Patent ID: 7849051

Claim:
A method for evaluating network data, wherein the network data comprises one or more records, the method comprising: receiving one or more events, each of the events having one or more conditions that, if all satisfied, render the corresponding event satisfied; organizing the events and conditions into metadata data structures for each of the records in the network data; for each field in a field map data structure in the metadata data structures, wherein the field map data structure contains a mapping of field names to a list of conditions specified on the field names: obtaining a list of conditions associated with the field from the field map data structure; for each condition in the list of conditions associated with the field: retrieving a list of events associated with the condition from a condition data structure in the metadata data structures, wherein the condition data structure contains information regarding conditions within the events; adding the list of events associated with the condition to a list of events of interest if the condition is satisfied by the data in the record; adding the list of events associated with the condition to a working set of events; for each of the events in the list of events of interest: incrementing a field representing the number of conditions met for the event in an event data structure in the metadata data structures, wherein the event data structure contains information regarding the events; for each event in the working set of events: determining if the number of conditions for the event is equal to the number of conditions met for the event by examining the event data structure in the metadata data structures; and marking the event as satisfied if the number of conditions for the event is equal to the number of conditions met for the event.