Abstract: Systems and methods are described to address the problem of maintaining only unique data values accessed through name-value tuple sets. A knowledgebase represents data in tuple sets where all the data across the tuples comprise unique instances for memory conservation and system performance purposes. The knowledgebase stores and maintains unique values in a data store structure and represents the values as tuples through the tuple store structure. Modules access tuples and their values through handles called tuple tickets. The knowledge base defines a set of valid data types that can be maintained, and all data types are accessible via a common interface. In addition, memory management is optimized using a system that frees objects that are no longer referenced.

Abstract: A system and method for the transformation of event correlation rules, such as those written in the Effective Policy through Intelligent Correlation (EPIC) Rule Language, into programming constructs that implement the functionality described by the rule. A match network module performs matching of rules by applying a forward chaining algorithm to an evaluation graph by matching network events that have been encapsulated into one or more tickets in the match network module. For every successful matching rule upon one or more network events reflected in tickets, the match network module creates at least one suggested responsive action. Since one input may satisfy multiple rules, a list of suggested responsive actions is created and sent to a conflict resolution module.