Fast gap reduction in policy tree creation for policy set with uneven density

Abstract

A policy tree of nodes and leaves is automatically created from a network security policy set, by identifying density zones of policy subsets. Responsive to identifying an uneven density zone in a node of the policy tree, child nodes are generated with normal density zones from the uneven density zones. A policy bitmap is generated from a set of network security policies. A partition number is configured during bitmap labeling for the policy bitmap. A configurable threshold during bitmap labeling is adjustable according to network security policies. Further, a plurality of boundaries between low-density zones and high-density zones utilizing bitmap labeling on the policy bitmap by counting lead zeros and tail zeros.