Not Applicable.
1. Background and Relevant Art
Computer systems and related technology affect many aspects of society. Indeed, the computer system's ability to process information has transformed the way we live and work. Computer systems now commonly perform a host of tasks (e.g., word processing, scheduling, accounting, etc.) that prior to the advent of the computer system were performed manually. More recently, computer systems have been coupled to one another and to other electronic devices to form both wired and wireless computer networks over which the computer systems and other electronic devices can transfer electronic data. Accordingly, the performance of many computing tasks are distributed across a number of different computer systems and/or a number of different computing environments.
In some computing environments, regular expressions are used to match strings of text, such as, for example, particular characters, words, or patterns of characters. Regular expressions can be written in a formal language that can be interpreted by a regular expression processor. The regular expression processor is a program that serves as a parser generator or examines text and identifies parts that match a provided specification.
Regular expressions are used by many text editors, utilities, and programming languages to search and manipulate text based on patterns. For example, anti-spam services can utilize regular expressions to determine if strings of text known to be indicative of SPAM are contained in an electronic message. Similarly, data leakage protection services can utilize regular expressions to detect and prevent the unauthorized use and transmission of confidential information.
In environments that utilize regular expressions, it is not uncommon for large collections of regular expressions to be executed sequentially. For example, an anti-spam service can use tens of thousands of regular expressions when determining if an electronic message contains SPAM. Regular expressions within a set of regular expressions can be run sequentially against each received electronic message. Sequential execution of regular expressions limits scalability and can consume significant resources as the number of regular expressions and/or portions of text being checked for matches increases.
The present invention extends to methods, systems, and computer program products for decomposing and merging regular expressions. One or more keyword graphs are accessed. The one or more keyword graphs were decomposed from a first regular expression. Each of the one or more keyword graphs has a root node, one or more intermediate nodes, and a leaf node. Each of the one or more intermediate nodes and the leaf node indentify a character pattern that partially matches the first regular expression. The root node and each of the one or more intermediate nodes have a single child node. One of the intermediate nodes has the leaf node as a child node. Each leaf node is labeled as a matching state for the first regular expression.
A second graph is accessed. The second graph represents a second regular expression. The second graph has a root node, one or more intermediate nodes, and one or more leaf nodes. Each of the one or more intermediate nodes and the one or more leaf nodes indentify a character pattern that partially matches the second regular expression. The second graph has one or more terminal nodes labeled as a matching state for the second regular expression.
The one or more keyword graphs and the second graph are merged into a directed acyclic graph that collectively represents both the first regular expression and the second regular expression. Merging includes identifying any similarly positioned intermediate nodes within the one or more keyword graphs and the second graph that have at least partially overlapping character patterns. For any identified intermediate nodes that have partially overlapping character patterns, the character pattern of at least one of the indentified intermediate nodes is altered to eliminate the partially overlapping character pattern. An edge is added between the keyword graph and the second graph to compensate for altering the character pattern of the at least one of the identified intermediate nodes. For any identified intermediate nodes that have fully overlapping character patterns, the intermediate node in the keyword graph and the intermediate node in the second graph are combined into a single node representing the fully overlapping character pattern.
This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.
Additional features and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by the practice of the invention. The features and advantages of the invention may be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims. These and other features of the present invention will become more fully apparent from the following description and appended claims, or may be learned by the practice of the invention as set forth hereinafter.
In order to describe the manner in which the above-recited and other advantages and features of the invention can be obtained, a more particular description of the invention briefly described above will be rendered by reference to specific embodiments thereof which are illustrated in the appended drawings. Understanding that these drawings depict only typical embodiments of the invention and are not therefore to be considered to be limiting of its scope, the invention will be described and explained with additional specificity and detail through the use of the accompanying drawings in which:
The present invention extends to methods, systems, and computer program products for decomposing and merging regular expressions. One or more keyword graphs are accessed. The one or more keyword graphs were decomposed from a first regular expression. Each of the one or more keyword graphs has a root node, one or more intermediate nodes, and a leaf node. Each of the one or more intermediate nodes and the leaf node indentify a character pattern that partially matches the first regular expression. The root node and each of the one or more intermediate nodes have a single child node. One of the intermediate nodes has the leaf node as a child node. Each leaf node is labeled as a matching state for the first regular expression.
A second graph is accessed. The second graph represents a second regular expression. The second graph has a root node, one or more intermediate nodes, and one or more leaf nodes. Each of the one or more intermediate nodes and the one or more leaf nodes indentify a character pattern that partially matches the second regular expression. The second graph has one or more terminal nodes labeled as a matching state for the second regular expression.
The one or more keyword graphs and the second graph are merged into a directed acyclic graph that collectively represents both the first regular expression and the second regular expression. Merging includes identifying any similarly positioned intermediate nodes within the one or more keyword graphs and the second graph that have at least partially overlapping character patterns. For any identified intermediate nodes that have partially overlapping character patterns, the character pattern of at least one of the indentified intermediate nodes is altered to eliminate the partially overlapping character pattern. An edge is added between the keyword graph and the second graph to compensate for altering the character pattern of the at least one of the identified intermediate nodes. For any identified intermediate nodes that have fully overlapping character patterns, the intermediate node in the keyword graph and the intermediate node in the second graph are combined into a single node representing the fully overlapping character pattern.
Embodiments of the present invention may comprise or utilize a special purpose or general-purpose computer including computer hardware, such as, for example, one or more processors and system memory, as discussed in greater detail below. Embodiments within the scope of the present invention also include physical and other computer-readable media for carrying or storing computer-executable instructions and/or data structures. Such computer-readable media can be any available media that can be accessed by a general purpose or special purpose computer system. Computer-readable media that store computer-executable instructions are computer storage media (devices). Computer-readable media that carry computer-executable instructions are transmission media. Thus, by way of example, and not limitation, embodiments of the invention can comprise at least two distinctly different kinds of computer-readable media: computer storage media (devices) and transmission media.
Computer storage media (devices) includes RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store desired program code means in the form of computer-executable instructions or data structures and which can be accessed by a general purpose or special purpose computer.
A “network” is defined as one or more data links that enable the transport of electronic data between computer systems and/or modules and/or other electronic devices. When information is transferred or provided over a network or another communications connection (either hardwired, wireless, or a combination of hardwired or wireless) to a computer, the computer properly views the connection as a transmission medium. Transmissions media can include a network and/or data links which can be used to carry or desired program code means in the form of computer-executable instructions or data structures and which can be accessed by a general purpose or special purpose computer. Combinations of the above should also be included within the scope of computer-readable media.
Further, upon reaching various computer system components, program code means in the form of computer-executable instructions or data structures can be transferred automatically from transmission media to computer storage media (devices) (or vice versa). For example, computer-executable instructions or data structures received over a network or data link can be buffered in RAM within a network interface module (e.g., a “NIC”), and then eventually transferred to computer system RAM and/or to less volatile computer storage media (devices) at a computer system. Thus, it should be understood that computer storage media (devices) can be included in computer system components that also (or even primarily) utilize transmission media.
Computer-executable instructions comprise, for example, instructions and data which, when executed at a processor, cause a general purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions. The computer executable instructions may be, for example, binaries, intermediate format instructions such as assembly language, or even source code. Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the described features or acts described above. Rather, the described features and acts are disclosed as example forms of implementing the claims.
Those skilled in the art will appreciate that the invention may be practiced in network computing environments with many types of computer system configurations, including, personal computers, desktop computers, laptop computers, message processors, hand-held devices, multi-processor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, mobile telephones, PDAs, pagers, routers, switches, and the like. The invention may also be practiced in distributed system environments where local and remote computer systems, which are linked (either by hardwired data links, wireless data links, or by a combination of hardwired and wireless data links) through a network, both perform tasks. In a distributed system environment, program modules may be located in both local and remote memory storage devices.
Within this description and the following claims a “regular expression”, is a construct used to match strings of text, such as, for example, particular characters, words, or patterns of characters. In some embodiments, a regular expression has a limited alphabet. A regular expression can be written in a formal language that can be interpreted by a regular expression processor. The regular expression processor serves as a parser generator or examines text and identifies parts of the text that match a provided regular expression.
In generally, graphs can be used to represent regular expressions and their matching states. For example, turning briefly to
In general, decomposition can be used to produce a set of simple graphs that represent a regular expression from a more complex graph that represents the regular expression. Accordingly, decomposition module 101 is configured to decompose a graph, such as, for example, a graph representing a regular expression, into a corresponding plurality of keyword graphs. Decomposition module 101 can essentially remove disjunctive portions of a more complex regular expression to break the more complex regular expression into a plurality of simpler regular expressions. A leaf node of each keyword graph represents a terminal condition from the more complex graph (which may be at an intermediate node or leaf node in the more complex graph). Decomposition module 101 can decompose labeled or unlabeled graphs.
Labeling module 102 is configured to label nodes of a graph or keyword graph to indicate matching states for a represented regular expression. Labeling module 102 can label nodes before or after decomposition.
Turning again to
Turning again to
In some embodiments, a graph is decomposed into keyword graphs in accordance with the following algorithm:
The algorithm can produce a collection of keyword graphs (e.g., DAGs) representing the graph. Each keyword graph has a single terminal node that is a leaf node. Within each graph, each node has a single child node.
In general, merging can be used to produce a single Directed Acyclic Graph (“DAG”) representing a collection of regular expressions. Accordingly, merge module 101 is configured to receive two graphs as input and merge the two graphs into a single DAG that collectively represents matching states for the two input graphs. To eliminate processing redundancies, merge module 101 can combine overlapping character patterns at similarly positioned nodes in the two input graphs into a single node in the single DAG. When character patterns partially overlap, merge module 101 can alter the character pattern at a node in one input graph. Merge module 101 can then compensate by adding an additional edge between the node and a corresponding node in the other input graph. Adding an additional edge facilitates equivalence in matching states between the two input graphs and the single DAG.
In some embodiments, merge module 141 merges two keyword graphs into a single DAG. In other embodiments, merge module 141 merges a keyword graph and another graph into a single DAG. The functionality of merge module 141 can be reused as needed to merge larger sets of graphs together.
Turning to
Labels (as indicated by different diagonal hatching) are maintained throughout the merge process. Thus, terminal nodes indicate a regular expression that is matched. Nodes 316 and 317 indicate a match to the regular expression “\d\dlum” (the regular expression they were decomposed from) and node 318 indicates a match to the regular expression “un”.
As depicted in
As depicted, merge module 141 includes position detector 142, overlap detector 143, and overlap compensator 144. During merging position, position detector 142 is configured to identify similarly positioned nodes within different graphs. Similarly positioned nodes can be identified based on a distance from the root node. For example, in
As depicted, the different hatching within terminal nodes indicates matching states for keyword graph 501 and graph 502 respectively.
In some embodiments, graphs are merge in accordance with the following algorithm:
Method 600 includes an act of accessing a graph representing a first regular expression (act 601). For example, decomposition module 101 can access graph 112, representing regular expression 111. Method 600 includes an act of decomposing the graph into one or more keyword graphs, each of one or more keyword graphs having a root node, one or more intermediate nodes, and a leaf node, each of the one or more intermediate nodes and the leaf node indentifying a character pattern that partially matches the first regular expression, the root node and each of the one or more intermediate nodes having a single child node, one of the intermediate nodes having the leaf node as a child node (act 602). For example, decomposition module 101 can decompose graph 112 into keyword graphs 113 (e.g., 113A, 113B, 113C, etc.).
Method 600 includes an act of labeling the leaf node of each of the one or more keyword graphs as a matching state for the first regular expression (act 603). For example, labeling module 102 can label the leaf nodes of keyword graphs 113 to generate labeled keyword graphs 113AL, 113BL, 113BL, etc.
Method 600 includes an act of accessing a second graph representing a second regular expression, the second graph having a root node, one or more intermediate nodes, and one or more leaf nodes, each of the one or more intermediate nodes and the one or more leaf nodes indentifying a character pattern that partially matches the second regular expression (act 604). For example, labeling module 102 can access graph 123, representing regular expression 121. Method 600 includes an act of labeling one or more terminal nodes in the second graph as a matching state for the second regular expression (act 605). For example, labeling module 102 can label the terminal nodes of graph 123 to generate labeled graph 123L
Method 600 includes an act of merging the one or more keyword graphs and the second graph into a directed acyclic graph that collectively represents both the first regular expression and the second regular expression (act 606). For example, merge module 141 can mere labeled keyword graphs 113L and labeled graph 123L into directed acyclic graph 134. Directed acyclic graph 134 collectively represents regular expression 111 and regular expression 121.
Act 606 includes an act of an act of identifying any similarly positioned intermediate nodes within the one or more keyword graphs and the second graph that have at least partially overlapping character patterns (act 607). For example, position detector 142 can identify similarly positioned intermediate nodes in one more labeled keyword graphs 113L and labeled graph 123L. Similarly positioned nodes can be nodes that are equidistance from their root node. For example, referring to
Among similarly positioned intermediate nodes, overlap detector 143 can detect when nodes have at least partially overlapping character patterns. In
For any identified intermediate nodes in a keyword graph and indentified intermediate nodes in the second graph that are similarly positioned and have partially overlapping character patterns, act 606 includes an act of altering the character pattern of at least one of the indentified intermediate nodes to eliminate the partially overlapping character pattern (act 608). For example, overlap compensator 144 can alter a character pattern at an intermediate node to eliminate a partial overlap with another node. Referring to
For any identified intermediate nodes in a keyword graph and indentified intermediate nodes in the second graph that are similarly positioned and have partially overlapping character patterns, act 606 includes an act of adding an edge between the keyword graph and the second graph to compensate for altering the character pattern of the at least one of the identified intermediate nodes (act 609). For example, overlap compensator 144 can add an edge from a non-altered node to a node below the altered node to compensate for altering the character pattern of the altered node. Referring to
For any identified intermediate nodes in a keyword graph and indentified intermediate nodes in the second graph that are similarly positioned and have fully overlapping character patterns, act 606 includes an act of combining together the keyword graph and the second graph by combining the intermediate node in the keyword graph and the intermediate node in the second graph into a single node representing the fully overlapping character pattern (act 610). For example, overlap compensator 144 can combine an intermediate node of a labeled keyword graph 113L and an intermediate node of labeled graph 123L. Referring to
Subsequent to creation of a DAG, the DAG can be run on a state machine against a portion of text to determine if the portion of text matches any regular expressions represented in the DAG.
In some embodiments, merging graphs is combined with other passes over regular expressions to facilitate expanding regular expression syntax (e.g. *, +, or number sets). For example, when constructing a DAG to represent regular expressions, it is possible that the entirety of a regular expression cannot be represented by DAG. For example, a regular expression can be include characters such as, ?: or nested * operators.
An increasingly complex state machine can be constructed to handle these types of operators. Another alternative is to create multiple “text processors” that include actual regular expressions and a monolithic DAG. The following algorithm can then be used to merge regular expressions:
a. Consider: 123\d\d\d(5.*3)*\d\d\thd
As such, a generated DAG can be used with a regular expression engine to produce results for an entire regular expression alphabet. A multi-pass approach also allows for the execution of look-ahead or look-behind regular expressions without in place backtracking or forward tracking, which simplifies the complexity of the system and helps performance.
Accordingly, embodiments of the invention decompose a regular expression into multiple simple keyword graphs, merge those keyword graphs in a compact and efficient manner, and produce a directed acyclic graph (DAG) that can execute a simplified regular expression alphabet. Several of these regular expression DAG's can then be merged together to produce a single DAG that represents an entire collection of regular expressions. DAGs along with other text processing algorithms and a heap collection can be combined in a multi-pass approach to expand the regular expression alphabet.
The present invention may be embodied in other specific forms without departing from its spirit or essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore, indicated by the appended claims rather than by the foregoing description. All changes which come within the meaning and range of equivalency of the claims are to be embraced within their scope.