Patent ID: 7203744

Claim:
A method for compiling rules for an integrated policy enforcement system for a computer network, the integrated policy enforcement system comprising modules for implementing policies on network traffic, the method comprising the steps of: a. receiving an input, the input comprising description of expressions and values of the expressions; b. processing the input, wherein the step of processing the input comprises: i. creating an expression value tree for the expressions used in the rules; ii. creating an mutually exclusive set of values for an expression based on the expression value tree, wherein the mutually exclusive set of values for the expression is used for creating a modified set of rules; and iii. assigning expression weights to the expressions in the modified set of rules, wherein the expression weights are used for defining a tree generation process; c. generating a rule tree-graph data structure using the tree generation process, the rule tree-graph data structure comprising a tree data structure and a graph data structure, wherein the step of generating the rule tree-graph data structure comprises the steps of: i. creating an expression value matrix based on relations between the expressions and the values of the expressions; ii. receiving a cutoff value; iii. defining the tree generation process based on the cutoff value and the expression weights of the expressions in the modified set of rules; and iv. applying the tree generation process upon the expression value matrix; and d. outputting policy files from the rule tree-graph data structure, the policy files being used by the modules for implementing policies on the network traffic.