Plug ruler to any rule based system and let it find duplicate/redundant rules. After reducing duplication, the rule-based system needs to evaluate less conditions and can, therefore, run faster.

1. Ruler
Accelerating rule-management
David Subiros and Luis M. Vaquero

2. Rule-based Systems
2
Main Idea: to capture the knowledge of a human expert in a specialized domain and embody it within a
software system.
Knowledge is stored as rules of the form IF condition THEN action: If income < 1000 THEN deny-
mortgage
• The UK’s NHS Direct adviser https://www.nhs.uk/symptom-checker/
• Ikea online assistant – an RBS with a chatbox interface
http://www.ikea.com/ms/en_GB/customer_service/contact_us/contact.html
• American Express Authorizer’s Assistant – developed in 1988, but still in use today - processes credit
requests, deciding whether to authorise or deny - very large: around 35,000 rules
• The iptables rules in all the machines and VMs in your data centre
• The technical analysis rules used by your pension schema manager
• At HPE: ArcSight, NFV Director, Helion … rely on rules

3. 3

4. Problem
4
Corruptissima re publica plurimae leges. Tacitus
• Experts introduce 8% overlapped rules in firewall configs (beginners up to 27%) [1]
• Situation worsened by the presence of many (siloed) automatic management (configuration churn)
• Detecting conflicting/overlapped rules is
o Slow
o Error prone
o Tedious
o Not scalable
• Heavily relying on expert knowledge
• Hard to debug
• Severely impacts performance
[1] Al-Shaer and Hamed. Modeling and management of firewall rules.

5. Challenges
1. Define generic rule similarity metrics
– Combinatorial explosion at a semantic level
– Curse of dimensionality
2. Visual representation of rules
3. Rule execution optimisation

6. Challenges
1. Define generic rule similarity metrics
– Combinatorial explosion at a semantic level
– Curse of dimensionality
2. Visual representation of rules
3. Rule execution optimisation

7. Example: X<-12 AND Y in [-5,0] AND Z in {cat, dog, 3.4} OR X in (-8, 5.01] AND Y in [-7,2)
z
x
-inf. …
y
-7
2
5.01
{cat, dog, 3.4}
{all z elements}
-8-12
Limited by
Dimension
-5
Rule Similarity
2 patents filed on this idea

8. Rule Similarity
0
0.02
0.04
0.06
0.08
0.1
0.12
0.14
0.16
0.18
0.2
0 200 400 600 800 1000 1200
Timetoaddanewrule[sec]
Number of intersections between the new rule and existing
rules

9. Rule Similarity
Number of rules in the system
Timetoaddanewrule[sec]
New rule mapped
to
4 hyperrectangles
New rule mapped
to
2 hyperrectangles
New rule maped to
1 hyperrectangle

10. Challenges
1. Define generic rule similarity metrics
– Combinatorial explosion at a semantic level
– Curse of dimensionality
2. Visual representation of rules
3. Rule execution optimisation

11. Visual Representation
11

12. Challenges
1. Define generic rule similarity metrics
– Combinatorial explosion at a semantic level
– Curse of dimensionality
2. Visual representation of rules
3. Rule execution optimisation

13. Execution Optimisation
13
&& &&R1
R2
R3 ¦¦
R4
Logical View of the Rules

14. Execution Optimisation
14
Execution View

15. Execution Optimisation
15
Execution View (II)
Event1

16. Execution Optimisation
16
Execution View (II)
True
True
False
False

17. Execution Optimisation
17
Exec results

18. Execution Optimisation
18
&& &&R1
R2
R3 ¦¦
R4
Logical View Reconstruction
Exec results

19. hank you
Contact: Luis M. Vaquero luis.vaquero@hpe.com