什么样的计算机科学概念可以处理多个条件的有效评估？

Question

I have a real world problem i'm trying to solve.

There's an application that processes incoming requests from a network socket.

The requests consist of multiple attribute value pairs.

I want the administrator to be able to filter the debug logging generated by processing those requests, by the attribute value pairs in the request.

The administrator would enter multiple conditions, with each condition mapping to a different output stream eg:

• if ((&user == 'bar') && (&host == 'foo') && (&ip = 192.168.0.1)) -> write debug to fd 9
• if ((&host == 'baz') && (&user == 'bar')) -> write debug to fd 10

Efficient evaluation of the above conditions requires that user only need be evaluated once. eg if (&user != 'bar') then we can stop processing.

It's obvious some sort of tree structure is needed...

I should also mention, that in the scenario i'm describing, there are no side effects from condition evaluation (you cannot perform assignment). So operands to most of the logical operators can be re-ordered without issue.

What is the computer science concept that deals with this problem? It has the smell of something NP complete.

Update: Follow up question. Are there any C libraries or expression languages such as BPF that could help solve the real world problem, or provide a generic implementation of the computer science concept?

Answer 1

I don't know whether this qualifies as "computer science concept", but you could tackle your issue with techniques from data flow planing / synthesis / scheduling. This is especially helpful when your operations have different costs associated (a pattern matching of a string is probably way more expensive than a bit-exact comparison of a byte).

Basically every "atomic" condition (like user == 'bar' ) would become a node in what's (I think) called a sequence graph. Compound conditions ( && and probably || and ! ) then become further nodes in this (directed) graph, with an edge from their operands (nodes) to them.

Nodes can be given "durations", eg a atomic string comparison takes 20 time units, whereas an && of multiple (already evaluated) conditions only takes 1 time unit.

You can then utilize different scheduling algorithms on this graph. Candidates (that I know of) are ASAP (As Soon As Possible), ALAP (As Late As Possible), "List Scheduling" and Force Directed Scheduling .

These scheduling algorithms basically compile your graph into an ordered list, specifying an ideal (or heuristically good) order in which you should evaluate the operands in order to get a result for all (complete) condition expressions. This is not really what you need.

The above scheduling algorithms are designed in order to produce plans when one has limited (hardware) resources (that are capable of executing the operations represented by the nodes) available, but are all concerned evaluating the full expression.

You'd need to extent this to incorporate the probability that a comparison could return a result that makes calculating further nodes pointless. I don't know how, though, so that's something you'd need to figure out yourself.

In order to do this I'd write a program that - given some complex conditions and some (preferably large) test data - finds (stochastic hill climbing, simulated annealing, genetic algorithm) a good schedule such that the mean expected time is good, and then let different (devised from above graph) scheduling algorithms compete against it.

All of the above is about static scheduling, there are also dynamic scheduling algorithms that could make use of the (step by step known) results of the atomic conditions to possibly make better plans.

Answer 2

In general, this is called "boolean algebra". Boolean algebra expressions can be simplified using techniques such as Karnaugh maps or, in general, other circuit minimization techniques . This field goes back to basic digital logic (before digital computers existed) and is very well studied.

In specific cases, like searching through linear log files, you are unlikely to speed up your program because any program searching through unindexed log files is likely to be IO-bound. Or in the case of filtering log entries, the cost of evaluating the filter is likely to be minimal compared to the cost of anything else that your application does.