Data query method and query client

Abstract

The embodiment of the present invention provides a method for data query and a query client. The method includes: the query client receives a first query request, the first query request carries a target service identifier, and is used to request to query the data corresponding to the target service identifier; the query client determines the target directory identifier corresponding to the target service identifier, and the target directory identifier belongs to the M directory identifiers; the query client determines whether there is a corresponding table entry for the target directory identifier; if there is a corresponding table entry for the target directory identifier, the query client determines whether there is a table entry including the target service identifier in the table entry corresponding to the target directory identifier; if there is no table entry including the target service identifier in the table entry corresponding to the target directory identifier, the query client determines that there is no data corresponding to the target service identifier in the data query system. The embodiment of the present application can improve the performance of the existing data query solution.

Description

[0001] This application is a divisional application of the application document with application number 201611220041.7, application date December 26, 2016, and name “Data Query Method and Query Client”. Technical Field

[0002] The embodiments of the present invention relate to the field of computers, and more specifically, to a data query method and a query client. Background Art

[0003] File reputation refers to the security level of a file. A harmless document has a higher reputation level, while a malicious program has a lower reputation level. File reputation can be represented by a numerical value, and a file can be identified by a hash. In this way, security vendors can query the corresponding file reputation value based on the file's identifier, and then determine whether the file is safe based on the file reputation value. For example, if the range of file reputation is defined as 0-100, the lower the file reputation value corresponding to the file identifier, the lower the reputation, that is, the worse the security of the file.

[0004] The cache of the query client can only maintain a small amount of data information, and all data information is stored in the query server. Therefore, when users of the prior art perform data information queries, such as querying the reputation value of a file, the query hit rate in the client's cache is relatively low. When the client's cache does not store the reputation value of the file, the client needs to trigger a remote query, that is, query the query server for the file reputation value. The low local hit rate of the prior art will lead to frequent triggering of remote queries, which, on the one hand, occupies more network transmission resources, and on the other hand, takes a long time to wait for the query results. Therefore, the existing query solution is not efficient. Summary of the invention

[0005] The embodiments of the present application provide a data query method and a query client, which can improve the performance of existing data query solutions.

[0006] In a first aspect, a method for data query is provided, the method being applied to a data query system including a query client and a query server, the query client including a client cache, the query server including a server cache, the client cache including M directory identifiers, each of the N directory identifiers in the client cache corresponding to at least one table entry, each of the at least one table entry including a service identifier and data corresponding to the service identifier, M and N being positive integers, M>N≥1, no corresponding table entry exists for directory identifiers other than the N directory identifiers in the M directory identifiers in the client cache, the server cache including the M directory identifiers, and the table entry corresponding to the first directory identifier in the N directory identifiers in the client cache is the same as the table entry in the server cache. The method includes: the query client receives a first query request, the first query request carries a target business identifier, and is used to request a query for data corresponding to the target business identifier; the query client determines a target directory identifier corresponding to the target business identifier, and the target directory identifier belongs to the M directory identifiers; the query client determines whether there is a corresponding table entry for the target directory identifier; if there is a corresponding table entry for the target directory identifier, the query client determines whether there is a table entry including the target business identifier in the table entry corresponding to the target directory identifier; if there is no table entry including the target business identifier in the table entry corresponding to the target directory identifier, the query client determines that the data corresponding to the target business identifier does not exist in the data query system.

[0007] In the embodiment of the present application, since the table entries corresponding to the same directory identifier in the query client and the query server are the same, when the query client determines that the target business identifier does not exist in the table entry corresponding to the target directory identifier in the local cache, the query server also does not have the target business identifier. In this way, the query client does not need to send a query request to the query server, thereby avoiding remote queries, thereby improving the performance of existing data query solutions.

[0008] In some possible implementations, the method also includes: if there is no corresponding table entry for the target directory identifier, sending a second query request to the query server, the second query request carrying the target business identifier; the query client receives the query result, the query result including data corresponding to the target business identifier or query failure indication information.

[0009] When the query client determines that there is no corresponding table entry for the target directory identifier, that is, the number of table entries corresponding to the target directory identifier is 0, the query client sends a query request (represented as a second query request) to the query server, and the query server performs a data query according to the second query request and generates a data query result, which the query client receives. The table entry corresponding to the directory identifier in the query client does not exist, or is exactly the same as the table entry corresponding to the directory identifier in the query server. In this way, when the table entry corresponding to the directory identifier does not exist, the query server is directly requested to query, which avoids requesting the query server again when the corresponding table entry does not exist after the query client queries, saving delay.

[0010] In some possible implementations, the method also includes: if there is a table entry including the target business identifier in the table entry corresponding to the target directory identifier, the method also includes: the query client obtains data in the table entry including the target business identifier; and uses the obtained data as data corresponding to the target business identifier.

[0011] Since the table entry corresponding to the target service identifier in the query client is the same as the table entry corresponding to the target service identifier in the query server, the query client can complete the data query in the local cache, thereby improving the efficiency of data query.

[0012] In some possible implementations, the method also includes: the query client receives a first update request, the first update request carries the first directory identifier, and the first update request is used to request deletion of a table entry corresponding to the first directory identifier; the query client deletes all table entries corresponding to the first directory identifier according to the first update request.

[0013] When the query client deletes the table entry corresponding to the directory identifier, it deletes all the table entries corresponding to a certain directory identifier as a unit to avoid the situation where the table entry corresponding to a certain directory identifier in the query client is not zero and is not the same as the table entry corresponding to the directory identifier in the query server. In this way, the query client can maintain the storage method to reduce the proportion of remote queries performed by the query client, thereby improving the performance of existing data query solutions.

[0014] In some possible implementations, the method also includes: the query client receives a second update request sent by the query server, the second update request carries the first directory identifier and all table entries corresponding to the first directory identifier in the query server, and the second update request is used to request an update of the table entries corresponding to the first directory identifier of the query client; the query client replaces all table entries currently corresponding to the first directory identifier with all table entries included in the second update request.

[0015] When the query client adds a table entry corresponding to a directory identifier, it adds it in units of all the table entries corresponding to the directory identifier in the query server, so as to avoid the situation where the table entry corresponding to a directory identifier in the query client is not zero and is not the same as the table entry corresponding to the directory identifier in the query server. In this way, the query client can maintain the storage method to reduce the proportion of remote queries performed by the query client, thereby improving the performance of existing data query solutions.

[0016] In some possible implementations, the service identifier included in each of the at least one table entry is a file identifier, and the data included in each of the at least one table entry is a reputation value.

[0017] In some possible implementations, the file identifier is a hash value of a predetermined length, the first k digits of the hash values ​​of each table entry corresponding to a directory identifier among the N directory identifiers are the same, and a directory identifier among the N directory identifiers is the first k digits of the hash values ​​included in each table entry corresponding to the directory identifier, k is a positive integer, and k≥1.

[0018] In a second aspect, a query client is provided, which has the function of implementing the method described in the first aspect or any possible implementation of the first aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the steps described in the method described in the first aspect or any possible implementation of the first aspect.

[0019] In a third aspect, a data query system is provided, the data query system comprising:

[0020] The query client and query server of the second aspect above.

[0021] According to a fourth aspect, a computer storage medium is provided, in which a program code is stored. The program code is used to indicate instructions for executing the data query method in the first aspect or any possible implementation of the first aspect.

[0022] Based on the above technical solution, the query client receives a first query request, the first query request carries a target business identifier, determines the target directory identifier corresponding to the target business identifier, and determines whether there is a corresponding table entry for the target directory identifier. If the number of table entries corresponding to the target directory identifier is not zero, it is determined whether there is a table entry including the target business identifier in the table entry corresponding to the target directory identifier. If it is determined that there is no table entry including the target business identifier in the table entry corresponding to the target directory identifier, it is determined that the data corresponding to the target business identifier does not exist in the data query system. In this way, the query client does not need to send a query request to the query server, thereby avoiding remote query, thereby improving the performance of existing data query solutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a reputation query scenario;

[0024] Figure 2 It is another reputation query scenario;

[0025] Figure 3 This is the architecture diagram of the reputation query system;

[0026] Figure 4 It is a flow chart of reputation query in traditional scheme;

[0027] FIG5(a) and FIG5(b) are schematic diagrams of examples of querying a local cache of a client;

[0028] Figure 6 This is a schematic diagram of the structure of cache storage in the traditional solution;

[0029] FIG. 7( a ) and FIG. 7( b ) respectively show schematic diagrams of the structure of the cache of the query server and the cache of the query client in the traditional solution;

[0030] FIG8(a) and FIG8(b) respectively show detailed schematic diagrams of the internal structure of querying the server cache and querying the client cache in the traditional solution;

[0031] Fig. 9 It is a schematic flow chart of cache query in traditional scheme;

[0032] Fig.10 is a schematic flow chart of a data query method according to an embodiment of the present application;

[0033] 11(a) and 11(b) are structural diagrams of the corresponding relationship between the Hash bucket and the Hash linked list in the query server and the query client in the embodiment of the present application;

[0034] 12(a) and 12(b) are detailed structural diagrams of the corresponding relationship between the Hash bucket and the Hash linked list in the query server and the query client in the embodiment of the present application;

[0035] Fig.13 is a schematic flow chart of a cache update example according to an embodiment of the present application;

[0036] Fig.14 is a schematic flow chart of a cache update example according to another embodiment of the present application;

[0037] Fig.15 is an interactive flow chart of a data query method according to another embodiment of the present application;

[0038] Fig.16 is a schematic block diagram of a query client according to an embodiment of the present application;

[0039] Fig.17 is a schematic block diagram of a data query system according to an embodiment of the present application;

[0040] Fig.18 It is a structural diagram of the query client of an embodiment of the present application. DETAILED DESCRIPTION

[0041] The technical solutions in the embodiments of the present invention will be described below in conjunction with the accompanying drawings.

[0042] File reputation refers to the security level of a file. A harmless document has a higher reputation level, while a malicious program has a lower reputation level. File reputation can be represented by a numerical value, and a file can be uniquely identified by a hash. For example, if the range of file reputation is defined as 0-100, the lower the value, the lower the reputation, that is, the worse the security.

[0043] For example, for a file whose file identifier (MD5) Hash is 951c651b601e96af06409ef114a852af, the file reputation value of the file is 90, which can be expressed as 951c651b601e96af06409ef114a852af:90.

[0044] Security vendors usually include many malicious files and many harmless files. The number is very large, usually reaching hundreds of millions. These vendors will evaluate the security level of each file and determine the corresponding reputation value. The reputation records of all files form a reputation library.

[0045] Security vendors express the security level of files through reputation databases and provide a fast method to query the reputation database, called file reputation query. In other words, file reputation query can be applied to some security devices, and the results of file reputation query can be used to assist in threat determination, such as firewalls. Specifically, some software can determine whether a newly received file is a malicious file by querying file reputation. Security vendors will provide a reputation query service on the Internet, and firewalls and networked hosts can use this reputation query service to query reputation.

[0046] Figure 1 This is a reputation query scenario. Figure 1 As shown, it includes a reputation query service 110, a firewall 120, and a host 130. The firewall 120 can query the file reputation value corresponding to a certain file from the reputation query service 110; the host 130 can also query the file reputation value corresponding to a certain file from the reputation query service 110.

[0047] Furthermore, we can Figure 1 The application scenario shown is abstracted as Figure 2 The application scenario shown includes a query server 210 and a query client 220 , that is, the query client 220 can query the file reputation value corresponding to a certain file through the query server 210 .

[0048] For example, the file reputation is abstracted into a query of a keyword (key): a reference value (value), where the key is the file Hash and the value is the file reputation value. In this way, each key corresponds to a value, that is, the query client 220 can query the corresponding value through a key.

[0049] It should be understood that the present application is not limited to file reputation query, and may also be Internet Protocol (IP) reputation query, for example, IP is the key, the corresponding IP reputation is the value, or other reputation query. For ease of description, the present application embodiment takes file reputation query as an example for explanation.

[0050] It should also be understood that the query client in the embodiment of the present application can be any device or software that needs to query data, and the embodiment of the present application does not limit this. The server in the embodiment of the present application can be a cloud server, a server on the Internet, or other servers that store data through the network, such as a network disk, and the present application does not limit this.

[0051] Since the scale of reputation data is very large, the query client can only maintain a smaller cache in the local memory, while the full amount of reputation data is maintained by the reputation query server. Figure 3 This is the architecture diagram of the reputation query system, such as Figure 3 As shown, the reputation query system includes a query server 310 and a query client 320. Among them, the query server 310 includes a server cache 311 and a server query module 312, and the query client 320 includes a client cache 321 and a client query module 322. In this application, the client cache 321 can also be called a local cache, and the following embodiments do not distinguish between them. The local cache has a relatively small amount of memory, but the query delay is at the microsecond level, and the delay is short; while the server cache 311 includes a full amount of memory, the query delay is tens of milliseconds, and the delay is longer.

[0052] like Figure 4 As shown in the figure, the specific process of reputation query is as follows:

[0053] 401, the query client first searches in the local cache. In this embodiment, the local cache refers to the cache in the client device;

[0054] 402, determine whether the cache can be hit, if the corresponding reputation data can be queried, the process ends and executes step 405;

[0055] 403, if not found, perform a remote query, for example, Figure 3 The query server 310 in the example needs to perform a reputation query in the server cache 311 through the server query module 312;

[0056] 404, waiting for the query result, if it is a hit, the reputation value is received; if it is not a hit, the query failure result is received. Regardless of whether it is a hit or not, step 405 is executed.

[0057] 405, credit query ended.

[0058] The local cache hit rate is relatively low, and most of them need remote query. For example, the size of the collected file reputation database is 100 million, that is, there are 100 million records in the file reputation database, and the size of the query client local cache is 10 million records, that is, the circles in Figure 5(a) and Figure 5(b) are regarded as the data space occupied by all files in the world, and the points in the circle in Figure 5(a) are regarded as the collected files. The total number of files in the world is much greater than 100 million, and the collected 100 million files can only occupy a small part in the data space, and the points in the circle in Figure 5(b) are regarded as local cache.

[0059] When the query client queries the local cache, the hit rate is:

[0060] Cache hit rate = local cache size / data space size * 100%

[0061] Assuming that the data space size is 10 billion, which may actually be much larger than 10 billion, and new files are constantly generated, the local cache hit rate is:

[0062] Cache hit rate = 10 million / 10 billion*100% = 0.1%

[0063] Correspondingly, the proportion of remote queries is:

[0064] Remote query ratio = 1-cache hit rate = 1-0.1% = 99.9%

[0065] Therefore, the role of local cache is minimal. Local cache caches single records, such as single table items. When querying the local cache, it is considered a hit only after a certain record is accurately hit. Otherwise, remote query needs to be triggered.

[0066] Figure 6 FIG. 1 shows a schematic diagram of the structure of cache storage in a traditional solution. Figure 6 As shown in the figure, the Hash linked list is used as an example. The Hash bucket is equivalent to a directory, and the buckets are divided according to the first 4 bits of the file identifier (MD5). All MD5 values ​​starting with 0000 are hung under the first bucket in the form of a linked list, and each MD5 value is a table entry in the Hash linked list. In the traditional solution, the cache is updated in units of table entries, such as deleting an entry or adding an entry.

[0067] Figure 7(a) and Figure 7(b) respectively show the structural diagrams of the server cache and client cache in the traditional solution. Figure 7(a) shows that the server cache includes all records in the reputation library added to the Hash linked list; Figure 7(b) shows the Hash linked list of the local cache. The bucket identifier and number of the server cache and the local cache are the same, but the local cache of the first bucket only retains one table entry, while the server cache has four corresponding table entries.

[0068] Figure 8(a) and Figure 8(b) respectively show the detailed internal structure diagrams of the server cache and the local cache in the traditional solution. In the 0000Hash bucket, the local cache has one entry and the server cache has four entries. For example, the MD5 value of a file is 0000eb90e1544e20 c053574aa96fa741. Fig. 9 As shown, the specific cache query steps are as follows:

[0069] 901. The number of the calculated hash bucket is 0000.

[0070] 902. Find the hash bucket numbered 0000;

[0071] 903. Traverse the linked list of the Hash bucket 0000 in the local cache to search;

[0072] 904. Determine whether it is found. If 0000eb90e1544e20c053574aa96fa741 is not found, execute step 905. If 0000eb90e1544e20c053574aa96fa741 is found, execute step 907.

[0073] 905. Start remote query;

[0074] 906. Waiting for remote query results.

[0075] 907. End cache query.

[0076] Therefore, in the traditional solution, as long as the MD5 is not accurately hit in the local cache, a remote query is required. The MD5 of the local cached files only accounts for a small part, and many newly generated files are not included in the local cache, so the proportion of accurate MD5 hits is very small.

[0077] Fig.10 A schematic flow chart of a data query method according to an embodiment of the present application is shown.

[0078] 1001. A query client receives a first query request, where the first query request is used to request to query data corresponding to a target service identifier.

[0079] The embodiment of the present application is applied to a data query system, which includes a query client and a query server. The query client can be Figure 2 Query client 220 or Figure 3 The query client 320 in the query server may be Figure 2 The query server 210 or Figure 3 The query server 310 in the query client includes a client cache and a client query module, where the client query module can be Figure 3 The reputation query 322 in the query server includes a server cache and a server query module, where the server query module can be Figure 3 Reputation query 312 in.

[0080] The client cache includes M directory identifiers, which is equivalent to forming a directory table. Among the M directory identifiers, each directory identifier in N directory identifiers corresponds to at least one table entry, M and N are positive integers, and M>N≥1. Among the M directory identifiers, there is no corresponding table entry for the other directory identifiers except the N directory identifiers, that is, the number of corresponding table entries is 0.

[0081] It should be understood that the M directory identifiers may be different, and the table entries corresponding to the N directory identifiers may also be different, but the present application is not limited to this.

[0082] The server cache also includes M directory identifiers that are the same as the directory identifiers included in the client cache, and each of the M directory identifiers included in the server cache corresponds to at least one table entry. In addition, the first directory identifier among the N directory identifiers in the client cache is the same as the table entry corresponding to the first directory identifier in the server cache, and the first directory identifier is any directory identifier among the N directory identifiers, that is, the N directory identifiers included in the client cache correspond one-to-one and are the same as the N directory identifiers included in the server cache, and the table entries corresponding to each group of directory identifiers are the same. The same table entries here can be the same number and type of table entries.

[0083] The query client receives a first query request, and the first query request carries a certain service identifier, which can be represented as a target service identifier, so that the first query request is used to request to query the data corresponding to the target service identifier. The table item includes the service identifier and the data corresponding to the service identifier. The service identifier can be a mark of various services, and the identifier can be a digital mark or a keyword mark, for example, a file identifier, an IP address, etc. The data corresponding to the service identifier can be a reputation value corresponding to the service identifier, etc.

[0084] For example, the table entry includes a file identifier and a reputation value corresponding to the file identifier; or the table entry includes an IP address and an IP reputation corresponding to the IP address.

[0085] It should be noted that the first query request may be generated by the query client receiving information manually input by the user according to needs, or may be triggered by a message sent by some security application, etc. This application does not limit this.

[0086] It should be understood that the table entries in the embodiments of the present application may also be referred to as "nodes", and the embodiments of the present application do not limit this.

[0087] 1002. The query client determines a target directory identifier corresponding to the target service identifier, where the target directory identifier belongs to the M directory identifiers.

[0088] The query client receives the first query request and can determine the target directory identifier of the target service identifier. The target directory identifier is equivalent to classifying different service identifiers.

[0089] Optionally, the file identifier can be a hash value obtained by performing a hash operation on the file, so that the directory identifier can be composed of the first k bits of the hash values ​​respectively included in multiple table entries corresponding to the directory identifier, k is a positive integer, and k≥1. At this time, the directory identifier is called a hash bucket identifier, that is, file identifiers with the same first k bits will belong to the same hash bucket.

[0090] For example, when the first query request is used to query the directory identifier corresponding to the file identifier 0000d057c8335e8170766270fbc27543, the query client can first use the first four digits 0000 of the file identifier as the directory identifier, and then query whether there is an entry containing the target service identifier among all the entries corresponding to the directory identifier 0000.

[0091] It should be understood that the query client may determine the directory identifier of the service identifier by the above method, or by other marks or keywords on the service identifier, and this application does not limit this.

[0092] It should also be understood that if the target service identifier does not belong to the service identifiers included in all the entries corresponding to the M directory identifiers, data cannot be queried in the data query system.

[0093] 1003, the query client determines whether there is a corresponding table entry for the target directory identifier.

[0094] Not every directory identifier in the query client has a corresponding table entry. In the embodiment of the present application, the query client receives a first query request that carries a target service identifier. After determining the target directory identifier based on the first query request, it is necessary to determine whether there is a corresponding table entry for the target directory identifier.

[0095] Optionally, when the query client determines that there is no corresponding table entry for the target directory identifier, that is, the number of table entries corresponding to the target directory identifier is 0, the query client sends a second query request to the query server, and the query server performs a data query according to the second query request and generates a data query result. For example, when the query server finds data corresponding to the target business identifier in the cache of the query server, a first query result is generated, and the first query result includes the data corresponding to the target business identifier; when the query server does not find data corresponding to the target business identifier in the cache of the query server, a second query result is generated, and the second query result includes query failure indication information.

[0096] It should be noted that the second query request may only carry the same target service identifier as the first query request, so that the query server performs the same operation as the query client, that is, the query server needs to determine the target directory identifier corresponding to the target service identifier, and then query whether the target service identifier exists according to the table item corresponding to the target directory identifier;

[0097] Alternatively, the second query request carries not only the target service identifier but also the target directory identifier. The query server can directly query whether the target service identifier exists in the table item corresponding to the target directory identifier. In this way, the query server does not need to determine the target directory identifier corresponding to the target service identifier based on the query request, thereby reducing the query delay and saving the power consumption of the server query.

[0098] Optionally, as long as there is a corresponding table entry for the target directory identifier in the query client, the table entry corresponding to the target business identifier in the query client is exactly the same as the table entry corresponding to the target business identifier in the query server. In this way, the query client can complete the data query in the local cache, thereby improving the efficiency of data query.

[0099] 1004. If there is a corresponding table entry for the target directory identifier, the query client determines whether there is a table entry including the target service identifier in the table entry corresponding to the target directory identifier.

[0100] When the query client determines that the number of entries corresponding to the target directory identifier is not zero, it also needs to determine whether there is an entry including the target service identifier in the entries corresponding to the target directory identifier.

[0101] 1005: If the table entry corresponding to the target directory identifier does not include the target service identifier, the query client determines that the data corresponding to the target service identifier does not exist in the data query system.

[0102] Since the table entries corresponding to the same directory identifier in the query client and the query server are the same, when the query client determines that the target business identifier does not exist in the table entry corresponding to the target directory identifier, the query server also does not have the target business identifier. In other words, when the query client determines that the target business identifier does not exist in the table entry corresponding to the target directory identifier, the target business identifier does not exist in the entire data query system. In this way, the query client does not need to send a query request to the query server, avoiding remote query, saving query delay, and improving the efficiency of data query.

[0103] Optionally, when the query client determines that the target business identifier exists in the first table item corresponding to the target directory identifier, since each table item stores the business identifier and the corresponding data, the query client can perform data query based on the first table item. Specifically, the query client can obtain the data in the table item including the target business identifier, and use the data as the data to be queried, so that the query client can determine the target data corresponding to the target business identifier.

[0104] Optionally, in an embodiment of the present application, the table items corresponding to each directory identifier in the query client and the query server are managed by a Hash linked list. Each Hash bucket in the query server has a Hash linked list as shown in FIG11(a), while only some Hash buckets in the query client have Hash linked lists as shown in FIG11(b), and the table items included in the Hash linked lists under the same Hash bucket in the query client and the query server are the same as shown in FIG12(a) and FIG12(b).

[0105] Optionally, in one embodiment of the present application, the directory identifier of the query client and the table item corresponding to the directory identifier are stored in the local cache, and the query client can update the local cache, which avoids the situation where the table item corresponding to a directory identifier in the query client is not zero and is not the same as the table item corresponding to the directory identifier in the query server, so that the query client can maintain the structure of the local cache to reduce the proportion of remote queries performed by the query client. Fig.13 A flowchart of an embodiment.

[0106] 1301. A query client receives a first update request, where the first update request carries a first directory identifier and is used to request deletion of an entry corresponding to the first directory identifier.

[0107] The first directory identifier can query any directory identifier among the N directory identifiers in the client.

[0108] 1302. The query client deletes all entries in the first directory identifier according to the first update request.

[0109] Exemplarily, the method of generating the first update request includes but is not limited to: first, the query client may actively apply for updating the local cache after the local cache ages, for example, all the entries corresponding to the first directory identifier have not been hit by the query for more than a predetermined time period. Second: the local cache periodically deletes entries to save memory. The first and second methods are that the query client can automatically generate the first update request. Third, the query client may also passively receive the first update request for update, for example, the first update request is generated based on information manually input by the user, or is triggered by a message from other security applications. This application does not limit this.

[0110] Optionally, in another embodiment of the present application, the query client may also receive an update request for deleting the cache sent by the query server, thereby avoiding the situation where the table entry corresponding to a certain directory identifier in the query client is not zero and is not the same as the table entry corresponding to the directory identifier in the query server, so that the query client can maintain the structure of the local cache to reduce the proportion of remote queries performed by the query client, such as Fig.14Shown is a flow chart of one embodiment.

[0111] 1401. The query client receives a second update request, where the second update request includes all entries corresponding to a first directory identifier, and the second update request is used to request deletion of the entry corresponding to the first directory identifier.

[0112] 1402. The query client replaces all entries corresponding to the current first directory identifier with at least one entry included in the second update request.

[0113] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0114] Therefore, in the data query method of the embodiment of the present application, the query client receives a first query request, the first query request carries a target business identifier, determines the target directory identifier corresponding to the target business identifier, and determines whether there is a corresponding table entry for the target directory identifier. If the number of table entries corresponding to the target directory identifier is not zero, it is determined whether there is a table entry including the target business identifier in the table entry corresponding to the target directory identifier. If it is determined that there is no table entry including the target business identifier in the table entry corresponding to the target directory identifier, it is determined that the data corresponding to the target business identifier does not exist in the data query system. In this way, the query client does not need to send a query request to the query server, thereby avoiding remote query, thereby improving the performance of existing data query solutions.

[0115] Fig.15 A schematic flow chart of a method for data query according to an embodiment of the present application is shown. The meanings of various terms in the embodiment of the present application are the same as those in the above embodiments.

[0116] It should be noted that this is only to help those skilled in the art to better understand the embodiments of the present application, rather than to limit the scope of the embodiments of the present application.

[0117] 1501. A query client receives a first query request, where the first query request carries a target service identifier.

[0118] 1502. The query client determines the target directory identifier corresponding to the target service identifier.

[0119] 1503, the query client determines whether there is a corresponding table entry for the target directory identifier. If there is a corresponding table entry, execute step 1504; if there is no corresponding table entry, execute step 1506.

[0120] 1504. When the query client determines that a corresponding table entry exists for the target directory identifier, the query client further determines whether a table entry including the target service identifier exists in the corresponding table entry.

[0121] When the query client determines that there is no table entry including the target business identifier, it determines that there is no data corresponding to the target business identifier in the data query system and executes step 1508; when the query client determines that there is a table entry including the target business identifier corresponding to the target directory identifier, it executes step 1505.

[0122] 1505 , when the query client determines that there is a first entry including the target service identifier in the entry corresponding to the target directory identifier, the query client performs data query according to the first entry, and executes step 1508 after obtaining the data query result.

[0123] 1506, when the query client determines that there is no corresponding table entry for the target directory identifier, it starts a remote query, that is, sends a second query request to the query server, the second query request carries the target service identifier, and the query server generates a data query result according to the second query request.

[0124] 1507, the query client receives the data query result sent by the query server.

[0125] 1508, data query ends.

[0126] It should be understood that the specific indication method of the above corresponding information can refer to the aforementioned embodiments, and for the sake of brevity, it will not be repeated here.

[0127] Therefore, in the data query method of the embodiment of the present application, the query client receives a first query request, the first query request carries a target business identifier, determines the target directory identifier corresponding to the target business identifier, and determines whether there is a corresponding table entry for the target directory identifier. If the number of table entries corresponding to the target directory identifier is not zero, it is determined whether there is a table entry including the target business identifier in the table entry corresponding to the target directory identifier. If it is determined that there is no table entry including the target business identifier in the table entry corresponding to the target directory identifier, it is determined that the data corresponding to the target business identifier does not exist in the data query system. In this way, the query client does not need to send a query request to the query server, thereby avoiding remote query, thereby improving the performance of existing data query solutions.

[0128] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0129] The data query method according to the embodiment of the present application is described in detail above, and the query client according to the embodiment of the present application will be described below.

[0130] Fig.16 FIG. 1 shows a schematic block diagram of a query client according to an embodiment of the present application. Fig.16 As shown, the query client 1600 is applied to a data query system including the query client and a query server, the query client includes a client cache, the query server includes a server cache, the client cache includes M directory identifiers, each directory identifier in the N directory identifiers in the client cache corresponds to at least one table entry, M and N are positive integers, M>N≥1, and there is no corresponding table entry for directory identifiers other than the N directory identifiers in the M directory identifiers in the client cache, the server cache includes the M directory identifiers, and the table entry corresponding to the first directory identifier in the N directory identifiers in the client cache is the same as the table entry corresponding to the first directory identifier in the server cache, and the table entry includes a service identifier and data corresponding to the service identifier, and the query client 1600 includes:

[0131] The receiving module 1610 is used to receive a first query request, where the first query request carries a target service identifier and is used to request to query data corresponding to the target service identifier;

[0132] A processing module 1620 is used to determine a target directory identifier corresponding to the target service identifier, where the target directory identifier belongs to the M directory identifiers;

[0133] The processing module 1620 is further used to determine whether there is a corresponding entry for the target directory identifier;

[0134] The processing module 1620 is further configured to determine whether the target service identifier exists in the table entry corresponding to the target directory identifier when it is determined that the target directory identifier exists in the table entry corresponding to the target directory identifier;

[0135] The processing module 1620 is further configured to determine that the data corresponding to the target service identifier does not exist in the data query system when there is no entry including the target service identifier in the entry corresponding to the target directory identifier.

[0136] It should be understood that the processing module 1620 may be Figure 3 The client query module 322 in.

[0137] Optionally, the query client 1600 further includes:

[0138] A sending module, configured to send a second query request to the query server when there is no corresponding table entry for the target directory identifier, wherein the second query request carries the target service identifier;

[0139] The receiving module 1610 is further configured to receive a data query result, where the query result includes data corresponding to the target service identifier or query failure indication information.

[0140] Optionally, if there is an entry including the target service identifier in the entry corresponding to the target directory identifier, the processing module 1620 is further configured to obtain data in the entry including the target service identifier;

[0141] The processing module 1620 is further configured to use the acquired data as data corresponding to the target service identifier.

[0142] Optionally, the receiving module 1610 is further used to receive a first update request, where the first update request is used to request deletion of the table entry corresponding to the first directory identifier; the processing module 1620 is further used to delete all table entries corresponding to the first directory identifier according to the first update request.

[0143] Optionally, the receiving module 1610 is also used to receive a first update request, which carries the first directory identifier and is used to request deletion of the table entry corresponding to the first directory identifier; the processing module 1620 is also used to delete all table entries corresponding to the first directory identifier according to the first update request.

[0144] Optionally, the receiving module 1610 is also used to receive a second update request sent by the query server, the second update request carries the first directory identifier and all table entries corresponding to the first directory identifier in the query server, and the second update request is used to request an update of the table entries corresponding to the first directory identifier of the query client; the processing module 1620 is also used to replace all table entries currently corresponding to the first directory identifier with all table entries included in the second update request.

[0145] Optionally, the service identifier included in each of the at least one table entry is a file identifier, and the data included in each of the at least one table entry is a reputation value.

[0146] Optionally, the file identifier is a hash value of a predetermined length, the first k digits of the hash values ​​of each table entry corresponding to a directory identifier among the N directory identifiers are the same, and a directory identifier among the N directory identifiers is the first k digits of the hash values ​​included in each table entry corresponding to the directory identifier, k is a positive integer, and k≥1.

[0147] Therefore, the query client of the embodiment of the present application receives a first query request, which carries a target business identifier, determines the target directory identifier corresponding to the target business identifier, and determines whether there is a corresponding table entry for the target directory identifier. If the number of table entries corresponding to the target directory identifier is not zero, it determines whether there is a table entry including the target business identifier in the table entry corresponding to the target directory identifier. If it is determined that there is no table entry including the target business identifier in the table entry corresponding to the target directory identifier, it is determined that the data corresponding to the target business identifier does not exist in the data query system. In this way, the query client does not need to send a query request to the query server, thereby avoiding remote query, thereby improving the performance of existing data query solutions.

[0148] The query client according to the embodiment of the present application may correspond to the query client of the data query method of the embodiment of the present application, and the above-mentioned and other operations and / or functions of each module of the query client are respectively for implementing the corresponding processes of the aforementioned methods, which will not be repeated here for the sake of brevity.

[0149] Fig.17 A data query system 1700 according to an embodiment of the present application is shown, and the data query system 1700 includes:

[0150] like Fig.16 The query client 1600 and the query server 1710 of the illustrated embodiment.

[0151] Fig.18 FIG. 1 shows a schematic diagram of the structure of a query client according to an embodiment of the present application. Fig.16 As shown, the query client includes at least one processor 1802 (e.g., a general-purpose processor CPU, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf field programmable gate array (FPGA), etc. with computing and processing capabilities), and the processor 1802 is used to manage and schedule various modules and devices in the query client. Fig.16 The processing module 1620 in the illustrated embodiment may be implemented by the processor 1802. The query client further includes at least one network interface 1805 (eg, receiver / transmitter) and a memory 1806. Fig.16 The receiving module 1610 and the sending module in the illustrated embodiment may be implemented via the network interface 1805. The various components of the query client communicate with each other via internal connection paths to transfer control and / or data signals.

[0152] It should be understood that the local cache in the query client is stored in memory 1806.

[0153] The method disclosed in the above-mentioned embodiment of the present application can be applied to the processor 1802, or used to execute an executable module stored in the memory 1806, such as a computer program. The memory 1806 may include a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory). The memory may include a read-only memory and a random access memory, and provide the processor with the required signaling or data, programs, etc. A portion of the memory may also include a non-volatile random access memory (NVRAM). The communication connection with at least one other network element is achieved through at least one transceiver 1805 (which may be wired or wireless).

[0154] In some implementations, the memory 1806 stores a program 18061, and the processor 1802 executes the program 18061 to perform the following operations:

[0155] Receiving a first query request through the network interface 1805, the first query request carrying a target service identifier, for requesting to query data corresponding to the target service identifier;

[0156] Determine, according to the first query request, a target directory identifier corresponding to the target service identifier, where the target directory identifier belongs to the M directory identifiers;

[0157] Determine whether there is a corresponding table entry for the target directory identifier;

[0158] If there is a corresponding table entry for the target directory identifier, determining whether there is an entry including the target service identifier in the table entry corresponding to the target directory identifier;

[0159] If the table entry corresponding to the target directory identifier does not include the table entry including the target service identifier, it is determined that the data corresponding to the target service identifier does not exist in the data query system.

[0160] Optionally, the query client of the embodiment of the present application may further include a remote query channel 1608, and the remote query channel 1808 is used to send a query request to the server cache when there is no entry corresponding to the target directory identifier in the query client.

[0161] It should be noted that the query client can be specifically Fig.16 The query client in the embodiment shown can be used to perform Figures 10 to 15 The method embodiment shown includes various steps and / or processes corresponding to the query client.

[0162] It can be seen from the above technical solution provided in the embodiment of the present application that by receiving a first query request, the first query request carries a target business identifier, determines the target directory identifier corresponding to the target business identifier, and determines whether there is a corresponding table entry for the target directory identifier. If the number of table entries corresponding to the target directory identifier is not zero, determines whether there is a table entry including the target business identifier in the table entry corresponding to the target directory identifier. If it is determined that there is no table entry including the target business identifier in the table entry corresponding to the target directory identifier, it is determined that the data corresponding to the target business identifier does not exist in the data query system. In this way, the query client does not need to send a query request to the query server, thereby avoiding remote queries, thereby improving the performance of existing data query solutions.

[0163] An embodiment of the present application also provides a computer storage medium, which can store program instructions for indicating any of the above methods.

[0164] Optionally, the storage medium may specifically be the memory 1806 .

[0165] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0166] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0167] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0168] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the traditional solution. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0169] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A data query system, characterized in that: The system comprises a query client and a query server. The query server includes a server cache, the server cache includes M directory identifiers, each of the M directory identifiers included in the server cache corresponds to at least one table entry, each of the at least one table entry in the server cache includes a service identifier and data corresponding to the service identifier, The query client includes a client cache, the client cache includes the M directory identifiers, each of the N directory identifiers in the client cache corresponds to at least one table entry, each of the at least one table entry in the client cache includes a service identifier and data corresponding to the service identifier, M and N are positive integers, M>N≥1, there is no corresponding table entry for directory identifiers other than the N directory identifiers in the M directory identifiers in the client cache, and the table entry corresponding to the first directory identifier among the N directory identifiers in the client cache is the same as the table entry corresponding to the first directory identifier in the server cache; The query client is used to receive a first query request, where the first query request carries a target service identifier and is used to request to query data corresponding to the target service identifier; Determine a target directory identifier corresponding to the target service identifier, where the target directory identifier belongs to the M directory identifiers; Determine whether there is a corresponding table entry for the target directory identifier; If there is a corresponding table entry for the target directory identifier, determining whether there is an entry including the target service identifier in the table entry corresponding to the target directory identifier; If the table entries corresponding to the target directory identifier do not include the entry including the target service identifier, it is determined that the data corresponding to the target service identifier does not exist in the system.

2. The system according to claim 1, characterized in that The query client is applied to a security device, and the security device includes a firewall or a host.

3. The system according to claim 1 or 2, characterized in that: The query client is also used to: If there is no corresponding table entry for the target directory identifier, sending a second query request to the query server, wherein the second query request carries the target service identifier; A query result is received, where the query result includes data corresponding to the target service identifier or query failure indication information.

4. The system according to claim 1 or 2, characterized in that: The query client is also used to: If an entry including the target service identifier exists in the entry corresponding to the target directory identifier, acquiring data in the entry including the target service identifier; The acquired data is used as the data corresponding to the target service identifier.

5. The system according to claim 1 or 2, characterized in that: The query client is also used to: receiving a first update request, where the first update request carries the first directory identifier, and the first update request is used to request deletion of an entry corresponding to the first directory identifier; According to the first update request, all entries corresponding to the first directory identifier are deleted.

6. The system according to claim 1 or 2, characterized in that: The query client is also used to: receiving a second update request sent by the query server, the second update request carrying the first directory identifier and all table entries corresponding to the first directory identifier in the query server, the second update request being used to request updating the table entry corresponding to the first directory identifier of the query client; All entries currently corresponding to the first directory identifier are replaced by all entries included in the second update request.

7. The system according to claim 1 or 2, characterized in that: The service identifier included in each of the at least one table entry is a file identifier, and the data included in each of the at least one table entry is a reputation value.

8. The system according to claim 7, characterized in that The file identifier is a hash value of a predetermined length, the first k digits of the hash values ​​of each table entry corresponding to one of the N directory identifiers are the same, and one of the N directory identifiers is the first k digits of the hash values ​​included in each table entry corresponding to the directory identifier, k is a positive integer, and k≥1.

9. The system according to claim 1 or 2, characterized in that: The service identifier included in each of the at least one table entry is an Internet Protocol IP address, and the data included in each of the at least one table entry is a reputation value.

Images