computer program product as in claim 10 , wherein building the decision tree comprises evaluating a plurality of attributes for each rule.

12. The computer program product as in claim 10 , wherein the engine applies at least one algorithm to build the decision tree.

13. The computer program product as in claim 10 , wherein referencing the decision tree comprises evaluating at least one of a logical AND operation, an OR operation and a NOT operation.

14. The computer program product as in claim 10 , wherein building the decision tree comprises evaluating a logical predicate of a respective rule.

15. The computer program product as in claim 14 , wherein evaluating a logical predicate comprises determining one of a true condition and a false condition.