Rapid evaluation of numerically large complex rules governing network and application transactions

1. A computer implemented method comprising:

at a network device, receiving network transaction record comprising a plurality of elements of possibly dissimilar data types, each of the plurality of elements characterizing a network transaction;

creating a hash of a result of concatenating the plurality of elements regardless of the type of each of the plurality of elements; and

if the hash is found in a hash table comprising, for each network transaction rule, a hash of the plurality of elements comprising the rule,

ignoring the network transaction;

blocking the network transaction; or

alerting a network user that a prohibited transaction has occurred.

2. The method of claim 1 wherein the creating further comprises, for each combination of elements in the network transaction record, creating a hash.

3. The method of claim 2 wherein a number of combinations of elements is reduced by eliminating combinations of elements that cannot be present in the same network transaction.

4. The method of claim 3 wherein the combinations of elements that cannot be present in the same network transaction comprise a combination of:

elements of a transaction specific to database operations; and

elements of a transaction specific to file operations.

5. The method of claim 2 wherein a number of combinations of elements is reduced by eliminating combinations of elements that include an element not found at least one rule.

6. The method of claim 1 , further comprising:

for each network transaction rule having a wild card for a portion of at least one of the plurality of elements comprising the rule, the hash is encoded as if the elements having a wild card were absent from the rule;

if the hash is found, matching the network transaction against the element having the wild card; and

if there is a match,

ignoring the network transaction;

blocking the network transaction; or

alerting a network user that a prohibited transaction has occurred.

7. The method of claim 1 , further comprising:

for each network transaction rule having a white list indication for a portion of at least one of the plurality of elements comprising the rule, the hash is encoded as if the elements having a wild card were absent from the rule;

if the hash is found, matching the network transaction against the element having the white list element; and

if there is no match,

ignoring the network transaction;

blocking the network transaction; or

alerting a network user that a prohibited transaction has occurred.

8. A network device comprising:

a memory; and

one or more processors configured to:

receive network transaction record comprising a plurality of elements of possibly dissimilar data types, each of the plurality of elements characterizing a network transaction;

create a hash of a result of concatenating the plurality of elements regardless of the type of each of the plurality of elements; and

if the hash is found in a hash table comprising, for each network transaction rule, a hash of the plurality of elements comprising the rule,

ignore the network transaction;

block the network transaction; or

alert a network user that a prohibited transaction has occurred.

9. The network device of claim 8 wherein the creating further comprises, for each combination of elements in the network transaction record, creating a hash.

10. The network device of claim 9 wherein a number of combinations of elements is reduced by eliminating combinations of elements that cannot be present in the same network transaction.

11. The network device of claim 10 wherein the combinations of elements that cannot be present in the same network transaction comprise a combination of:

elements of a transaction specific to database operations; and

elements of a transaction specific to file operations.

12. The network device of claim 9 wherein a number of combinations of elements is reduced by eliminating combinations of elements that include an element not found at least one rule.

13. The network device of claim 8 wherein the one or more processors are further configured to:

for each network transaction rule having a wild card for a portion of at least one of the plurality of elements comprising the rule, encode the hash as if the elements having a wild card were absent from the rule;

if the hash is found, match the network transaction against the element having the wild card; and

if there is a match,

ignore the network transaction;

block the network transaction; or

alert a network user that a prohibited transaction has occurred.

14. The network device of claim 8 wherein the one or more processors are further configured to:

for each network transaction rule having a white list indication for a portion of at least one of the plurality of elements comprising the rule, encode the hash as if the elements having a wild card were absent from the rule;

if the hash is found, match the network transaction against the element having the white list element; and

if there is no match,

ignore the network transaction;

block the network transaction; or

alert a network user that a prohibited transaction has occurred.

15. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method, the method comprising:

at a network device, receiving network transaction record comprising a plurality of elements of possibly dissimilar data types, each of the plurality of elements characterizing a network transaction;

creating a hash of a result of concatenating the plurality of elements regardless of the type of each of the plurality of elements; and

if the hash is found in a hash table comprising, for each network transaction rule, a hash of the plurality of elements comprising the rule,

ignoring the network transaction;

blocking the network transaction; or

alerting a network user that a prohibited transaction has occurred.

16. A network device comprising:

means for, at a network device, receiving network transaction record comprising a plurality of elements of possibly dissimilar data types, each of the plurality of elements characterizing a network transaction;

means for creating a hash of a result of concatenating the plurality of elements regardless of the type of each of the plurality of elements; and

means for, if the hash is found in a hash table comprising, for each network transaction rule,

a hash of the plurality of elements comprising the rule,

ignoring the network transaction;

blocking the network transaction; or

alerting a network user that a prohibited transaction has occurred.

17. A computer implemented method comprising:

at a network device, receiving network transaction record comprising a first plurality of elements of possibly dissimilar data types, each of the first plurality of elements characterizing a network transaction;

selectively removing one or more elements from the first plurality of elements according to a binary pattern to create a second plurality of elements;

creating a hash of a result of concatenating the second plurality of elements regardless of the type of each of the plurality of elements; and

if the hash is found in a hash table comprising, for each network transaction rule, a hash of a plurality of elements comprising the rule,

ignoring the network transaction;

blocking the network transaction; or

alerting a network user that a prohibited transaction has occurred.

18. A network device comprising:

a memory; and

one or more processors configured to:

receive network transaction record comprising a first plurality of elements of possibly dissimilar data types, each of the first plurality of elements characterizing a network transaction;

selectively remove one or more elements from the first plurality of elements according to a binary pattern to create a second plurality of elements;

create a hash of a result of concatenating the second plurality of elements regardless of the type of each of the plurality of elements; and

if the hash is found in a hash table comprising, for each network transaction rule, a hash of a plurality of elements comprising the rule,

ignoring the network transaction;

block the network transaction; or

alert a network user that a prohibited transaction has occurred.