Patent ID: 8112415

Claim:
A method of obtaining information using field group unpacking functions comprising: identifying, by a computer device, at least one optimized unpacking function from a plurality of field group unpacking functions by solving a weighted set cover problem using at least one field and a cost, the at least one field being associated with at least one of the plurality of field group unpacking functions, the at least one field being associated with at least one of a plurality of queries, the cost being associated with the at least one of the plurality of field group unpacking functions; unpacking, by the computer device, a field associated with a data stream using the at least one optimized unpacking function; applying, by the computer device, a prefilter to a data stream comprising: determining, by the computer device, at least one predicate to be used with the prefilter, the predicate being associated with the at least one query; determining, by the computer device, a plurality of fields associated with the at least one predicate; determining, by the computer device, at least one prefilter unpacking function by solving the weighted set cover problem using the plurality of fields referenced by the at least one predicate and the plurality of field group unpacking functions; and unpacking, by the computer device, a prefilter field associated with the data stream using the at least one prefilter unpacking function; unpacking, by the computer device, an optimized field associated with the data stream using the at least one optimized unpacking function based on whether the predicate is satisfied by information obtained from unpacking the prefilter field associated with the data stream using the at least one prefilter unpacking function; associating, by the computer device, said at least one optimized unpacking function and said at least one query with each optimized field not unpacked by the prefilter unpacking function, but referenced in at least one query; evaluating, by the computer device, said at least one prefilter unpacking function, and identifying the set of queries remaining that need to be evaluated using said prefilter; and evaluating, by the computer device, said set of queries by using said at least one optimized unpacking function in response to a new packet being received.