2011 International Conference on Computer Science and Network Technology Detecting Self-Conflicts for Business Action Rules LUO Qian1, 2, TANG Chang-jie1+, LI Chuan1, YU Er-gai2 (1. Department of Computer Science, Sichuan University, Chengdu 610065, China; 2. The Second Research Institute of China Aviation Administration Centre, Chengdu 610041China) + Corresponding author: Changjie Tang Phone: +86-28-8546-6105, E-mail: [email protected] Rule4 FM D A CraftSite 4 Abstract—Essential discrepancies in business operation datasets Rule5 3U D Chengdu Y A CraftSite 5 may cause failures in operational decisions. For example, an Rule6 CA I A CraftSite 6 antecedent X may accidentally lead to different action results, which obviously violates the atomicity of business action rules and … … … … … … … will possibly cause operational failures. These inconsistencies Rule119 I B CraftSite 105 within business rules are called self-conflicts. In order to handle the problem, this paper proposes a fast rules conflict detection Rule120 M B CraftSite 229 algorithm called Multiple Slot Parallel Detection (MSPD). The algorithm manages to turn the seeking of complex conflict rules into the discovery of non-conflict rules which can be accomplished The “Rule1” says that “IF (Type = International and in linear time complexity. The contributions include: (1) formally Transition = San Francisco) THEN (Landing field = proposing the Self-Conflict problem of business action rules, (2) CraftSite1). The rule is made by operator “A", which stands for proving the Theorem of Rules Non-conflict, (3) proposing the MSPD algorithm which is based on Huffman- Tree, (4) a business operator, only investigated when a certain rule is to conducting extensive experiments on various datasets from Civil be discussed as a problem. Airport business rules sets, which shows that the proposed There are more than 1000 flights every day in the major algorithm saves 33.6% more space than the traditional Policy tree domestic airports. Taking into account the other factors like the algorithm and improved the detection speed by 36.2%. resources type (craftsite/ boarding gate/ luggage checking), Keywords- Business Action Rules; Self-Conflict Detection; time range (year/ month/ day), etc. the actual size of such resource allocation rules table will probably go beyond our Actual Bucket expectation. Through investigations about the table, we can have the following viewpoints. Observation 1: For the business tuple X, i.e., Rule 1: an I. INTRODUCTION international flight CA392 departs from Chengdu via San Francisco, if we want to find out how many rules match X, we Business action rules are based on the workflows, which can get that rule 1 (CraftSite 1) and rule 119 (CraftSite 105) current industry oriented system seems more and more meet the criteron. However, if we handle it as a linear manner dependent on. Simultanuously, various applications from matching, rule 119 will never be found, which will mislead different users require that the system can work properly just operator B in what to do next. through a set of simple configuration. This situation gives rise to the concept of so-called Rules Engine, which turns the Observation 2: If we remove R2, R6, R119 and R120 from business workflows and users’ needs into a set of rules. To Table 1, there will be one and only one rule being hit when a ensure these rules are correctly set up, the validation becomes rule is taken as an inquiry criteron, which makes the very important not only to system performance, but also to management design agree with system behaviors. system flexibility and operationality. The above observations show that there would be potential Table 1 is a set of civil airport operation rules, which has discrepancies within the rules. We call it Rules conflict which been greatly simplified. A business action rule is as simple as will be formally defined in section 2. The purpose of this paper "IF (Condition) THEN (Action)" as is shown below. is to design a reasonable algorithm to find out and lable these conflicts rules so that these conflicts can be further dealt with. TABLE I CIVIL AIRPORT OPERATION RULES II. RELATED WORK Airways Type Transition VIP Operator Field Reference [1] proposed the MSHTree algorithm working Rule1 I San Francisco A CraftSite1 with simplified operators. This paper extends it and propose the Rule2 CZ Y A CraftSite 2 MSHTrie algorithm, which makes rules engine more pervasive. Rule3 M Beijing N A CraftSite 3 What’s more, the rules matching efficiency improves by 21.3% compared with PolicyTree algorithm. The papers [2] and [3] 978-1-4577-1585-3/11/$26.00 ©2011 IEEE 1274 December 24-26, 2011 proposed a data structure called "PolicyTree" for the firewall’s results are different, we say that R is Conflict, denoted as rules filtering. Reference [12] classified the rules conflict and Conflict(R), Formally, we have proposed the optimized FastDectionConflict algorithm. However, they did not overcome the problems of PolicyTree IF {lij:(Xl match Rj)∩(Xl match Rj)| 1≤i≠j≤m} and algorithm with its high repetition rate, huge space consumption, (Ai≠Aj) THEN conflict(R) and expansion difficulties. Definition 3 (Rule non-Conflict): If there is one and only one rule Reference [11] and [12] proposed PATRICIA tree and LE- Ri (1≤i≤m, m is number of rules) has been hit, when a Trie tree structure to handle these problems, respectively. business data Xl (l is an integer) compares with all of rules in However, the proposed methods can only detect the conflicts table, we say that R is non-Conflict, denoted as Compatible (R). between source IP field and destination IP field, and cannot Formally, we have meet the general demand. Similarly, the detection algorithms ∩ Ф ≤ ≤ proposed in the reseach papers [4] and [5] are suitable only for IF {k:P[i,k].V P[j,k].V= |1 k m} THEN fixed format rules, and the fields detection algorithms for rules (Compatible(Ri ,Rj)) are independent to each other. Further, the algorithms lack Based on the above definitions, we see that it requires essential flexibility and extendibility. traversal of all the rules set and business data before we can Reference [6] firstly proved the rules conflict detection judge whether there is a rule conflict, Conflict(R). However, it problem in the package filtering for firewalls is a NPC problem, is impossible to enumerate all the business data. So the conflict i.e., a variant of the SAT problem. The authours of paper [7] judgement is in extreme low efficiency. Can we make use of considers improving the efficiency by compressing the search inter-record relationship to help diagnose the conflict? paths of the above algorithm. Reference [8] directly analyzed Proposition 1. Let Ri and Rj be any two action rules in the rules the rule conflict mechanism in network intrusion system, Snort. table. If the intersection of fields values of each pair rule- Finally, reference [10] proposed a security policy by multi- point’s attributes is not an empty set, and the operation results dimensional integer space, which takes each condition field of are different, then there must exit conf(R), denoted as conf(Ri, rules into a set of integers using the condition field mapping Rj). Formally, we have principle. But the algorithm lacks strict formal formulation on IF {k: P[i,k].V ∩ P[j,k].V ≠Ф|1 ≤ k≤n } and (Ai ≠ Aj) rule conflict, and it assumes that the number of expression THEN conf(R). denoted as conf(Ri, Rj). variables is less than 5. The mapping rules are too simplified, which is not suitable for practical huge-scale scenarios. Proof. By Definition 1, there exits a business data Xl hitting rules Ri and Rj at the same time, which means Xl match Ri holds, and X match R also holds. So X matches III. BASIC CONCEPTS l j l Ri<=>k:X[l,k].V ∩ P[i,k].V≠ Ф hold. For the same reason, Definition 1 (Action Rule R): R = {((P1 ∧(P2 ∧ ... (Pn) -> A | (Pi k:X[l,k].V∩P[i,k].V≠Фhold with two possible cases. (1) ∈ {P}, A ∈{Action Result Set}} is called an action rule, X[l,k].V=P[i,k].V; (2) P[i,k].V=Ω. So there must exit P[i,k].V where A is an Action set representing the business operations ∩ P[j,k].V ≠Ф, then Conflict(R) is True. Therefore, [1] required when (P1 ∧P2 ∧ ... Pn) is True. Pi is a rules point , proposition 1 holds. satisfying the following boolean expression: Pi = {( Pi.N = Pi.V) | P ∈ (True, False)},while P .N is a variable, P .V is a specific Proposition 2 Let Ri and Rj be any two action rules in the rules i i i table. If there exists a pair of rules that are mutually exclusive, value in Pi.N’s domain. N is the number of rules point. there must exist Compatible(R), denoted as Compatible(Ri ,Rj). In order to formally discribe the problem, we firstly make Formally, we have the following hypothesis. IF{k: P[i,k].V∩P[j,k].V=Ф|1≤k≤m } [1] (1) H1 Rule point’s Non-intersection . Suppose Pi.N and THEN Compatible (R). Pj.N denote the I’s and j’s rules point properties of an arbitrary rule. Then we have {Pi.N}∩{Pj.N}=Ф,,where i≠j,1≤i,j≤n. Proof. By Definition 2, for any arbitrary business data Xl, [1] (2) H2 Rule operation value uniqueness. Let r be an there is one and only one rule Ri being hit, which means that Xl arbitrary rule of the rule repository. We have |A|=1, which matches Ri holds.