Correlation analysis expression index analysis method, device and electronic equipment

Abstract

The application provides a correlation analysis expression index analysis method and device and electronic equipment. The method comprises the following steps: obtaining a correlation analysis expression to be analyzed; determining that the correlation analysis expression to be analyzed is a key Boolean expression and an indexable expression at the same time, and determining that the correlation analysis expression to be analyzed has an index, wherein the key Boolean expression is a Boolean expression capable of determining the value of the correlation analysis expression, each indexable expression comprises two identical single-table field expression, the flow table corresponding to each single-table field expression is mutually exclusive, and the fields in each single-table field expression belong to the same flow table. The performance of the correlation analysis can be improved based on the index analysis on the correlation analysis expression corresponding to the data flow, and the search efficiency of the data flow can be improved, thereby improving the efficiency of the network security analysis.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, and electronic device for correlation analysis expression index analysis. Background Technology

[0002] The rapid development of internet technology and the deepening digital transformation of various industries have brought tremendous convenience to people's lives and work. However, with the development of technology and the spread of knowledge, the methods and number of cyberattacks have also increased significantly, with various new attack methods emerging one after another, posing great challenges and pressure to security analysts and products.

[0003] In related technologies, data streams correspond to association analysis expressions. When performing network security analysis on data streams, it is usually necessary to traverse all data in the flow table to find the target data stream. Currently, finding a method to improve the efficiency of data stream lookup based on index analysis of the association analysis expressions corresponding to data streams has become a research hotspot. Summary of the Invention

[0004] This invention provides a method, apparatus, and electronic device for indexing and analyzing association analysis expressions. It enables the improvement of association analysis performance by indexing and analyzing the association analysis expressions corresponding to data streams, thereby improving the search efficiency of data streams and ultimately enhancing the efficiency of network security analysis.

[0005] This invention provides a method for indexing association analysis expressions. The method includes: obtaining an association analysis expression to be analyzed; and determining that the association analysis expression to be analyzed exists when it is determined that the association analysis expression to be analyzed is both a key Boolean expression and an indexable expression. The key Boolean expression is a Boolean expression that can determine the value of the association analysis expression. Each indexable expression includes two identical single-table field expressions, and the flow tables corresponding to each single-table field expression are mutually exclusive. The fields in each single-table field expression belong to the same flow table.

[0006] According to the association analysis expression indexing analysis method provided by the present invention, the association analysis expression to be analyzed includes an association expression; the association analysis expression to be analyzed is determined to be a key Boolean expression by the following method: parsing the association analysis expression to be analyzed into a logic tree, wherein the nodes of the logic tree include association expression definition nodes corresponding to the association expression; traversing each association expression definition node of the logic tree and determining whether the corresponding association expression definition node is a preset Boolean node, wherein the association analysis expression corresponding to the preset Boolean node is a key Boolean expression; if so, then the association expression to be analyzed corresponding to the corresponding association expression definition node of the logic tree is determined to be a key Boolean expression.

[0007] According to the association analysis expression indexing analysis method provided by the present invention, the association analysis expression to be analyzed is determined to be an indexable expression by the following means: after determining that the corresponding association expression definition node is the preset Boolean node, an indexable expression analyzer is invoked to analyze the nodes on the left and right sides of the preset Boolean node, wherein the indexable expression analyzer is configured with indexable expression definition conditions; it is determined whether the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer; if they match, the association analysis expression to be analyzed is determined to be an indexable expression.

[0008] According to the association analysis expression index analysis method provided by the present invention, the method further includes: when the left node of the preset Boolean node matches the indexable expression definition condition in the indexable expression analyzer, setting the left node as the index of the corresponding association analysis expression.

[0009] According to the association analysis expression indexing method provided by the present invention, the method further includes: when the right node of the preset Boolean node matches the indexable expression definition condition in the indexable expression analyzer, setting the right node as the index of the corresponding association analysis expression.

[0010] According to the association analysis expression indexing method provided by the present invention, the indexable expression definition conditions include: a first single-table field expression and a second single-table field expression that are identical, wherein the flow table corresponding to the first single-table field expression is the left table and the flow table corresponding to the second single-table field expression is the right table; the indexable expression analyzer has a built-in first single-table field expression analyzer and a second single-table field expression analyzer, wherein the first single-table field expression analyzer is configured with the first single-table field expression and the second single-table field expression analyzer is configured with the second single-table field expression.

[0011] According to the association analysis expression indexing analysis method provided by the present invention, the step of calling an indexable expression analyzer to analyze the nodes on the left and right sides of the preset Boolean node includes: calling a first single-table field expression analyzer to analyze whether the flow table corresponding to the left node of the preset Boolean node is a left table, and calling a second single-table field expression analyzer to analyze whether the flow table corresponding to the right node of the preset Boolean node is a right table; or, calling the second single-table field expression analyzer to analyze whether the flow table corresponding to the left node of the preset Boolean node is a right table, and calling the first single-table field expression analyzer to analyze whether the flow table corresponding to the right node of the preset Boolean node is a left table.

[0012] According to the association analysis expression indexing method provided by the present invention, determining whether the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer includes: if the first single-table field expression analyzer analyzes the flow table corresponding to the left node of the preset Boolean node as a left table, and the second single-table field expression analyzer analyzes the flow table corresponding to the right node of the preset Boolean node as a right table, then it is determined that the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer; or, if the second single-table field expression analyzer analyzes the flow table corresponding to the left node of the preset Boolean node as a right table, and the first single-table field expression analyzer analyzes the flow table corresponding to the right node of the preset Boolean node as a left table, then it is determined that the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer; otherwise, it is determined that the nodes on the left and right sides of the preset Boolean node do not match the indexable expression definition conditions configured in the indexable expression analyzer.

[0013] According to the association analysis expression index analysis method provided by the present invention, the method further includes: after determining that the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer, counting the reference counts of the left and right tables.

[0014] The present invention also provides an association analysis expression index analysis device, the device comprising: a first module for acquiring an association analysis expression to be analyzed; and a second module for determining that the association analysis expression to be analyzed exists in an index when the association analysis expression to be analyzed is both a key Boolean expression and an indexable expression, wherein the key Boolean expression is a Boolean expression that can determine the value of the association analysis expression, each indexable expression includes two identical single-table field expressions, and the flow tables corresponding to each single-table field expression are mutually exclusive, and the fields in each single-table field expression belong to the same flow table.

[0015] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the association analysis expression index analysis method as described above.

[0016] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the association analysis expression index analysis method as described above.

[0017] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the association analysis expression index analysis method as described above.

[0018] The association analysis expression index analysis method, apparatus, and electronic device provided by this invention can determine that the association analysis expression to be analyzed has an index when it is determined that the association analysis expression to be analyzed is both a key Boolean expression and an indexable expression. This enables the performance of association analysis to be improved by performing index analysis on the association analysis expression to be analyzed corresponding to the data stream, thereby improving the search efficiency of the data stream and thus improving the efficiency of network security analysis. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the association analysis expression index analysis method provided by the present invention;

[0021] Figure 2 This is a flowchart illustrating the process of determining the correlation analysis expression to be analyzed as a key Boolean expression, provided by the present invention.

[0022] Figure 3 This is a flowchart illustrating the process of determining the correlation analysis expression to be analyzed as an indexable expression, provided by the present invention.

[0023] Figure 4 This is a flowchart illustrating the association analysis expression index analysis provided by the present invention;

[0024] Figure 5 This is a schematic diagram of the application process of the indexable expression analyzer provided by the present invention;

[0025] Figure 6 This is a schematic diagram of the application process of the single-table field expression analyzer provided by the present invention;

[0026] Figure 7 This is a schematic diagram of the structure of the association analysis expression index analysis device provided by the present invention;

[0027] Figure 8 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0029] The association analysis expression indexing analysis method provided by this invention corresponds the association analysis expression to a data stream, such as a dual data stream, where the data stream includes network behavior data. In application, the association analysis expression corresponding to the dual data stream can be indexed and analyzed in real time to discover the association analysis expression to be indexed, thereby improving the performance of real-time dual data stream association analysis. Furthermore, it can also improve the data stream search efficiency, thus improving the efficiency of network security analysis.

[0030] Figure 1 This is a flowchart illustrating the association analysis expression index analysis method provided by the present invention.

[0031] To further introduce the association analysis expression index analysis method provided by this invention, the following will be combined with... Figure 1 Please provide an explanation.

[0032] In an exemplary embodiment of the present invention, combined with Figure 1 As can be seen, the association analysis expression index analysis method may include steps 110 and 120, which will be described in detail below.

[0033] In step 110, the correlation analysis expression to be analyzed is obtained.

[0034] In one embodiment, the association analysis expression to be analyzed may correspond to a data stream, such as a dual data stream. The data stream originates from a flow table and may include network behavior data. The structure of the association analysis expression to be analyzed can be defined as join[flow table definition]if[association expression definition]. The expression combination includes two parts: the flow table definition and the association expression definition. In an example, the flow table definition can be expressed as [input stream name]as[flow table name]. For example, stream1as left, stream2 as right, where stream1 and stream2 correspond to the names of two different input data streams respectively, and left and right are the corresponding flow table names. stream1 is defined as left, and stream2 is defined as right. In another example, the association expression can be a Boolean expression, and the result of the expression is true or false. For example, left.sip == right.sip and left.sport < right.sport. The semantics of the expression is that the expression is true when the source ip of the left table is equal to the sip of the right table and the source port of the left table is less than that of the right table, otherwise it is false.

[0035] In step 120, when it is determined that the association analysis expression to be analyzed is both a key Boolean expression and an indexable expression, it is determined that an index exists for the association analysis expression to be analyzed.

[0036] Among them, the key Boolean expression is a Boolean expression that can determine the value of the association analysis expression. Each indexable expression includes two identical single-table field expressions, and the flow tables corresponding to each single-table field expression are mutually exclusive. The fields in each single-table field expression belong to the same flow table.

[0037] In one embodiment, whether an index exists for an association analysis expression needs to meet the following two conditions:

[0038] 1. The association analysis expression contains an indexable expression;

[0039] 2. This indexable expression is also a key Boolean expression. Among them, the key Boolean expression is defined as if an expression is a Boolean expression and the value of the expression can determine the value of the entire association expression, then it is a key Boolean expression. In the example join stream1as left, stream2 as right if left.sip == right.sipand left.sport < right.sport, [left.sip == right.sip] and [left.sport < right.sport] are both key Boolean expressions because they can both determine the value of the entire association expression.

[0040] In another example, an indexable expression can be defined as [single-table field expression] == [single-table field expression], where the flow tables corresponding to the single-table field expression on the left and the single-table field expression on the right are mutually exclusive. That is, if the table corresponding to the single-table field expression on the left is the left table, then the flow table corresponding to the single-table field expression on the right is the right table, and vice versa.

[0041] In another example, a single-table field expression is an expression that contains table field expressions and only includes fields from the same flow table. That is, the expression only references fields from the left table or the right table; the fields from the left and right tables do not exist simultaneously in this expression. For example: `left.dport + left.sport == 80`. Here, only the `dport` and `sport` fields from the left table are used, therefore it is a single-table field expression. However, the following example is not a single-table field expression: `left.dport + right.sport == 80`. Here, both the `dport` fields from the left table and the `sport` fields from the right table are used, therefore it is not a single-table field expression.

[0042] In this embodiment, by determining that the expression to be analyzed has an index, the number of table data that needs to be associated each time can be significantly reduced by building an index, thereby improving the performance of the association analysis.

[0043] The association analysis expression index analysis method provided by this invention can determine that the association analysis expression to be analyzed has an index when it is both a key Boolean expression and an indexable expression. This enables the performance of association analysis to be improved by performing index analysis on the association analysis expression to be analyzed corresponding to the data stream, thereby improving the search efficiency of the data stream and thus improving the efficiency of network security analysis.

[0044] Figure 2 This is a flowchart illustrating the process of determining the association analysis expression to be analyzed as a key Boolean expression, as provided by the present invention.

[0045] To further introduce the association analysis expression index analysis method provided by this invention, the following will be combined with... Figure 2 Please provide an explanation.

[0046] In an exemplary embodiment of the present invention, the correlation analysis expression to be analyzed may include a correlation expression. Combined with... Figure 2 As can be seen, determining the association analysis expression to be analyzed as a key Boolean expression may include steps 210 to 230, which will be described in detail below.

[0047] In step 210, the association analysis expression to be analyzed is parsed into a logic tree, wherein the nodes of the logic tree include the association expression definition nodes corresponding to the association expression.

[0048] In one embodiment, the logic tree may include multiple nodes, which may include: association analysis expression definition nodes and flow table definition nodes. In this embodiment, the focus is on association analysis expression definition nodes.

[0049] In step 220, each association expression definition node of the logic tree is traversed, and it is determined whether the corresponding association expression definition node is a preset Boolean node. The association analysis expression corresponding to the preset Boolean node is the key Boolean expression.

[0050] In step 230, if so, the association expression to be analyzed corresponding to the definition node of the corresponding association expression in the logic tree is determined to be a key Boolean expression.

[0051] In one embodiment, each associative expression definition node in the logic tree can be traversed, and it can be determined whether the corresponding associative expression definition node is a preset Boolean node. In one example, the preset Boolean node can be a node representing the AND operation logic character, such as an AND node. The associative analysis expression corresponding to the preset Boolean node is the key Boolean expression. In application, when the corresponding associative expression definition node is determined, for example, the current associative expression definition node is a preset Boolean node, it can be determined that the associative expression to be analyzed corresponding to the current associative expression definition node is a key Boolean expression. Furthermore, if it is further determined that the associative expression to be analyzed corresponding to the current associative expression definition node is an indexable expression, it can be determined that the associative expression to be analyzed corresponding to the current associative expression definition node has an index.

[0052] Figure 3 This is a flowchart illustrating the process of determining whether an association analysis expression to be analyzed is an indexable expression, as provided by the present invention.

[0053] The following will combine Figure 3 The process of determining whether the association analysis expression to be analyzed is an indexable expression is explained.

[0054] In an exemplary embodiment of the present invention, combined with Figure 3 As can be seen, determining that the association analysis expression to be analyzed is an indexable expression may include steps 310 to 330, which will be described in detail below.

[0055] In step 310, after determining that the corresponding associated expression definition node is a preset Boolean node, the indexable expression analyzer is called to analyze the nodes on the left and right sides of the preset Boolean node. The indexable expression analyzer is configured with indexable expression definition conditions.

[0056] In step 320, it is determined whether the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer.

[0057] In step 330, if a match is found, the association analysis expression to be analyzed is determined to be an indexable expression.

[0058] In one embodiment, after determining that the corresponding association expression definition node is a preset Boolean node, the indexable expression analyzer can be further invoked to analyze the nodes on both sides of the preset Boolean node. If the nodes on both sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer, then the association analysis expression to be analyzed can be determined to be an indexable expression. Since the association analysis expression to be analyzed is also a key Boolean expression, it can be known that the association analysis expression to be analyzed is both a key Boolean expression and an indexable expression, thus it can be determined that the association analysis expression to be analyzed has an index.

[0059] In yet another exemplary embodiment of the present invention, continuing with the foregoing embodiments as an example, the association analysis expression index analysis method may further include the following steps:

[0060] When the left node of a preset Boolean node matches the definition condition of an indexable expression in the indexable expression analyzer, the left node is set as the index of the corresponding association analysis expression.

[0061] In another exemplary embodiment of the present invention, the indexable expression definition conditions may include: an identical first single-table field expression and a second single-table field expression, wherein the flow table corresponding to the first single-table field expression is the left table and the flow table corresponding to the second single-table field expression is the right table.

[0062] The indexable expression analyzer has a built-in first single-table field expression analyzer and a second single-table field expression analyzer. The first single-table field expression analyzer is configured with the first single-table field expression, and the second single-table field expression analyzer is configured with the second single-table field expression.

[0063] In yet another exemplary embodiment of the present invention, continuing with the foregoing embodiments as an example, the association analysis expression index analysis method may further include the following steps:

[0064] When the right node of a preset Boolean node matches the definition condition of an indexable expression in the indexable expression analyzer, the right node is set as the index of the corresponding association analysis expression.

[0065] In one example, the relevant association analysis expression can be the association analysis expression to be analyzed. Through this embodiment, the association analysis expression to be analyzed corresponding to the dual data streams can be indexed in real time, thereby discovering the association analysis expressions that can be indexed and calculated, and improving the performance of real-time dual data stream association analysis.

[0066] Figure 4 This is a flowchart illustrating the association analysis expression index analysis provided by the present invention.

[0067] To further introduce the association analysis expression index analysis method provided by this invention, the following will be combined with... Figure 4 Please provide an explanation.

[0068] In an exemplary embodiment of the present invention, combined with Figure 4 As can be seen, the association analysis expression index analysis can include steps 401 to 414, and each step will be described below.

[0069] In step 401, input the association analysis expression.

[0070] The association analysis expression can correspond to the association analysis expression to be analyzed mentioned above.

[0071] In step 402, the association analysis expression is parsed into an association analysis expression logic tree, and the root node of the logic tree containing the association expression is located.

[0072] In one example, you can enter an association analysis expression, such as join[flow table definition]if[association expression definition].

[0073] In step 403, all logic tree nodes are traversed starting from the root node of the relational expression logic tree.

[0074] In step 404, it is determined whether there are any logic tree nodes that have not been traversed.

[0075] In step 405, if there are logic tree nodes that have not been traversed, then it is determined whether the current logic tree node is an AND node.

[0076] In step 406, if there are no untraversed logical tree nodes, the process ends and an index is marked as not found.

[0077] In one embodiment, all nodes in the logic tree can be traversed to determine whether the current logic tree node is an AND node. Here, an AND node can correspond to the preset Boolean node described above.

[0078] In step 407, if it is determined that the current logic tree node is not an AND node, the analysis of the current logic tree node is skipped.

[0079] In step 408, if the current logic tree node is determined to be an AND node, the indexable expression analyzer is called to analyze the left node of the AND logic tree.

[0080] In one embodiment, if it is determined that the current logic tree node is not an AND node, the analysis of the current logic tree node is skipped, and the left and right nodes of the current logic tree are traversed (corresponding to step 414), so that all nodes can be traversed.

[0081] In another embodiment, when it is determined that the current logic tree node is an AND node, the indexable expression analyzer is invoked to analyze the left node of the AND logic tree.

[0082] It should be noted that the left node and right node of the AND logic tree can correspond to the nodes on the left and right sides of the preset Boolean node mentioned above.

[0083] The indexable expression analyzer is used to analyze indexable expressions. An indexable expression is defined as [single-table field expression] == [single-table field expression], where the flow tables corresponding to the single-table field expressions on the left and right are mutually exclusive. That is, if the table corresponding to the single-table field expression on the left is the left table, then the flow table corresponding to the single-table field expression on the right is the right table, and vice versa.

[0084] In step 409, it is determined whether the return value of the indexable expression is true.

[0085] In step 410, if so, the index of the current association analysis expression is set to the left node of the current logical tree, and the process ends.

[0086] In step 411, if not, the indexable expression analyzer is invoked to analyze the right node of the AND logic tree.

[0087] In step 412, it is determined whether the return value of the indexable expression is true.

[0088] In step 413, if so, the index of the current association analysis expression is set to the right node of the current logic tree, and the process ends.

[0089] In step 214, if not, continue traversing the left and right nodes of the current logic tree.

[0090] In one embodiment, an indexable expression analyzer can be invoked to analyze the left node of the AND logic tree. If the indexable expression returns true, the index of the current association analysis expression is set to the left node of the current logic tree, and the process ends (corresponding to step 410).

[0091] In another embodiment, an indexable expression analyzer can be invoked to analyze the right node of the AND logic tree. If the indexable expression returns true, the index of the current association analysis expression is set to the right node of the current logic tree, and the process ends (corresponding to step 413). If it returns false, the process continues to traverse the left and right nodes of the current logic tree (corresponding to step 414), and then continues to execute step 404.

[0092] In yet another exemplary embodiment of the present invention, the indexable expression analyzer is invoked to analyze the nodes on the left and right sides of a preset Boolean node, which can be achieved in the following way:

[0093] The first single-table field expression analyzer is invoked to analyze whether the flow table corresponding to the left node of the preset Boolean node is a left table, and the second single-table field expression analyzer is invoked to analyze whether the flow table corresponding to the right node of the preset Boolean node is a right table; or, the second single-table field expression analyzer is invoked to analyze whether the flow table corresponding to the left node of the preset Boolean node is a right table, and the first single-table field expression analyzer is invoked to analyze whether the flow table corresponding to the right node of the preset Boolean node is a left table.

[0094] In one embodiment, when it is determined that the flow table types corresponding to the left node and the flow table corresponding to the right node of the preset Boolean node are different (i.e., one is a left table and the other is a right table), it can be determined that the nodes on both sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer. This allows for quick and accurate determination that the association analysis expression to be analyzed is an indexable expression.

[0095] In yet another exemplary embodiment of the present invention, determining whether the nodes on the left and right sides of a preset Boolean node match the definition conditions of an indexable expression configured in the indexable expression analyzer can be achieved in any of the following ways:

[0096] In one embodiment, if the first single-table field expression analyzer analyzes the flow table corresponding to the left node of the preset Boolean node as the left table, and the second single-table field expression analyzer analyzes the flow table corresponding to the right node of the preset Boolean node as the right table, then it is determined that the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer.

[0097] In another embodiment, if the second single-table field expression analyzer analyzes the flow table corresponding to the left node of the preset Boolean node as the right table, and the first single-table field expression analyzer analyzes the flow table corresponding to the right node of the preset Boolean node as the left table, then it is determined that the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer.

[0098] If, after matching using the above two methods, it is found that one of the nodes on the left and right sides of the preset Boolean node is not a left node and the other is a right node (that is, it does not conform to the description of any of the above embodiments), then it is determined that the nodes on the left and right sides of the preset Boolean node do not match the indexable expression definition conditions configured in the indexable expression analyzer.

[0099] This embodiment can quickly and accurately determine whether the association analysis expression to be analyzed is an indexable expression, and thus facilitate the determination of whether the association analysis expression to be analyzed has an index.

[0100] Figure 5 This is a schematic diagram of the application process of the indexable expression analyzer provided by the present invention.

[0101] To further introduce the association analysis expression index analysis method provided by this invention, the following will be combined with... Figure 5 Please provide an explanation.

[0102] In an exemplary embodiment of the present invention, combined with Figure 5 As can be seen, the application process of the indexable expression parser may include steps 510 to 570, which will be described in detail below.

[0103] In step 510, input the logic tree node to be analyzed.

[0104] The logic tree nodes to be analyzed can correspond to the nodes on the left and right sides of the preset Boolean nodes mentioned above.

[0105] In step 520, it is determined whether the current logic tree node is an == expression node.

[0106] In step 530, if the current logic tree node is not an == expression node, the analysis process ends and returns false.

[0107] In step 540, if the current logic tree node is an == expression node, then the single-table field expression analyzer A is called to analyze the left node of the node, and the single-table field expression analyzer B is called to analyze the right node of the node.

[0108] In step 550, it is determined whether the condition is met that analyzer A is the left table and analyzer B is the right table, or analyzer A is the right table and analyzer B is the left table.

[0109] The single-table field expression analyzer can include the `leftTableFieldCount`, `rightTableFieldCount`, and `type` parameters. `leftTableFieldCount` represents the number of times a field in the left table is referenced in the current expression. `rightTableFieldCount` represents the number of times a field in the right table is referenced in the current expression. The `type` parameter has the value [left table / right table / unknown]. Specifically, if the analysis result contains only fields from the left table (i.e., `leftTableFieldCount > 0` and `rightTableFieldCount == 0`), then `type = left table`; if the analysis result contains only fields from the right table (i.e., `leftTableFieldCount == 0` and `rightTableFieldCount > 0`), then `type = right table`; otherwise, `type = unknown`.

[0110] In step 560, if yes, the analysis process ends and returns true.

[0111] In step 570, if not, the analysis process ends and returns false.

[0112] During application, if it is determined that the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer, then the analysis expression to be analyzed that is already a key Boolean expression can be determined as an indexable expression.

[0113] In yet another exemplary embodiment of the present invention, the association analysis expression index analysis method may further include the following steps:

[0114] After determining that the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer, the reference counts of the left and right tables are counted.

[0115] Figure 6 This is a schematic diagram of the application process of the single-table field expression analyzer provided by the present invention.

[0116] The following will combine Figure 6 The application process of the single-table field expression analyzer is explained.

[0117] In an exemplary embodiment of the present invention, combined with Figure 6 As can be seen, the application process of the single-table field expression analyzer can include steps 610 to 690, which will be described in detail below.

[0118] In step 610, input the logic tree node to be analyzed.

[0119] In one embodiment, the logic tree node to be analyzed can be considered as the left node of a preset Boolean node or the right node of a preset Boolean node.

[0120] In step 620, all logic tree nodes are traversed starting from the logic tree node to be analyzed.

[0121] In step 630, it is determined whether there are any logic tree nodes that have not been traversed.

[0122] In step 640, if there are logic tree nodes that have not been traversed, it is determined whether the current logic tree node is a table field expression node.

[0123] In step 650, if there are no logic tree nodes that have not been traversed, then if the reference count of the left table field is greater than 0 and the reference count of the right table field is equal to 0, the type is set to left table; if the reference count of the right table field is greater than 0 and the reference count of the left table field is equal to 0, the type is set to right table; otherwise, it is unknown.

[0124] In step 660, if the current logical tree node is not a table field expression node, the left and right child nodes of the current tree node are analyzed, and the process returns after completion.

[0125] In step 670, if the current logical tree node is a table field expression node, then it is determined whether the current field is a left table field.

[0126] In step 680, if the current field is a field of the left table, then set the reference count of the left table field to the reference count of the left table field plus 1.

[0127] In step 690, if the current field is a right table field, then set the right table field reference count to the right table field reference count plus 1.

[0128] In one embodiment, if there are no logic tree nodes that have not been traversed, then if leftTableFieldCount (the number of references to the left table field) > 0 and rightTableFieldCount (the number of references to the right table field) == 0, then set type = left table; if leftTableFieldCount (the number of references to the left table field) == 0 and rightTableFieldCount (the number of references to the right table field) > 0, then set type = right table; otherwise, set type = unknown, and the process ends after completion.

[0129] As described above, the association analysis expression index analysis method provided by this invention can determine that the association analysis expression to be analyzed has an index when it is both a key Boolean expression and an indexable expression. This enables the performance of association analysis to be improved by performing index analysis on the association analysis expression to be analyzed corresponding to the data stream, thereby improving the search efficiency of the data stream and thus improving the efficiency of network security analysis.

[0130] The data flow table analysis apparatus provided by the present invention is described below. The data flow table analysis apparatus described below can be referred to in correspondence with the data flow table analysis method described above.

[0131] Figure 7 This is a schematic diagram of the structure of the association analysis expression index analysis device provided by the present invention.

[0132] In an exemplary embodiment of the present invention, combined with Figure 7 As can be seen, the association analysis expression index analysis device may include a first module 710 and a second module 720, and each module will be described below.

[0133] The first module 710 can be configured to obtain the association analysis expression to be analyzed.

[0134] The second module 720 can be configured to determine if the association analysis expression to be analyzed exists in an index when it is both a key Boolean expression and an indexable expression. The key Boolean expression is a Boolean expression that can determine the value of the association analysis expression. Each indexable expression includes two identical single-table field expressions, and the flow tables corresponding to each single-table field expression are mutually exclusive. The fields in each single-table field expression belong to the same flow table.

[0135] In an exemplary embodiment of the present invention, the correlation analysis expression to be analyzed may include a correlation expression;

[0136] The second module 720 can determine the key Boolean expression to be analyzed as the correlation analysis expression in the following way:

[0137] The association analysis expression to be analyzed is parsed into a logic tree, where the nodes of the logic tree include the association expression definition nodes corresponding to the association expression;

[0138] Traverse each association expression definition node in the logic tree and determine whether the corresponding association expression definition node is a preset Boolean node. The association analysis expression corresponding to the preset Boolean node is the key Boolean expression.

[0139] If so, then the association expression to be analyzed corresponding to the definition node of the association expression in the logic tree is determined to be the key Boolean expression.

[0140] In an exemplary embodiment of the present invention, the second module 720 may determine that the association analysis expression to be analyzed is an indexable expression in the following manner:

[0141] After determining that the corresponding associated expression definition node is a preset Boolean node, the indexable expression analyzer is called to analyze the nodes on the left and right sides of the preset Boolean node. The indexable expression analyzer is configured with indexable expression definition conditions.

[0142] Determine whether the nodes on the left and right sides of the preset Boolean node match the definition conditions of the indexable expression configured in the indexable expression analyzer.

[0143] If a match is found, the association analysis expression to be analyzed is determined to be an indexable expression.

[0144] In an exemplary embodiment of the present invention, the second module 720 may further be configured to:

[0145] When the left node of a preset Boolean node matches the definition condition of an indexable expression in the indexable expression analyzer, the left node is set as the index of the corresponding association analysis expression.

[0146] In an exemplary embodiment of the present invention, the second module 720 may further be configured to:

[0147] When the right node of a preset Boolean node matches the definition condition of an indexable expression in the indexable expression analyzer, the right node is set as the index of the corresponding association analysis expression.

[0148] In an exemplary embodiment of the present invention, the indexable expression definition conditions may include: a first single-table field expression and a second single-table field expression that are identical, wherein the flow table corresponding to the first single-table field expression is the left table and the flow table corresponding to the second single-table field expression is the right table; the indexable expression analyzer has a built-in first single-table field expression analyzer and a second single-table field expression analyzer, wherein the first single-table field expression analyzer is configured with the first single-table field expression and the second single-table field expression analyzer is configured with the second single-table field expression.

[0149] In an exemplary embodiment of the present invention, the second module 720 can invoke the indexable expression analyzer to analyze the nodes on the left and right sides of a preset Boolean node in the following manner:

[0150] The first single-table field expression analyzer is invoked to analyze whether the flow table corresponding to the left node of the preset Boolean node is a left table, and the second single-table field expression analyzer is invoked to analyze whether the flow table corresponding to the right node of the preset Boolean node is a right table; or, the second single-table field expression analyzer is invoked to analyze whether the flow table corresponding to the left node of the preset Boolean node is a right table, and the first single-table field expression analyzer is invoked to analyze whether the flow table corresponding to the right node of the preset Boolean node is a left table.

[0151] In an exemplary embodiment of the present invention, the second module 720 may determine whether the nodes on the left and right sides of the preset Boolean node match the definition conditions of the indexable expression configured in the indexable expression analyzer in the following manner:

[0152] If the first single-table field expression analyzer determines that the flow table corresponding to the left node of the preset Boolean node is a left table, and the second single-table field expression analyzer determines that the flow table corresponding to the right node of the preset Boolean node is a right table, then it is determined that the nodes on both sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer; or, if the second single-table field expression analyzer determines that the flow table corresponding to the left node of the preset Boolean node is a right table, and the first single-table field expression analyzer determines that the flow table corresponding to the right node of the preset Boolean node is a left table, then it is determined that the nodes on both sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer; otherwise, it is determined that the nodes on both sides of the preset Boolean node do not match the indexable expression definition conditions configured in the indexable expression analyzer.

[0153] In an exemplary embodiment of the present invention, the second module 720 may further be configured to:

[0154] After determining that the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer, the reference counts of the left and right tables are counted.

[0155] Figure 8 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 8As shown, the electronic device may include a processor 810, a communications interface 820, a memory 830, and a communication bus 840. The processor 810, communications interface 820, and memory 830 communicate with each other via the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute an association analysis expression indexing analysis method. The method includes: obtaining an association analysis expression to be analyzed; and determining that the association analysis expression to be analyzed exists if it is both a key Boolean expression and an indexable expression. The key Boolean expression is a Boolean expression that determines the value of the association analysis expression. Each indexable expression includes two identical single-table field expressions, and the flow tables corresponding to each single-table field expression are mutually exclusive. The fields in each single-table field expression belong to the same flow table.

[0156] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0157] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the association analysis expression indexing analysis method provided by the above methods. The method includes: obtaining an association analysis expression to be analyzed; determining that the association analysis expression to be analyzed exists if it is determined that the association analysis expression to be analyzed is both a key Boolean expression and an indexable expression. The key Boolean expression is a Boolean expression that can determine the value of the association analysis expression. Each indexable expression includes two identical single-table field expressions, and the flow tables corresponding to each single-table field expression are mutually exclusive. The fields in each single-table field expression belong to the same flow table.

[0158] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the association analysis expression indexing analysis method provided by the above methods. The method includes: obtaining an association analysis expression to be analyzed; and determining that the association analysis expression to be analyzed exists when it is determined that the association analysis expression to be analyzed is both a key Boolean expression and an indexable expression. The key Boolean expression is a Boolean expression that can determine the value of the association analysis expression, and each indexable expression includes two identical single-table field expressions, and the flow tables corresponding to each single-table field expression are mutually exclusive, and the fields in each single-table field expression belong to the same flow table.

[0159] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0160] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0161] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for analyzing the index of an association analysis expression, characterized in that, The method includes: Obtain the association analysis expression to be analyzed; If the association analysis expression to be analyzed is determined to be both a key Boolean expression and an indexable expression, then it is determined that the association analysis expression to be analyzed has an index. The key Boolean expression is a Boolean expression that can determine the value of the association analysis expression. Each indexable expression includes two identical single-table field expressions, and the flow tables corresponding to each single-table field expression are mutually exclusive. The fields in each single-table field expression belong to the same flow table. The association analysis expression to be analyzed includes an association expression. The key Boolean expression to be analyzed is determined by the following method: The association analysis expression to be analyzed is parsed into a logic tree, wherein the nodes of the logic tree include the association expression definition nodes corresponding to the association expression; Traverse each association expression definition node of the logic tree and determine whether the corresponding association expression definition node is a preset Boolean node. The association analysis expression corresponding to the preset Boolean node is a key Boolean expression. If so, then the association expression to be analyzed corresponding to the definition node of the corresponding association expression in the logic tree is determined to be a key Boolean expression.

2. The association analysis expression index analysis method according to claim 1, characterized in that, The association analysis expression to be analyzed is determined to be an indexable expression in the following way: After determining that the corresponding associated expression definition node is the preset Boolean node, the indexable expression analyzer is called to analyze the nodes on the left and right sides of the preset Boolean node. The indexable expression analyzer is configured with indexable expression definition conditions. Determine whether the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer; If a match is found, the association analysis expression to be analyzed is determined to be an indexable expression.

3. The association analysis expression index analysis method according to claim 2, characterized in that, The method further includes: When the left node of the preset Boolean node matches the definition condition of the indexable expression in the indexable expression analyzer, the left node is set as the index of the corresponding association analysis expression.

4. The association analysis expression index analysis method according to claim 2, characterized in that, The method further includes: When the right node of the preset Boolean node matches the definition condition of the indexable expression in the indexable expression analyzer, the right node is set as the index of the corresponding association analysis expression.

5. The association analysis expression index analysis method according to claim 2, characterized in that, The indexable expression definition conditions include: an identical first single-table field expression and a second single-table field expression, wherein the flow table corresponding to the first single-table field expression is the left table and the flow table corresponding to the second single-table field expression is the right table; The indexable expression analyzer includes a first single-table field expression analyzer and a second single-table field expression analyzer. The first single-table field expression analyzer is configured with the first single-table field expression, and the second single-table field expression analyzer is configured with the second single-table field expression.

6. The association analysis expression index analysis method according to claim 5, characterized in that, The step of calling the indexable expression analyzer to analyze the nodes on the left and right sides of the preset Boolean node includes: The first single-table field expression analyzer is invoked to analyze whether the flow table corresponding to the left node of the preset Boolean node is a left table, and the second single-table field expression analyzer is invoked to analyze whether the flow table corresponding to the right node of the preset Boolean node is a right table. or, The second single-table field expression analyzer is invoked to analyze whether the flow table corresponding to the left node of the preset Boolean node is a right table, and the first single-table field expression analyzer is invoked to analyze whether the flow table corresponding to the right node of the preset Boolean node is a left table.

7. The association analysis expression index analysis method according to claim 6, characterized in that, The step of determining whether the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer includes: If the first single-table field expression analyzer analyzes the flow table corresponding to the left node of the preset Boolean node as a left table, and the second single-table field expression analyzer analyzes the flow table corresponding to the right node of the preset Boolean node as a right table, then it is determined that the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer. or, If the second single-table field expression analyzer analyzes the flow table corresponding to the left node of the preset Boolean node as the right table, and the first single-table field expression analyzer analyzes the flow table corresponding to the right node of the preset Boolean node as the left table, then it is determined that the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer. Otherwise, it is determined that the nodes on the left and right sides of the preset Boolean node do not match the indexable expression definition conditions configured in the indexable expression analyzer.

8. The association analysis expression index analysis method according to claim 7, characterized in that, The method further includes: After determining that the nodes on the left and right sides of the preset Boolean node match the indexable expression definition conditions configured in the indexable expression analyzer, the reference counts of the left and right tables are counted.

9. A correlation analysis expression index analysis device, characterized in that, The apparatus is used to implement the association analysis expression index analysis method according to any one of claims 1 to 8, and the apparatus comprises: The first module is used to obtain the association analysis expression to be analyzed. The second module is used to determine that the association analysis expression to be analyzed exists in an index when it is both a key Boolean expression and an indexable expression. The key Boolean expression is a Boolean expression that can determine the value of the association analysis expression. Each indexable expression includes two identical single-table field expressions, and the flow tables corresponding to each single-table field expression are mutually exclusive. The fields in each single-table field expression belong to the same flow table.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the association analysis expression index analysis method as described in any one of claims 1 to 8.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the association analysis expression index analysis method as described in any one of claims 1 to 8.

Images