A multi-rule matching method, device and equipment

Abstract

The application discloses a multi-rule matching method and device, equipment and storage medium. The method comprises the following steps: using an ANTLR parser, performing rule analysis on a plurality of logical expressions according to an AND logic operator to split a plurality of sub-expressions; selecting a common sub-expression as a parent node from all the sub-expressions according to the frequency of each sub-expression; based on the parent node, selecting a target sub-expression as a child node according to the operation amount and frequency corresponding to the logical expression and the remaining sub-expressions to build a rule tree to obtain one or more rule trees; obtaining to-be-detected data, and performing rule matching on the to-be-detected data in sequence from the parent node by using the rule tree, and if the matching fails, skipping the rule matching of all child nodes of the current node and outputting a matching result. By taking the common sub-expression as the parent node, the same rule is avoided from being matched multiple times, and the efficiency of rule matching is improved.

Description

Technical Field

[0001] This invention relates to the field of security detection technology, and in particular to a multi-rule matching method, apparatus and equipment. Background Technology

[0002] In security analysis scenarios, users create custom logical expressions as rule matching conditions to achieve multi-rule matching. Generally, a system's rule matching capability is linearly related to the number of rules. However, in real-world business scenarios, many rules contain many identical sub-expressions, leading to repeated matching of these same sub-expressions and decreased computational performance. Currently, a large number of rule matches present performance bottlenecks, ultimately causing delays in real-time alerts. Furthermore, because some expression engines lack the feature to skip matching and processing rules from all child nodes of the current node, some invalid calculations result in wasted performance during the computation of a single expression, reducing the rule detection capability. Summary of the Invention

[0003] In view of this, the purpose of this invention is to provide a multi-rule matching method, apparatus, device, and medium that can improve the efficiency of multi-rule matching. The specific solution is as follows:

[0004] Firstly, this application discloses a multi-rule matching method, including:

[0005] The ANTLR parser is used to parse multiple logical expressions according to the AND logical operator, so as to split them into multiple sub-expressions;

[0006] Based on the frequency of each sub-expression, select the common sub-expression from all the sub-expressions as the parent node;

[0007] Based on the parent node, and according to the computational complexity and frequency of the logical expression and the other sub-expressions, target sub-expressions are sequentially selected as child nodes to construct a rule tree to obtain one or more rule trees.

[0008] The system acquires the data to be detected and uses the rule tree to perform rule matching on the data to be detected in sequence, starting from the parent node. If the matching fails, the system skips the rule matching of all child nodes of the current node and outputs the matching result.

[0009] Optionally, the ANTLR parser is used to perform rule-based parsing on multiple logical expressions according to the AND logical operator, in order to split them into multiple sub-expressions, including:

[0010] An ANTLR syntax file is generated based on the syntax and lexical of the logical expression, and the ANTLR syntax file is converted into an ANTLR syntax tree using an ANTLR parser.

[0011] The ANTLR parser is used to split the ANTLR syntax tree according to the AND logical operator to obtain multiple sub-expressions of the logical expression.

[0012] Optionally, after constructing a rule tree by sequentially selecting target sub-expressions as child nodes based on the parent node, according to the computational complexity and frequency of the logical expression and the other sub-expressions, to obtain one or more rule trees, the method further includes:

[0013] Based on the logical expression, generate a list of sub-expressions and key-value pairs of rule names corresponding to each logical expression;

[0014] The rule tree is traversed using the key-value pairs, and the corresponding rule name is added at the target node where the key-value pair matches successfully.

[0015] Optionally, after constructing a rule tree by sequentially selecting target sub-expressions as child nodes based on the parent node, according to the computational complexity and frequency of the logical expression and the other sub-expressions, to obtain one or more rule trees, the method further includes:

[0016] Traverse all nodes of the rule tree. If it is detected that the current node has only one child node and the current node does not have a corresponding rule name, then merge the child node with the current node and assign the rule name corresponding to the child node to the current node.

[0017] Optionally, the step of using the rule tree to perform rule matching on the data to be detected sequentially starting from the parent node, and skipping the rule matching of all child nodes of the current node and outputting the matching result if a match fails, includes:

[0018] The rule tree is used to perform rule matching on the data to be detected, starting from the parent node and following the node sorting order.

[0019] If the subexpression corresponding to the current node does not match the data to be detected, then skip the rule matching of all child nodes of the current node, and output the matching result.

[0020] If the subexpression corresponding to the current node matches the data to be detected, then obtain the node information of the current node, and determine whether the current node has child nodes and whether the current node has a corresponding rule name based on the node information;

[0021] If the current node has child nodes, then the rule matching operation on the data to be detected is performed using the child nodes;

[0022] If the current node has a corresponding rule name, then output the rule name corresponding to the current node.

[0023] Optionally, the step of performing rule matching on the data to be detected sequentially from the parent node using the rule tree includes:

[0024] According to the pre-configured operator priority definition rules and operation amount calculation formula, the operation amount corresponding to each rule tree is calculated; the operator priority definition rules include that the operator with smaller operation amount has higher priority than the operator with larger operation amount, and the operation amount calculation formula is a calculation formula that adds the operation amounts corresponding to the operators in the expression connected by the AND logical operator.

[0025] Based on the computational complexity corresponding to each rule tree, all rule trees are sorted in ascending order of computational complexity to generate a rule tree list;

[0026] The data to be detected is matched against rules according to the rule tree list.

[0027] Optionally, based on the frequency of each sub-expression, a common sub-expression is selected from all the sub-expressions as a parent node; based on the parent node, target sub-expressions are sequentially selected as child nodes according to the computational complexity and frequency of the logical expression and the remaining sub-expressions to construct a rule tree to obtain one or more rule trees, including:

[0028] Count the frequency of each of the sub-expressions, and extract the common sub-expressions from all the sub-expressions based on the frequency;

[0029] Generate a list of parent nodes by filtering out the subexpressions that appear only once from all the subexpressions;

[0030] The computational quantity of the subexpression is determined according to the priority definition rules of the operation operators and the operation operators contained in the subexpression. Then, the computational quantity priority parameter of each subexpression is determined according to the frequency and computational quantity of the subexpression. The computational quantity priority parameter is the ratio of the frequency to the computational quantity.

[0031] Each sub-expression in the parent node list and the common sub-expression are taken as parent nodes, and the target sub-expressions are selected as child nodes of each level according to the priority of the computational complexity of the remaining sub-expressions other than the parent nodes to construct a rule tree, so as to obtain one or more rule trees.

[0032] Optionally, after constructing a rule tree by sequentially selecting target sub-expressions as child nodes based on the parent node, according to the computational complexity and frequency of the logical expression and the other sub-expressions, to obtain one or more rule trees, the method further includes:

[0033] Traverse all nodes of the rule tree. If the subexpression of the current node contains an OR logical operator, then split the subexpression of the current node according to the OR logical operator to obtain multiple new subexpressions, and generate new child nodes based on the new subexpressions.

[0034] The computational priority parameter corresponding to the new sub-expression is determined, and the new child nodes are sorted according to the computational priority parameter corresponding to the new sub-expression. Then, the current node is replaced by the new child nodes in the order determined by the sorting.

[0035] Secondly, this application discloses a multi-rule matching device, comprising:

[0036] The parsing and splitting module is used to use the ANTLR parser to parse multiple logical expressions according to the AND logical operator, so as to split them into multiple sub-expressions;

[0037] The common sub-expression filtering module is used to filter out common sub-expressions as parent nodes from all the sub-expressions based on the frequency of each sub-expression;

[0038] The rule tree construction module is used to build a rule tree by sequentially selecting target sub-expressions as child nodes based on the parent node, according to the logical expression and the amount of computation and frequency of the other sub-expressions, in order to obtain one or more rule trees.

[0039] The rule matching module is used to acquire the data to be detected, and to perform rule matching on the data to be detected in sequence starting from the parent node using the rule tree. If the matching fails, the rule matching of all child nodes of the current node is skipped and the matching result is output.

[0040] Thirdly, this application discloses an electronic device, including:

[0041] Memory, used to store computer programs;

[0042] A processor is used to execute the computer program to implement the aforementioned multi-rule matching method.

[0043] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned multi-rule matching method.

[0044] In this application, the ANTLR parser is used to perform rule parsing on multiple logical expressions based on the AND logical operator to break them down into multiple sub-expressions. Based on the frequency of each sub-expression, common sub-expressions are selected from all the sub-expressions as parent nodes. Using the parent nodes as a basis, target sub-expressions are sequentially selected as child nodes based on the computational complexity and frequency of the logical expressions and the remaining sub-expressions to construct a rule tree, resulting in one or more rule trees. Data to be detected is acquired, and the rule trees are used to perform rule matching on the data to be detected sequentially, starting from the parent node. If a match fails, the rule matching of all child nodes of the current node is skipped, and the matching result is output. As can be seen, ANTLR parsing breaks down multiple logical expressions into subexpressions based on the AND operator. Then, common subexpressions are extracted according to frequency to construct multiple tree structures. The child nodes of the rule tree are sorted according to the computational complexity and frequency of the corresponding subexpressions. Finally, the constructed rule tree is used to perform rule matching on the data to be detected. Therefore, by using the ANTLR parser to extract common subexpressions as parent nodes of the rule tree after splitting logical expressions, multiple matching of the same rule can be avoided during rule matching, improving the efficiency of rule matching. Furthermore, since the child nodes of the rule tree are sorted according to the frequency and computational complexity of their corresponding subexpressions, rules with higher computational priority can be matched first during rule matching, thereby reducing the computational load of rule matching. Additionally, if a match fails during rule matching, the matching of all child nodes of the current node is skipped, and the matching result is output, further improving the efficiency of multi-rule matching. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0046] Figure 1 A flowchart of a multi-rule matching method provided in this application;

[0047] Figure 2 A flowchart of a specific multi-rule matching method provided in this application;

[0048] Figure 3 A flowchart of a specific multi-rule matching method provided in this application;

[0049] Figure 4A schematic diagram of a multi-rule matching device provided in this application;

[0050] Figure 5 This application provides a structural diagram of an electronic device. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0052] In existing technologies, custom logical expressions are created as rule matching conditions to achieve multi-rule matching. However, many rules contain numerous identical sub-expressions, leading to repeated matching of these same sub-expressions and decreased computational performance. To overcome these problems, this application proposes a multi-rule matching method that improves the efficiency of multi-rule matching.

[0053] This application discloses a multi-rule matching method. See also Figure 1 As shown, the method may include the following steps:

[0054] Step S11: Using the ANTLR parser, multiple logical expressions are parsed according to the AND logical operator to split them into multiple sub-expressions.

[0055] First, the logical expression is parsed. Based on the AND logical operator within the expression, the expressions on both sides connected by the AND operator are split into independent expressions to obtain multiple sub-expressions. For example, the logical expression AANDB is split into sub-expressions A and B. Specifically, parsing tools such as ANTLR can be used, providing a parsing foundation for subsequent syntax transformation and tree-like display. ANTLR (Another Tool for Language Recognition) is a powerful parser generator widely used to build languages, tools, and frameworks. It can be used to read, process, execute, or translate structured text or binary files. Using ANTLR, a parser capable of building and traversing parse trees can be generated from user-defined syntax. Then, based on the ANTLR parser, syntax validation, semantic analysis, and syntax transformation can be easily performed using the visitor pattern.

[0056] In this embodiment, the step of using the ANTLR parser to parse multiple logical expressions according to the AND logical operator to decompose them into multiple sub-expressions may include: generating an ANTLR syntax file based on the syntax and lexical structure of the logical expressions; converting the ANTLR syntax file into an ANTLR syntax tree using the ANTLR parser; and decomposing the ANTLR syntax tree using the ANTLR parser according to the AND logical operator to obtain multiple sub-expressions of the logical expressions. It can be understood that first, an ANTLR syntax file is generated based on the syntax and lexical structure of the logical expressions; then, the ANTLR parser is used to decompose the logical expression rules based on the AND logical operator using the visitor pattern to form sub-expressions. The aforementioned ANTLR syntax file (.g4 file) includes the syntax and lexical format of the logical expression. Specifically, based on the syntax file, the ANTLR tool parses each logical expression rule to generate a corresponding ANTLR syntax tree; the ANTLR tool compiles to obtain the ANTLR runtime interface, converting the input text into a syntax analysis tree corresponding to the predefined syntax file; and finally, the ANTLR tool parses each logical expression rule to generate a corresponding ANTLR syntax tree. Then, the ANTLR syntax tree is transformed using the ANTLR visitor pattern, splitting it according to the AND logical operator. Specifically, when accessing the AND operator interface, if the existing subexpression list does not include the left or right subexpression of the AND operator, the left or right subexpression is added as an independent subexpression to the subexpression list. Finally, for each logical expression rule, multiple subexpressions are obtained by splitting it according to the AND logical operator. For example, AAND(BORC) can be split into two subexpressions: subexpression A and subexpression BORC.

[0057] Step S12: Based on the frequency of each sub-expression, select the common sub-expression as the parent node from all the sub-expressions.

[0058] In this embodiment, by counting the frequency of each sub-expression—that is, the number of times each sub-expression appears among all sub-expressions—common sub-expressions are selected as child nodes for subsequent rule tree construction. For example, logical expression rule 1: AANDB, logical expression rule 2: AANDC, then logical expression rules 1 and 2 both contain sub-expression A, so sub-expression A is extracted as a common sub-expression. That is, sub-expression A is the parent node and contains two child nodes, B and C. For multiple rule logical expressions, multiple rule trees containing common expressions can ultimately be formed.

[0059] Step S13: Based on the parent node, according to the logical expression and the computational complexity and frequency of the other sub-expressions, select the target sub-expressions as child nodes to construct a rule tree to obtain one or more rule trees.

[0060] In this embodiment, after selecting the parent node, a rule tree is constructed based on the parent node and the logical relationships between different sub-expressions of the logical expression. During the construction process, the target sub-expressions are sequentially selected as child nodes based on the computational cost and frequency of the remaining sub-expressions (excluding the parent node) to construct one or more rule trees. That is, the child nodes of the rule tree are sorted according to the frequency and computational cost of their corresponding sub-expressions. Therefore, when using the rule tree for rule matching, rules with higher computational cost priority can be matched first, thereby reducing the computational cost of rule matching. Specifically, the computational cost can be calculated for each sub-expression based on the pre-defined priority of the operators. It can be understood that different operators represent different computational costs, and corresponding computational cost sizes are set. For example, if the computational cost of the "equals" operator < the computational cost of the "string contains" operator < the computational cost of the "regular expression" operator, then the priority of the operators is set to "equals" > "string contains" > "regular expression". Based on the pre-defined operator priorities and all operators contained in the current sub-expression, the computational cost of the sub-expression can be calculated. In other words, in this embodiment, common sub-expressions are obtained by judging and extracting logical operators from the syntax tree parsed by ANTLR. Based on these common sub-expressions, multiple logical expressions are split and reorganized, and sorted and reorganized according to the priority of computational complexity to form a tree structure expression. In order, the multi-rule matching of data is finally completed according to the tree structure order based on the sorted tree structure, thereby reducing the computational complexity of rule matching.

[0061] In this embodiment, the step of selecting common sub-expressions from all sub-expressions as parent nodes based on the frequency of each sub-expression, and then, based on the parent nodes, sequentially selecting target sub-expressions as child nodes to construct a rule tree to obtain one or more rule trees, may include: counting the frequency of each sub-expression and extracting common sub-expressions from all sub-expressions based on the frequency; selecting sub-expressions that appear only once from all sub-expressions to generate a parent node list; determining the computational quantity corresponding to each sub-expression based on the priority of the operators; defining rules and the operators contained in the sub-expressions to determine the computational quantity priority parameter of each sub-expression based on its frequency and computational quantity; the computational quantity priority parameter being the ratio of the frequency to the computational quantity; and using each sub-expression in the parent node list and the common sub-expression as parent nodes, and sequentially selecting target sub-expressions as child nodes of each level based on the computational quantity priority of the remaining sub-expressions excluding the parent nodes to construct a rule tree to obtain one or more rule trees.

[0062] It is understandable, for example Figure 2 As shown, in addition to selecting common sub-expressions as parent nodes, individual nodes that appear only once are also selected. This involves extracting sub-expressions that appear only once from the set of sub-expressions corresponding to multiple logical expression rules, forming a separate list of parent nodes. If no sub-expression appears only once in any set of sub-expressions, the parent node list is added to the sub-expression with the highest priority based on the computational priority parameter. Then, the parent node list is removed from the set of sub-expressions corresponding to all logical expressions, resulting in the remaining set of sub-expressions. Next, by traversing all parent nodes, for each parent node, the computational priority parameter of each sub-expression is determined based on its frequency and computational complexity. Then, based on the computational priority of the remaining sub-expressions (excluding parent nodes), the target sub-expressions are sequentially selected as child nodes for each level to construct the rule tree. That is, sub-expressions with higher computational priority are extracted as child nodes of the previously determined nodes, and this process continues until all sub-expressions are included as nodes in the rule tree, ultimately resulting in multiple rule trees merged into a tree-like structure. In other words, the child nodes of the rule tree are sorted according to the priority of the computational complexity of the corresponding sub-expressions. When using the rule tree for rule matching, rules with high computational priority can be matched first, avoiding matching sub-expressions with low frequency and high computational complexity first, thereby reducing the computational complexity of rule matching and avoiding wasting computing resources.

[0063] In this embodiment, after constructing a rule tree by sequentially selecting target sub-expressions as child nodes based on the parent node, according to the computational complexity and frequency of the logical expression and the other sub-expressions, to obtain one or more rule trees, the method may further include: generating key-value pairs of a list of sub-expressions and rule names corresponding to each logical expression based on the logical expression; traversing the rule tree using the key-value pairs, and adding the corresponding rule name at the target node where the key-value pair matches successfully. That is, by sorting the split sub-expressions in character order, a sorted list of sub-expressions and key-value pairs of rule names are formed, with each logical expression corresponding to a rule name and one or more sub-expressions. Then, all rule trees are traversed, adding them sequentially to the sub-expression list from parent node to child node, and sorting them in character order. Matching is performed between the sorted list of sub-expressions and the key-value pairs; if a match is successful, the rule name information is marked on the tree node, until all nodes of the rule tree have been traversed. For example, if we define AANDB as logical expression 1, and the parent node of the constructed rule tree is A, and the parent node A contains a child node B, then after assigning rule names to the rule tree through the above steps, the rule name corresponding to the child node B is logical expression 1. If node A is not a complete logical expression, then node A does not have a corresponding rule name.

[0064] In this embodiment, after constructing a rule tree by sequentially selecting target sub-expressions as child nodes based on the parent node, according to the logical expression and the computational complexity and frequency of the other sub-expressions to obtain one or more rule trees, the process may further include: traversing all nodes of the rule tree; if it is detected that the current node has only one child node and the current node does not have a corresponding rule name, then the child node is merged with the current node, and the rule name corresponding to the child node is assigned to the current node. That is, by traversing all rule tree nodes, if the current node has exactly one child node and the current node does not have a rule name, then the expression of the child node is extracted and connected to the expression of the current node using AND, and the rule tree under the child node is merged into the current node, and the rule name corresponding to the child node is assigned to the current node. All rule tree nodes are traversed. By merging a single rule, the number of times the rule matching is performed on the expression can be reduced, saving the computational complexity of the rule matching. Then, the rule tree nodes after merging the single rule are traversed, and the sub-expressions corresponding to each node are pre-compiled to facilitate multiple data matching.

[0065] In this embodiment, after constructing a rule tree by sequentially selecting target sub-expressions as child nodes based on the parent node, according to the logical expression and the computational complexity and frequency of the other sub-expressions to obtain one or more rule trees, it may further include: traversing all nodes of the rule tree; if the sub-expression of the current node contains an OR logical operator, then splitting the sub-expression of the current node according to the OR logical operator to obtain multiple new sub-expressions, and generating new child nodes based on the new sub-expressions; determining the computational priority parameter corresponding to the new sub-expression, sorting the new child nodes according to the computational priority parameter corresponding to the new sub-expression, and then replacing the current node with the new child nodes in the sorted order.

[0066] This involves splitting and sorting sub-expressions containing the OR logical operator within the rule tree nodes. Specifically, this is done by traversing all rule tree nodes and splitting sub-expressions containing the OR logical operator. This can be achieved by using the ANTLR tool to generate corresponding ANTLR syntax trees from the sub-expressions of the rule tree nodes based on the syntax file of the logical rule expressions. Then, the ANTLR syntax trees are transformed using the ANTLR visitor pattern, and finally split according to the OR logical operator. This means treating the left-hand or right-hand sub-expression of the OR logical operator as a separate new child node. Furthermore, the new sub-expressions are sorted in ascending order of computational priority based on the priority parameter of the corresponding computational cost. Therefore, expressions with lower computational cost can be prioritized, saving computational resources in rule matching.

[0067] Step S14: Obtain the data to be detected, and use the rule tree to perform rule matching on the data to be detected in sequence starting from the parent node. If the matching fails, skip the rule matching of all child nodes of the current node and output the matching result.

[0068] In this embodiment, after constructing the rule tree, the data to be detected is obtained. Then, the rule tree is used to perform rule matching on the data to be detected sequentially, starting from the parent node. If a match fails, the matching result is short-circuited and output. That is, if the current node fails to match, the rule matching of all child nodes of the current node is skipped. In other words, when expressions with low computational complexity satisfy the judgment condition first, expressions with higher computational complexity that follow can be ignored, saving computational resources in rule matching. Thus, by directly short-circuiting and outputting the matching result if a match fails in rule matching, and skipping the matching of all child nodes of the current node, the efficiency of multi-rule matching is further improved.

[0069] In this embodiment, the step of using the rule tree to perform rule matching on the data to be detected sequentially starting from the parent node, and skipping the rule matching of all child nodes of the current node and outputting the matching result if the matching fails, may include: using the rule tree to perform rule matching on the data to be detected starting from the parent node and in the node sorting order; if the subexpression corresponding to the current node does not match the data to be detected, skipping the rule matching of all child nodes of the current node and outputting the matching result; if the subexpression corresponding to the current node matches the data to be detected, obtaining the node information of the current node, and determining whether the current node has child nodes and whether the current node has a corresponding rule name based on the node information; if the current node has child nodes, performing rule matching operation on the data to be detected using the child nodes; if the current node has a corresponding rule name, outputting the rule name corresponding to the current node.

[0070] For example Figure 3 As shown, input the data to be detected, and match it according to the rule tree structure. First, the logical expression of the parent node is evaluated. If the logical expression of the parent node is not satisfied, the matching logic of all child nodes under that parent node can be skipped, saving the computational load of rule matching. If the logical expression of the node is satisfied and the node has a rule name, the rule name corresponding to the node can be directly output. If the logical expression of the node is satisfied, but the node does not have a rule name and the node has child nodes, then the logical expressions of the child nodes are matched until the rule name is output or all nodes have been traversed. If multiple logical expression rules are mutually exclusive, that is, only a single rule needs to be matched to output.

[0071] In this embodiment, the step of performing rule matching on the data to be detected sequentially from the parent node using the rule tree may include: calculating the computational load corresponding to each rule tree according to pre-configured operator priority definition rules and computational load calculation formulas; the operator priority definition rules include that operators with smaller computational loads have higher priority than operators with larger computational loads; the computational load calculation formula is a formula for adding the computational loads corresponding to the operators in the expression connected by the AND logical operator; sorting all the rule trees in ascending order of computational load according to the computational load corresponding to each rule tree to generate a rule tree list; and performing rule matching on the data to be detected according to the rule tree list.

[0072] This involves calculating the computational cost of each sub-expression based on pre-configured operator priority rules; calculating the computational cost of each rule tree based on the computational cost and its calculation formula; and then sorting the rule trees in ascending order of computational cost to generate a rule tree list. This list is then used for rule matching of the data to be tested, saving on the total computational cost of rule matching. Furthermore, it can count the sum of the frequencies of all nodes in each tree that satisfy the logical expression in real time, and sort them according to the total frequency and total computational cost, reducing the average number of matches. In essence, different operators represent different computational costs, and corresponding computational cost values ​​are set. For example, if the computational cost of the "equals" operator is less than that of the "string containment" operator, which is less than that of the "regular expression" operator, then the operator priority is set to "equals" > "string containment" > "regular expression," and the computational cost is set to "regular expression" > "string containment" > "equals." The formula for calculating the computational complexity of a rule tree is as follows: if two expressions are connected by AND or OR logical operators, the total computational complexity is the sum of the computational complexity corresponding to all operators in the two expressions.

[0073] As can be seen from the above, in this embodiment, the ANTLR parser is used to perform rule parsing on multiple logical expressions based on the AND logical operator to split them into multiple sub-expressions; based on the frequency of each sub-expression, common sub-expressions are selected from all the sub-expressions as parent nodes; based on the parent nodes, target sub-expressions are sequentially selected as child nodes to construct a rule tree based on the computational complexity and frequency of the logical expression and the other sub-expressions to obtain one or more rule trees; the data to be detected is obtained, and the rule trees are used to perform rule matching on the data to be detected sequentially starting from the parent node; if the matching fails, the rule matching of all child nodes of the current node is skipped and the matching result is output. As can be seen, ANTLR parsing breaks down multiple logical expressions into subexpressions based on the AND operator. Then, common subexpressions are extracted according to frequency to construct multiple tree structures. The child nodes of the rule tree are sorted according to the computational complexity and frequency of the corresponding subexpressions. Finally, the constructed rule tree is used to perform rule matching on the data to be detected. Therefore, by using the ANTLR parser to extract common subexpressions as parent nodes of the rule tree after splitting logical expressions, multiple matching of the same rule can be avoided during rule matching, improving the efficiency of rule matching. Furthermore, since the child nodes of the rule tree are sorted according to the frequency and computational complexity of their corresponding subexpressions, rules with higher computational priority can be matched first during rule matching, thereby reducing the computational load of rule matching. Additionally, if a match fails during rule matching, the matching of all child nodes of the current node is skipped, and the matching result is output, further improving the efficiency of multi-rule matching.

[0074] Accordingly, embodiments of this application also disclose a multi-rule matching device, see [link to relevant documentation]. Figure 4 As shown, the device includes:

[0075] The parsing and splitting module 11 is used to use the ANTLR parser to perform rule-based parsing on multiple logical expressions according to the AND logical operator, so as to split them into multiple sub-expressions;

[0076] The common sub-expression filtering module 12 is used to filter out common sub-expressions as parent nodes from all the sub-expressions based on the frequency of each sub-expression;

[0077] The rule tree construction module 13 is used to build a rule tree by sequentially selecting target sub-expressions as child nodes based on the parent node, according to the logical expression and the amount of computation and frequency of the other sub-expressions, in order to obtain one or more rule trees.

[0078] The rule matching module 14 is used to acquire the data to be detected, and to perform rule matching on the data to be detected in sequence starting from the parent node using the rule tree. If the matching fails, the rule matching of all child nodes of the current node is skipped and the matching result is output.

[0079] As can be seen from the above, in this embodiment, the ANTLR parser is used to perform rule parsing on multiple logical expressions based on the AND logical operator to split them into multiple sub-expressions; based on the frequency of each sub-expression, common sub-expressions are selected from all the sub-expressions as parent nodes; based on the parent nodes, target sub-expressions are sequentially selected as child nodes to construct a rule tree based on the computational complexity and frequency of the logical expression and the other sub-expressions to obtain one or more rule trees; the data to be detected is obtained, and the rule trees are used to perform rule matching on the data to be detected sequentially starting from the parent node; if the matching fails, the rule matching of all child nodes of the current node is skipped and the matching result is output. As can be seen, ANTLR parsing breaks down multiple logical expressions into subexpressions based on the AND operator. Then, common subexpressions are extracted according to frequency to construct multiple tree structures. The child nodes of the rule tree are sorted according to the computational complexity and frequency of the corresponding subexpressions. Finally, the constructed rule tree is used to perform rule matching on the data to be detected. Therefore, by using the ANTLR parser to extract common subexpressions as parent nodes of the rule tree after splitting logical expressions, multiple matching of the same rule can be avoided during rule matching, improving the efficiency of rule matching. Furthermore, since the child nodes of the rule tree are sorted according to the frequency and computational complexity of their corresponding subexpressions, rules with higher computational priority can be matched first during rule matching, thereby reducing the computational load of rule matching. Additionally, if a match fails during rule matching, the matching of all child nodes of the current node is skipped, and the matching result is output, further improving the efficiency of multi-rule matching.

[0080] In some specific embodiments, the parsing and splitting module 11 may specifically include:

[0081] The syntax tree generation unit is used to generate an ANTLR syntax file based on the syntax and lexical of the logical expression, and to convert the ANTLR syntax file into an ANTLR syntax tree using an ANTLR parser;

[0082] The splitting unit is used to split the ANTLR syntax tree according to the AND logical operator using the ANTLR parser, so as to obtain multiple sub-expressions of the logical expression.

[0083] In some specific embodiments, the multi-rule matching device may specifically include:

[0084] The key-value pair generation unit is used to generate key-value pairs of a list of sub-expressions and a rule name corresponding to each logical expression based on the logical expression.

[0085] The rule name addition unit is used to traverse the rule tree using the key-value pairs and add the corresponding rule name at the target node where the key-value pairs are successfully matched.

[0086] In some specific embodiments, the multi-rule matching device may specifically include:

[0087] The merging unit is used to traverse all nodes of the rule tree. If it is detected that the current node has only one child node and the current node does not have a corresponding rule name, then the child node is merged with the current node, and the rule name corresponding to the child node is assigned to the current node.

[0088] In some specific embodiments, the rule matching module 14 may specifically include:

[0089] The rule matching unit is used to perform rule matching on the data to be detected, starting from the parent node and following the node sorting order, using the rule tree;

[0090] The unit skips the rule matching of all child nodes of the current node and outputs the result. If the subexpression corresponding to the current node does not match the data to be detected, the unit skips the rule matching of all child nodes of the current node and outputs the matching result.

[0091] The node information acquisition unit is used to acquire the node information of the current node if the subexpression corresponding to the current node matches the data to be detected, and to determine whether the current node has child nodes and whether the current node has a corresponding rule name based on the node information.

[0092] The rule matching execution unit is used to perform rule matching operations on the data to be detected using the child nodes if the current node has child nodes.

[0093] The rule name output unit is used to output the rule name corresponding to the current node if the current node has a corresponding rule name.

[0094] In some specific embodiments, the rule matching module 14 may specifically include:

[0095] The rule tree computation calculation unit is used to calculate the computation amount corresponding to each rule tree according to the pre-configured priority definition rules and computation amount calculation formula of the operation operators; the priority definition rules of the operation operators include that the priority of the operation operators with smaller computation amounts is higher than that of the operation operators with larger computation amounts, and the computation amount calculation formula is a calculation formula for adding the computation amounts corresponding to the operation operators in the expression connected by the AND logical operator.

[0096] The rule tree list generation unit is used to sort all the rule trees in ascending order of computational complexity based on the computational complexity corresponding to each rule tree, and generate a rule tree list.

[0097] The rule detection unit is used to perform rule matching on the data to be detected according to the rule tree list.

[0098] In some specific embodiments, the multi-rule matching device may specifically include:

[0099] A common subexpression extraction unit is used to count the frequency of each subexpression and extract the common subexpression from all the subexpressions based on the frequency.

[0100] The parent node list generation unit is used to filter out the sub-expressions that appear only once from all the sub-expressions to generate a parent node list;

[0101] The computational priority parameter determination unit is used to determine the computational quantity corresponding to the sub-expression according to the priority definition rules of the operation operator and the operation operator contained in the sub-expression, and then determine the computational priority parameter of each sub-expression according to the frequency and computational quantity of the sub-expression; the computational priority parameter is the ratio of the frequency to the computational quantity;

[0102] The rule tree construction unit is used to select target sub-expressions as child nodes of each level based on the priority of the computational complexity of the remaining sub-expressions other than the parent nodes, so as to obtain one or more rule trees.

[0103] In some specific embodiments, the multi-rule matching device may specifically include:

[0104] The splitting unit is used to traverse all nodes of the rule tree. If the subexpression of the current node contains an OR logical operator, the subexpression of the current node is split according to the OR logical operator to obtain multiple new subexpressions, and a new child node is generated based on the new subexpressions.

[0105] The replacement unit is used to determine the computational priority parameter corresponding to the new sub-expression, sort the new child nodes according to the computational priority parameter corresponding to the new sub-expression, and then replace the current node with the new child nodes in the order determined by the sorting.

[0106] Furthermore, this application also discloses an electronic device, see [link to relevant documentation]. Figure 5 As shown, the content in the figure should not be considered as any limitation on the scope of use of this application.

[0107] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the multi-rule matching method disclosed in any of the foregoing embodiments.

[0108] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0109] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored on it include operating system 221, computer program 222 and data 223 including rule tree, etc., and the storage method can be temporary storage or permanent storage.

[0110] The operating system 221 manages and controls the various hardware devices on the electronic device 20 and the computer program 222 to enable the processor 21 to perform calculations and processing on the massive amounts of data 223 in the memory 22. The operating system 221 can be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of performing the multi-rule matching method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0111] Furthermore, this application also discloses a computer storage medium storing computer-executable instructions. When the computer-executable instructions are loaded and executed by a processor, they implement the steps of the multi-rule matching method disclosed in any of the foregoing embodiments.

[0112] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0113] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0114] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0115] The foregoing has provided a detailed description of the multi-rule matching method, apparatus, device, and medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A multi-rule matching method, characterized in that, include: The ANTLR parser is used to parse multiple logical expressions according to the AND logical operator, so as to split them into multiple sub-expressions; Based on the frequency of each sub-expression, select the common sub-expression from all the sub-expressions as the parent node; Based on the parent node, and according to the computational complexity and frequency of the logical expression and the other sub-expressions, target sub-expressions are sequentially selected as child nodes to construct a rule tree to obtain one or more rule trees. The system acquires the data to be detected and uses the rule tree to perform rule matching on the data to be detected in sequence, starting from the parent node. If the matching fails, the system skips the rule matching of all child nodes of the current node and outputs the matching result. The step of performing rule matching on the data to be detected using the rule tree, starting from the parent node and proceeding sequentially, includes: According to the pre-configured operator priority definition rules and operation amount calculation formula, the operation amount corresponding to each rule tree is calculated; the operator priority definition rules include that the operator with smaller operation amount has higher priority than the operator with larger operation amount, and the operation amount calculation formula is a calculation formula that adds the operation amounts corresponding to the operators in the expression connected by the AND logical operator. Based on the computational complexity corresponding to each rule tree, all rule trees are sorted in ascending order of computational complexity to generate a rule tree list; The data to be detected is matched against rules according to the rule tree list; Specifically, the process involves selecting common sub-expressions from all sub-expressions based on their frequency to serve as parent nodes; and then, based on these parent nodes, sequentially selecting target sub-expressions as child nodes according to the logical expression and the computational complexity and frequency of the remaining sub-expressions to construct a rule tree, thereby obtaining one or more rule trees. Count the frequency of each of the sub-expressions, and extract the common sub-expressions from all the sub-expressions based on the frequency; Generate a list of parent nodes by filtering out the subexpressions that appear only once from all the subexpressions; The computational quantity of the subexpression is determined according to the priority definition rules of the operation operators and the operation operators contained in the subexpression. Then, the computational quantity priority parameter of each subexpression is determined according to the frequency and computational quantity of the subexpression. The computational quantity priority parameter is the ratio of the frequency to the computational quantity. Each sub-expression in the parent node list and the common sub-expression are taken as parent nodes, and the target sub-expressions are selected as child nodes of each level according to the priority of the computational complexity of the remaining sub-expressions other than the parent nodes to construct a rule tree, so as to obtain one or more rule trees.

2. The multi-rule matching method according to claim 1, characterized in that, The ANTLR parser is used to parse multiple logical expressions according to the AND logical operator, thereby splitting them into multiple sub-expressions, including: An ANTLR syntax file is generated based on the syntax and lexical of the logical expression, and the ANTLR syntax file is converted into an ANTLR syntax tree using an ANTLR parser. The ANTLR parser is used to split the ANTLR syntax tree according to the AND logical operator to obtain multiple sub-expressions of the logical expression.

3. The multi-rule matching method according to claim 1, characterized in that, After constructing a rule tree by sequentially selecting target sub-expressions as child nodes based on the parent node, according to the computational complexity and frequency of the logical expression and the other sub-expressions, to obtain one or more rule trees, the method further includes: Based on the logical expression, generate a list of sub-expressions and key-value pairs of rule names corresponding to each logical expression; The rule tree is traversed using the key-value pairs, and the corresponding rule name is added at the target node where the key-value pair matches successfully.

4. The multi-rule matching method according to claim 3, characterized in that, After constructing a rule tree by sequentially selecting target sub-expressions as child nodes based on the parent node, according to the computational complexity and frequency of the logical expression and the other sub-expressions, to obtain one or more rule trees, the method further includes: Traverse all nodes of the rule tree. If it is detected that the current node has only one child node and the current node does not have a corresponding rule name, then merge the child node with the current node and assign the rule name corresponding to the child node to the current node.

5. The multi-rule matching method according to claim 3, characterized in that, The process of using the rule tree to perform rule matching on the data to be detected sequentially, starting from the parent node, and skipping the rule matching of all child nodes of the current node if a match fails, includes: The rule tree is used to perform rule matching on the data to be detected, starting from the parent node and following the node sorting order. If the subexpression corresponding to the current node does not match the data to be detected, then skip the rule matching of all child nodes of the current node, and output the matching result. If the subexpression corresponding to the current node matches the data to be detected, then obtain the node information of the current node, and determine whether the current node has child nodes and whether the current node has a corresponding rule name based on the node information; If the current node has child nodes, then the rule matching operation on the data to be detected is performed using the child nodes; If the current node has a corresponding rule name, then output the rule name corresponding to the current node.

6. The multi-rule matching method according to claim 1, characterized in that, After constructing a rule tree by sequentially selecting target sub-expressions as child nodes based on the parent node, according to the computational complexity and frequency of the logical expression and the other sub-expressions, to obtain one or more rule trees, the method further includes: Traverse all nodes of the rule tree. If the subexpression of the current node contains an OR logical operator, then split the subexpression of the current node according to the OR logical operator to obtain multiple new subexpressions, and generate new child nodes based on the new subexpressions. The computational priority parameter corresponding to the new sub-expression is determined, and the new child nodes are sorted according to the computational priority parameter corresponding to the new sub-expression. Then, the current node is replaced by the new child nodes in the order determined by the sorting.

7. A multi-rule matching device, characterized in that, include: The parsing and splitting module is used to use the ANTLR parser to parse multiple logical expressions according to the AND logical operator, so as to split them into multiple sub-expressions; The common sub-expression filtering module is used to filter out common sub-expressions as parent nodes from all the sub-expressions based on the frequency of each sub-expression; The rule tree construction module is used to build a rule tree by sequentially selecting target sub-expressions as child nodes based on the parent node, according to the logical expression and the amount of computation and frequency of the other sub-expressions, in order to obtain one or more rule trees. The rule matching module is used to acquire the data to be detected, and to perform rule matching on the data to be detected in sequence starting from the parent node using the rule tree. If the matching fails, the rule matching of all child nodes of the current node is skipped and the matching result is output. The rule matching module is used to calculate the computational quantity corresponding to each rule tree according to the pre-configured priority rules and computational quantity calculation formula of the operation operators; the priority rules of the operation operators include that the priority of the operation operators with smaller computational quantities is higher than that of the operation operators with larger computational quantities, and the computational quantity calculation formula is a calculation formula for adding the computational quantities corresponding to the operation operators in the expression connected by the AND logical operator; according to the computational quantity corresponding to each rule tree, all rule trees are sorted in ascending order of computational quantity to generate a rule tree list; The data to be detected is matched against rules according to the rule tree list; The multi-rule matching device is used to count the frequency of each sub-expression, extract common sub-expressions from all sub-expressions based on the frequency, and generate a parent node list by filtering out sub-expressions that appear only once from all sub-expressions. The computational complexity of a subexpression is determined based on the priority rules of the operators and the operators contained in the subexpression. Then, the computational complexity priority parameter of each subexpression is determined based on its frequency and computational complexity. The computational complexity priority parameter is the ratio of the frequency to the computational complexity. Each subexpression in the parent node list and the common subexpression are taken as parent nodes, and the target subexpressions are selected as child nodes of each level according to the computational complexity priority of the remaining subexpressions excluding the parent nodes to construct a rule tree, thereby obtaining one or more rule trees.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the multi-rule matching method as described in any one of claims 1 to 6.

Images