A method, device, equipment and storage medium for message detection

Abstract

The present application provides a message detection method, apparatus, device and storage medium. The method includes: according to at least one preset file type, generating a first AC tree and at least one second AC tree from a feature set for detecting a message body through the AC algorithm, where a second AC tree corresponds to a unique file type; obtaining the message body of the message to be detected; determining whether the message body belongs to the at least one file type; if so, detecting the message body based on the second AC tree corresponding to the file type of the message body; if not, detecting the message body based on the first AC tree. In the present application, a large AC tree of the message body is split into multiple relatively small AC trees, thereby solving the problem of reduced matching efficiency of the AC algorithm due to the large size of the AC tree, and thus improving the overall detection efficiency of the message.

Description

Technical Field

[0001] This application relates to the field of communication technologies, and in particular, to a method, device, equipment, and storage medium for detecting messages. Background Art

[0002] In the era of the rapid development of the Internet, the keyword detection function is usually used to prevent users from publishing content with specified keywords. For example, in the chat system of games, character name detection, forum posting, live barrage, etc., it is necessary to detect the content published by users to detect whether it contains sensitive keywords.

[0003] In the multi-pattern matching algorithm, the AC algorithm can effectively solve the efficiency problem of keyword detection, with a time complexity of O(n), where n is the length of the content published by the user. The time complexity is basically independent of the number of keywords. The AC algorithm is used to match character sequences, not necessarily strings, and can be features composed of any ASCII characters. Before use, all character sequences (features) to be matched are compiled into a state table, and the AC algorithm quickly matches the message once by means of a lookup table to obtain multiple matching results. Therefore, many defense and detection systems deeply detect messages through the AC algorithm to quickly identify the keywords carried in the network transmission data.

[0004] The process of the AC algorithm matching a message is to read the current message byte by byte and find the next state according to the ASCII code. If the next state is an end point, the successfully matched character sequence is recorded and the matching continues until the message is read completely. However, in actual use, the memory of a device is limited. Therefore, when implementing a certain function, it is hoped to reduce memory consumption as much as possible while ensuring the requirements of the function and performance. Of course, the AC algorithm is no exception. When using the AC algorithm, two problems need to be considered, one is the memory problem, and the other is the matching efficiency problem. Then, when the number of features is large, how to reduce memory consumption as much as possible without affecting the matching efficiency when using the AC algorithm is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0005] The purpose of this application is to provide a method, device, equipment, and storage medium for detecting messages to improve the message detection efficiency.

[0006] The first aspect of this application provides a method for detecting messages, including:

[0007] According to at least one preset file type, generate a first AC tree and at least one second AC tree for the feature set used to detect the message body through the AC algorithm, where a second AC tree corresponds to a unique file type;

[0008] Obtain the message body of the message to be detected;

[0009] Determine whether the message body belongs to the at least one file type;

[0010] If so, detect the message body based on the second AC tree corresponding to the file type of the message body; if not, detect the message body based on the first AC tree.

[0011] The second aspect of the present application provides a message detection device, including:

[0012] An AC tree generation module, configured to generate a first AC tree and at least one second AC tree from a feature set for detecting a message body through the AC algorithm according to at least one preset file type, where one second AC tree corresponds to a unique file type;

[0013] An acquisition module, configured to acquire the message body of the message to be detected;

[0014] A detection module, configured to determine whether the message body belongs to the at least one file type; if so, detect the message body based on the second AC tree corresponding to the file type of the message body; if not, detect the message body based on the first AC tree.

[0015] The third aspect of the present application provides a message detection device, including: a memory, a processor, and a computer program stored on the memory and executable on the processor, where when the processor runs the computer program, it is executed to implement the method described in the first aspect.

[0016] The fourth aspect of the present application provides a computer-readable storage medium, on which computer-readable instructions are stored, and the computer-readable instructions can be executed by a processor to implement the method described in the first aspect.

[0017] Compared with the prior art, the message detection method, device, device, and storage medium provided by the present application generate a first AC tree and at least one second AC tree from a feature set for detecting a message body through the AC algorithm according to at least one preset file type, where one second AC tree corresponds to a unique file type; acquire the message body of the message to be detected; determine whether the message body belongs to the at least one file type; if so, detect the message body based on the second AC tree corresponding to the file type of the message body; if not, detect the message body based on the first AC tree. In this solution, a large AC tree of the message body is split into multiple relatively small AC trees, thereby solving the problem of reduced matching efficiency of the AC algorithm due to the large size of the AC tree, and thus improving the overall detection efficiency of the message. Description of the Drawings

[0018] By reading the following detailed description of the preferred embodiments, various other advantages and benefits will become clear to those of ordinary skill in the art. The accompanying drawings are only for the purpose of showing the preferred embodiments and are not considered to be a limitation of the present application. Moreover, throughout the drawings, the same reference numerals are used to represent the same components. In the drawings:

[0019] Figure 1 A schematic diagram of the AC tree under the combined use of a double matrix is shown;

[0020] Figure 2 A flowchart of a message detection method provided by the present application is shown;

[0021] Figure 3 A flowchart of the creation of the AC tree for the entire message provided by the present application is shown;

[0022] Figure 4 A flowchart of the AC matching detection for the entire message provided by the present application is shown;

[0023] Figure 5 A schematic diagram of a message detection device provided by the present application is shown;

[0024] Figure 6 A schematic diagram of a message detection device provided by the present application is shown. Detailed Embodiments

[0025] Hereinafter, the exemplary embodiments of the present disclosure will be described in more detail with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided so that the present disclosure can be more thoroughly understood and the scope of the present disclosure can be completely conveyed to those skilled in the art.

[0026] It should be noted that unless otherwise specified, the technical terms or scientific terms used in the present application should have the ordinary meaning understood by those skilled in the art to which the present application belongs.

[0027] In addition, terms such as "first" and "second" are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally further includes steps or units not listed, or optionally further includes other steps or units inherent to these processes, methods, products or devices.

[0028] The AC pattern string matching algorithm, abbreviated as the AC algorithm, and its full English name is Anchor Aho-Corasick.

[0029] The main idea of the AC algorithm is to build a deterministic tree-shaped finite state machine with multiple pattern strings, use the main string as the input of the finite state machine, and make the state machine perform state transitions. When reaching certain specific states, it indicates that pattern matching has occurred.

[0030] Construction of the AC tree: Build the pattern strings into a trie tree. Each node of the tree is assigned a state; each node has a unique parent node, but not vice versa; an edge between each node and its parent node corresponds to an ASCII character.

[0031] Figure 1 The schematic diagram of the AC tree under the combined use of double matrices (full matrix and sparse matrix) is shown. The full matrix method has a very fast search speed but occupies a large amount of memory; the sparse matrix method has a slower search speed but occupies less memory.

[0032] Such as Figure 1 shown, the feature is split into a leading part and a trailing part. For example, for the feature: abcdefg, it is split into abcd, efg; the state table of the leading part is stored using the full matrix memory method, and the trailing part is stored using the sparse matrix memory method. Since most packets will fail to match in the leading part and will not enter the trailing part for matching, the poor search performance of the trailing part will not affect the overall efficiency. And the memory occupancy is greatly reduced, and the allocation of the leading part and the trailing part can be flexibly adjusted under different feature configurations.

[0033] According to characteristics such as the basic transmission protocol to which the feature string belongs and the position where it appears in the packet, multiple AC trees are built, such as protocol trees for HTTP, FTP, etc. In the HTTP protocol, it can also be divided into a Header tree (the AC tree corresponding to the packet header), a body tree (the AC tree corresponding to the packet body), etc. Then all the feature strings are added to different AC trees according to their characteristics respectively. However, if the amount of features is large, the body tree of the protocol will become more and more huge, and the matching efficiency of the AC algorithm will decrease accordingly.

[0034] In view of this, the embodiments of the present application provide a packet detection method and device, a packet detection device, and a computer-readable storage medium, which will be described below with reference to the accompanying drawings.

[0035] Please refer to Figure 2 , which shows a flowchart of a packet detection method provided by some embodiments of the present application. As shown in the figure, it may specifically include the following steps S101 to step S105:

[0036] Step S101: According to at least one preset file type, generate a first AC tree and at least one second AC tree for the feature set used to detect the packet body through the AC algorithm, and one second AC tree corresponds to a unique file type;

[0037] Step S102: Obtain the message body of the message to be detected;

[0038] Step S103: Determine whether the message body belongs to the at least one file type;

[0039] Step S104: If so, detect the message body based on the second AC tree corresponding to the file type of the message body;

[0040] Step S105: If not, detect the message body based on the first AC tree.

[0041] In step S101, the message includes a message header and a message body, and the feature set includes feature strings for matching and detecting the message body, and this feature string is the pattern string in the AC algorithm.

[0042] Specifically, the preset file types can be common file types of the message body. For example, it can include at least one of executable files, picture files, document files, browser-related files, script files, and media files. The second AC tree corresponds to the file type one by one, that is, an AC tree can be created for each of the above file types.

[0043] Specifically, the process of building the AC tree in step S101 above can be implemented as:

[0044] For each file type, determine the feature string corresponding to the file type from the feature set for detecting the message body;

[0045] According to the feature string corresponding to the file type, generate the second AC tree corresponding to the file type through the AC algorithm;

[0046] After generating the second AC trees corresponding to each file type, generate the first AC tree through the AC algorithm for the remaining feature strings in the feature set.

[0047] It should be understood that in this application, a large AC tree corresponding to the message body is split into multiple relatively small AC trees. In this application, the AC tree for other parts of the message is created using related technologies, which will not be elaborated in this application.

[0048] Such as Figure 3 shown is the flowchart of creating the AC tree for the entire message provided by this application. Such as Figure 3 shown, in practical applications, the process of creating the AC tree for the entire message is as follows:

[0049] S201: Obtain the feature string rule information;

[0050] S202: Obtain the protocol specified by the feature string;

[0051] S203: Determine whether the position of the feature string is in the body field; if so, jump to S204, if not, jump to S205;

[0052] S204: Determine the file type specified by the feature string;

[0053] S205: Search for the corresponding AC tree according to the position of the feature string and the protocol;

[0054] S206: Add the feature string to the corresponding AC tree;

[0055] S207: Add the feature string to the corresponding second AC tree;

[0056] S208: Add the feature string to the first AC tree.

[0057] It should be understood that the above AC tree creation process is for the entire message. The difference from the related technology is that in this application, the body tree corresponding to the message body is further divided into a first AC tree and multiple second AC trees, thus avoiding the problem that the AC algorithm matching efficiency will decrease as the body tree becomes larger and larger.

[0058] In practical applications, the body tree can be split into multiple small AC trees according to the file type, or can be split into different AC trees according to actual needs.

[0059] In step S103 of this application, the file type of the message body of the to-be-detected message obtained in step S102 is judged to determine whether the file type of the message body of the to-be-detected message is the file type corresponding to the second AC tree.

[0060] In step S104, if the file type of the message body of the to-be-detected message corresponds to the second AC tree, then perform AC matching detection on the message body based on the corresponding second AC tree.

[0061] In step S105, if the file type of the message body of the to-be-detected message does not have the second AC tree, then perform AC matching detection on the message body based on the first AC tree.

[0062] As Figure 4 shown is the flowchart of the AC matching detection of the entire message provided by this application. As Figure 4 shown, taking the HTTP message as an example, the AC matching detection process of the entire message in practical applications is as follows:

[0063] S301: Process the HTTP message header data;

[0064] S302: Judge whether the data of the Body (message body) part is 0; if so, end, if not,

[0065] then jump to S303;

[0066] S303: Obtain the direction of the current message;

[0067] S304: Determine whether the message is Trunk-encoded; if so, jump to S306, if not, jump to S305;

[0068] S305: Determine whether the Body field is compressed; if so, jump to S307, if not, jump to S308;

[0069] S306: Perform Trunk parsing, and jump to S305 after parsing;

[0070] S307: Decompress the Body field, and jump to S308 after parsing;

[0071] S308: Determine whether the Body is in MIME format; if so, jump to S309, if not, jump to S310;

[0072] S309: Perform MIME format parsing on the Body field, and jump to S310 after parsing;

[0073] S310: Determine whether the Body field is a file; if so, jump to S312, if not, jump to S311;

[0074] S311: Perform detection on the first AC tree of the HTTP protocol;

[0075] S312: Identify the file type of the Body field;

[0076] S313: Determine whether the file in the Body field is a compressed file; if so, jump to S314, if not, jump to S315;

[0077] S314: Decompress the file, and jump to S316 after decompression;

[0078] S315: Perform detection on the corresponding second AC tree according to the file type;

[0079] S316: Re-identify the decompressed file, and jump to S315 after identification;

[0080] The above is the AC matching detection process of the message provided by this application. In the real environment where file transfer traffic is widespread, the huge protocol body tree can be split into multiple different AC trees according to common file types, reducing the burden on the protocol body tree to ensure that the matching efficiency of the AC algorithm will not be reduced due to the large number of file feature strings.

[0081] According to some embodiments of this application, after step S101, the message detection method may further include the following steps:

[0082] Determine the memory allocation method for each of the first AC tree and the at least one second AC tree according to the number of state nodes in the AC tree, so as to allocate memory for the AC tree according to the required memory allocation method of the AC tree during packet detection.

[0083] It should be understood that determining the memory allocation method of the AC tree is to determine the data type and storage method used for allocating memory for the required AC tree during packet detection.

[0084] Specifically, the data type can be UCHAR (unsigned character type), USHORT (unsigned short integer type), and UINT (integer type). The storage method can be a full matrix or a sparse matrix. Different data types and storage methods are used for the AC tree, and the memory consumption is also different. Therefore, the memory consumption of the AC algorithm can be effectively reduced by optimizing the data type and storage method of the AC tree.

[0085] In practical applications, when the number of feature strings of one or several AC trees is small, using a full matrix of UINT to store the sub-states of a certain state will cause unnecessary memory consumption. The number of state nodes in the AC tree represents the size of the AC tree. In this application, after each AC tree is constructed, a suitable full matrix memory is also allocated according to the size of the AC tree according to the actual situation, so as to effectively reduce the memory consumption of the AC algorithm.

[0086] According to some embodiments of the present application, when the number of state nodes of the AC tree is within the first range, a full matrix storage method in the form of a first data type is used for memory allocation; when the number of state nodes of the AC tree is within the second range, a full matrix storage method in the form of a second data type is used for memory allocation; when the number of state nodes of the AC tree is within the third range, a full matrix storage method in the form of a third data type is used for memory allocation.

[0087] Specifically, according to the size of the AC tree, the full matrix memory is allocated according to the actual situation. When the number of state nodes of the AC tree is within the range of [1, 127], a full matrix storage in the form of UCHAR

[256] is used; when the number of state nodes is within the range of [128, 65535], a full matrix storage in the form of USHORT

[256] is used; when the number of state nodes is greater than 65535, a full matrix storage in the form of UINT

[256] is used.

[0088] When the number of state nodes of an AC tree is less than 65535, the full matrix method is used for matching. However, once the number of state nodes of the AC tree exceeds 65535, at this time, a combination of the full matrix and the sparse matrix is required for matching to achieve high-speed search with low memory consumption.

[0089] The full matrix requires continuous memory space. If there is insufficient memory space, try to reduce the number of full matrix states and continue to apply until the memory for the minimum number of full matrix states (customized according to the actual situation) cannot be allocated. The specific process can be implemented programmatically. Finally, associate the allocated memory with the corresponding AC tree.

[0090] Using the above method to allocate memory for each AC tree reduces the memory consumption of the AC algorithm to a certain extent.

[0091] The above message detection method provided by the embodiments of the present application generates a first AC tree and at least one second AC tree for the feature set used to detect the message body through the AC algorithm according to at least one preset file type; obtains the message body of the message to be detected; determines whether the message body belongs to the at least one file type; if so, detects the message body based on the second AC tree corresponding to the file type of the message body; if not, detects the message body based on the first AC tree. In this solution, a large AC tree of the message body is split into multiple relatively small AC trees, thus solving the problem of reduced matching efficiency of the AC algorithm due to the large size of the AC tree, and improving the overall detection efficiency of the message.

[0092] In the above embodiments, a message detection method is provided. Correspondingly, the present application also provides a message detection device. The message detection device provided by the embodiments of the present application can implement the above message detection method. Please refer to Figure 5 which shows a schematic diagram of a message detection device provided by some embodiments of the present application. Since the device embodiments are basically similar to the method embodiments, the description is relatively simple. For the relevant parts, refer to the partial description of the method embodiments. The device embodiments described below are only illustrative.

[0093] As Figure 5 shown, the message detection device 10 may include:

[0094] An AC tree generation module 101, configured to generate a first AC tree and at least one second AC tree for the feature set used to detect the message body through the AC algorithm according to at least one preset file type, and one second AC tree corresponds to a unique file type;

[0095] An acquisition module 102, configured to acquire the message body of the message to be detected;

[0096] A detection module 103, configured to determine whether the message body belongs to the at least one file type; if so, detect the message body based on the second AC tree corresponding to the file type of the message body; if not, detect the message body based on the first AC tree.

[0097] In some embodiments of the embodiments of the present application, the AC tree generation module 101 is specifically configured to:

[0098] For each file type, determine the feature string corresponding to the file type from the feature set for detecting the message body;

[0099] According to the feature string corresponding to the file type, generate the second AC tree corresponding to the file type through the AC algorithm;

[0100] After generating the second AC trees corresponding to each file type, generate the first AC tree through the AC algorithm for the remaining feature strings in the feature set.

[0101] In some embodiments of the embodiments of the present application, the device 10 further includes:

[0102] A memory allocation module, configured to, after the AC tree generation module generates the first AC tree and at least one second AC tree from the feature set for detecting the message body through the AC algorithm according to at least one preset file type, determine the memory allocation method for each AC tree in the first AC tree and the at least one second AC tree according to the number of state nodes in the AC tree, so as to allocate memory to the AC tree according to the memory allocation method of the required AC tree during message detection.

[0103] In some embodiments of the embodiments of the present application, the memory allocation module is specifically configured to:

[0104] When the number of state nodes of the AC tree is within the first range, perform memory allocation using the full matrix storage method in the form of the first data type;

[0105] When the number of state nodes of the AC tree is within the second range, perform memory allocation using the full matrix storage method in the form of the second data type;

[0106] When the number of state nodes of the AC tree is within the third range, perform memory allocation using the full matrix storage method in the form of the third data type.

[0107] In some embodiments of the embodiments of the present application, the file type includes at least one of an executable file, a picture file, a document file, a browser-related file, a script file, and a media file.

[0108] The message detection device provided in the above embodiments of the present application and the message detection method provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects.

[0109] Embodiments of the present application also provide a packet detection device corresponding to the packet detection method provided in the foregoing embodiments. The device may be a mobile phone, a laptop computer, a tablet computer, a desktop computer, etc., to execute the above-mentioned packet detection method.

[0110] Please refer to Figure 6 , which shows a schematic diagram of a packet detection device provided in some embodiments of the present application. As Figure 6 shown, the packet detection device 20 includes: a processor 200, a memory 201, a bus 202, and a communication interface 203. The processor 200, the communication interface 203, and the memory 201 are connected through the bus 202. A computer program that can run on the processor 200 is stored in the memory 201. When the processor 200 runs the computer program, it executes the packet detection method provided in any of the foregoing embodiments of the present application. Among them, the memory 201 may include a high-speed random access memory (RAM: Random Access Memory), and may also include a non-volatile memory, such as at least one disk memory. Through at least one communication interface 203 (which may be wired or wireless), a communication connection is established between this system network element and at least one other network element, and the Internet, wide area network, local area network, metropolitan area network, etc. can be used.

[0111] The bus 202 may be an ISA bus, a PCI bus, an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. Among them, the memory 201 is used to store a program. After receiving an execution instruction, the processor 200 executes the program. The packet detection method disclosed in any of the foregoing embodiments of the present application can be applied to or implemented by the processor 200.

[0112] The processor 200 may be an integrated circuit chip with the ability to process signals. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in the processor 200 or the instructions in the form of software. The above-mentioned processor 200 may be a general-purpose processor, including a central processing unit (CPU for short), a network processor (NP for short), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. It can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as being executed and completed by the hardware decoding processor, or executed and completed by the combination of the hardware and software modules in the decoding processor. The software module may be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. This storage medium is located in the memory 201, and the processor 200 reads the information in the memory 201 and combines its hardware to complete the steps of the above method.

[0113] The message detection device provided by the embodiments of the present application and the message detection method provided by the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by them.

[0114] The embodiments of the present application also provide a computer-readable storage medium corresponding to the message detection method provided by the foregoing embodiments. The computer-readable storage medium may be an optical disc, on which a computer program (i.e., a program product) is stored. When the computer program is run by a processor, it will execute the message detection method provided by any of the foregoing embodiments.

[0115] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical and magnetic storage media, which will not be elaborated here one by one.

[0116] The computer-readable storage medium provided by the above embodiments of the present application and the message detection method provided by the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0117] Finally, it should be noted that the flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to multiple embodiments of the present application. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and the module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than that marked in the accompanying drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, as well as the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0118] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the systems, devices, and units described above can refer to the corresponding processes in the foregoing method embodiments, and will not be elaborated herein.

[0119] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division, and there may be other division methods in actual implementation. For another example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the couplings or direct couplings or communication connections shown or discussed with each other can be through some communication interfaces, and the indirect couplings or communication connections of the devices or units can be in electrical, mechanical, or other forms.

[0120] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application, and they should all be covered by the scope of the claims and the description of the present application.

Claims

1. A message detection method, characterized in that, it includes: According to at least one preset file type, generate a first AC tree and at least one second AC tree for the feature set used to detect the message body through the AC algorithm, and one second AC tree corresponds to a unique file type; Obtain the message body of the message to be detected; Judge whether the message body belongs to the at least one file type; If so, detect the message body based on the second AC tree corresponding to the file type of the message body; if not, detect the message body based on the first AC tree; The step of generating a first AC tree and at least one second AC tree for the feature set used to detect the message body through the AC algorithm according to at least one preset file type includes: For each file type, determine the feature string corresponding to the file type from the feature set used to detect the message body; Generate the second AC tree corresponding to the file type through the AC algorithm according to the feature string corresponding to the file type; After generating the second AC trees corresponding to each file type, generate the first AC tree through the AC algorithm for the remaining feature strings in the feature set.

2. The method according to claim 1, characterized in that, after generating a first AC tree and at least one second AC tree for the feature set used to detect the message body through the AC algorithm according to at least one preset file type, it further includes: Determine the memory allocation method for each AC tree in the first AC tree and the at least one second AC tree according to the number of state nodes in the AC tree, so as to allocate memory for the AC tree according to the required memory allocation method of the AC tree during message detection.

3. The method according to claim 2, characterized in that, the step of determining the memory allocation method for each AC tree in the first AC tree and the at least one second AC tree according to the number of state nodes in the AC tree and allocating memory according to the memory allocation method includes: When the number of state nodes of the AC tree is within the first range, use the full matrix storage method in the form of the first data type for memory allocation; When the number of state nodes of the AC tree is within the second range, use the full matrix storage method in the form of the second data type for memory allocation; When the number of state nodes of the AC tree is within the third range, use the full matrix storage method in the form of the third data type for memory allocation.

4. The method according to claim 1, characterized in that, the file type includes at least one of executable files, picture files, document files, browser-related files, script files and media files.

5. A message detection device, characterized in that, it includes: An AC tree generation module, configured to generate a first AC tree and at least one second AC tree for the feature set used to detect the message body through the AC algorithm according to at least one preset file type, and one second AC tree corresponds to a unique file type; An acquisition module, configured to acquire the message body of the message to be detected; A detection module, configured to determine whether the message body belongs to at least one of the file types; if so, detect the message body based on the second AC tree corresponding to the file type of the message body; if not, detect the message body based on the first AC tree; The AC tree generation module is specifically configured to: For each file type, determine the feature string corresponding to the file type from the feature set for detecting the message body; According to the feature string corresponding to the file type, generate the second AC tree corresponding to the file type through the AC algorithm; After generating the second AC trees corresponding to each file type, generate the first AC tree through the AC algorithm for the remaining feature strings in the feature set.

6. The apparatus according to claim 5, wherein, The apparatus further includes: A memory allocation module, configured to, after the AC tree generation module generates the first AC tree and at least one second AC tree from the feature set for detecting the message body according to at least one preset file type through the AC algorithm, determine the memory allocation method for each of the first AC tree and the at least one second AC tree according to the number of state nodes in the AC tree, so as to allocate memory to the AC tree according to the required memory allocation method of the AC tree during message detection.

7. The apparatus according to claim 6, wherein, The memory allocation module is specifically configured to: When the number of state nodes of the AC tree is within the first range, perform memory allocation using the full matrix storage method in the form of the first data type; When the number of state nodes of the AC tree is within the second range, perform memory allocation using the full matrix storage method in the form of the second data type; When the number of state nodes of the AC tree is within the third range, perform memory allocation using the full matrix storage method in the form of the third data type.

8. The apparatus according to claim 5, wherein, The file type includes at least one of executable files, picture files, document files, browser-related files, script files, and media files.

9. A message detection device, wherein, It includes: A memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor runs the computer program, it is executed to implement the method according to any one of claims 1 to 4.

10. A computer-readable storage medium, wherein, Computer-readable instructions are stored thereon, and the computer-readable instructions can be executed by a processor to implement the method according to any one of claims 1 to 4.

Images