A top-k ranking query and storage method and device

Abstract

The present application provides a top-k ranking query, storage method and device, which relates to the field of data processing. The top-k ranking query method includes: when receiving a top-k ranking query request, extracting the query time range included in the query request; dividing the query time range according to a preset time division level to obtain multiple query time intervals; obtaining multiple query data tables corresponding to the multiple query time intervals; extracting data according to the multiple query data tables to obtain a data set; performing top-k ranking on the data set to obtain a top-k ranking result. It can be seen that the implementation of this implementation method can quickly and stably query the top-k ranking results within a period of time when the resources of a single machine are limited, thereby solving the previous query efficiency problems and system burden problems.

Description

Technical Field

[0001] The present application relates to the field of data processing, and more specifically, to a top-k ranking query and storage method and device. Background Art

[0002] With the advent of the data age, various industries can use a large amount of data for data analysis to obtain corresponding huge benefits. Among them, a large amount of data is accompanied by a large number of network security logs. In order to achieve security protection, technicians often need to query the top-k attack host ranking results within a certain period of time. However, in practice, it is found that top-k ranking of a large amount of data will seriously increase the time consumption and lead to a significant reduction in efficiency; at the same time, frequent operations will also greatly increase the number of disk I / O reads and writes and the number of CPU-intensive calculations, thereby causing a huge load on the system, which in turn affects the stability of top-k ranking queries. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a top-k ranking query method and device, which can quickly and stably query the top-k ranking results within a period of time when the resources of a single machine are limited, thereby solving the previous query efficiency and system burden problems.

[0004] A first aspect of an embodiment of the present application provides a top-k ranking query method, comprising:

[0005] When receiving a query request for top-k ranking, extracting a query time range included in the query request;

[0006] Dividing the query time range according to a preset time division level to obtain multiple query time intervals;

[0007] Acquire multiple query data tables corresponding to the multiple query time intervals one by one;

[0008] Extract data according to the multiple query data tables to obtain a data set;

[0009] Perform a top-k ranking on the data set to obtain a top-k ranking result.

[0010] In the above implementation process, when receiving a query request for top-k ranking, the method can divide the query time range in the query request according to the time division level, and obtain the data information in the corresponding time according to the division result, and then perform top-k ranking on the data. It can be seen that by implementing this implementation method, the received network security log can be cached in a time-sharing multi-level manner, so that the method can perform time-sharing multi-level query according to the received query request, thereby improving the query speed of top-k ranking; at the same time, due to the preprocessing, the number of disk I / O reads and writes can be reduced to a great extent, thereby greatly reducing the burden on the system, and thus improving the stability of the system. In addition, in the traditional method, the top-k ranking is based on all data, and the result of the top-k ranking based on all data is often more accurate; however, the method of processing data can classify and cache all data, so that when top-k querying, only part of the data in the cache can be effectively queried, thereby effectively improving the efficiency of top-k ranking on the basis of ensuring that the result of top-k ranking is more accurate.

[0011] Furthermore, when receiving a query request for top-k ranking, before extracting the query time range included in the query request, the method further includes:

[0012] Detect top-k ranking query requests initiated by the Web through ApiServer.

[0013] Furthermore, the step of dividing the query time range according to a preset time division level to obtain a plurality of query time intervals includes:

[0014] The query time range is divided into query month, query week, query day, query hour and query minute; the query month, query week, query day, query hour and query minute constitute a plurality of query time intervals.

[0015] Furthermore, the step of extracting data according to the multiple query data tables to obtain a data set includes:

[0016] Extracting hot data from the multiple query data tables;

[0017] Search for cold data within the query time range through Elasticsearch;

[0018] The hot data and the cold data are combined to obtain a data set.

[0019] A second aspect of the embodiment of the present application provides a top-k ranking storage method, including:

[0020] Use Logstash to obtain multiple network security logs sent by multiple firewalls at the same time;

[0021] Dividing the receiving time of the plurality of network security logs according to a preset time division level to obtain a plurality of receiving time intervals;

[0022] The multiple network security logs are used to generate multiple query data tables according to the multiple receiving time intervals.

[0023] In the above implementation process, the method can obtain a large number of network security logs in advance, and then divide the large number of network security logs according to the preset time division level, and then establish multiple query data tables according to the division results. It can be seen that by implementing this implementation method, the received network security logs can be stored according to the time period, so that the network security logs can be distributed according to time, which is convenient for calling and querying.

[0024] A third aspect of an embodiment of the present application provides a top-k ranking query device, the top-k ranking query device comprising:

[0025] an extraction unit, configured to extract, when receiving a query request for top-k ranking, a query time range included in the query request;

[0026] A division unit, used to divide the query time range according to a preset time division level to obtain multiple query time intervals;

[0027] An acquisition unit, configured to acquire a plurality of query data tables corresponding one-to-one to the plurality of query time intervals;

[0028] The extraction unit is further used to extract data according to the multiple query data tables to obtain a data set;

[0029] The ranking unit is used to perform top-k ranking on the data set to obtain a top-k ranking result.

[0030] In the above implementation process, when the query device receives a query request for top-k ranking, it can determine the corresponding multiple time periods according to the query request, and then obtain the network security logs in each time period, and perform top-k ranking on these logs to obtain the top-k ranking results. It can be seen that the implementation of this implementation method can use a multi-level cache method to participate in the top-k ranking query under the limited resources of a single machine, thereby avoiding all data from participating in the query, thereby improving the query efficiency of the top-k ranking results.

[0031] Furthermore, the division unit is specifically used to divide the query time range into query month, query week, query day, query hour and query minute; the query month, query week, query day, query hour and query minute constitute multiple query time intervals.

[0032] A fourth aspect of the embodiments of the present application provides a top-k ranking storage device, the storage device comprising:

[0033] The receiving unit is used to obtain multiple network security logs sent by multiple firewalls simultaneously through Logstash;

[0034] A division unit, used to divide the receiving time of the plurality of network security logs according to a preset time division level to obtain a plurality of receiving time intervals;

[0035] The generating unit is used to generate a plurality of query data tables according to the plurality of receiving time intervals from the plurality of network security logs.

[0036] In the above implementation process, the device can store the received network security logs according to the time period, so that the network security logs can be distributedly stored according to time, which is convenient for calling and querying.

[0037] A fifth aspect of an embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the top-k ranking query method described in any one of the first aspect of the embodiments of the present application.

[0038] A sixth aspect of an embodiment of the present application provides a computer-readable storage medium storing computer program instructions. When the computer program instructions are read and executed by a processor, the top-k ranking query method described in any one of the first aspect of the embodiment of the present application is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A schematic diagram of a top-k ranking query method provided in an embodiment of the present application;

[0041] Figure 2A schematic diagram of a top-k ranking method for storing data provided in an embodiment of the present application

[0042] Figure 3 A schematic diagram of the structure of a top-k ranking query device provided in an embodiment of the present application;

[0043] Figure 4 A schematic diagram of the structure of a top-k ranking storage device provided in an embodiment of the present application;

[0044] Figure 5 An example architecture diagram of a top-k ranking query device or a top-k ranking storage device provided in an embodiment of the present application;

[0045] Figure 6 A flowchart of a top-k ranking storage instance provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0047] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0048] Example 1

[0049] Please see Figure 1 , Figure 1 A flowchart of a top-k ranking query method is provided for an embodiment of the present application. The top-k ranking query method includes:

[0050] S101. Detect the top-k ranking query request initiated by the Web through ApiServer.

[0051] In this embodiment, the Web initiates a top-k ranking query request within a certain time range to the ApiServer, and the ApiServer receives and processes the request.

[0052] S102: When receiving a query request for top-k ranking, extract the query time range included in the query request.

[0053] S103, dividing the query time range into query month, query week, query day, query hour and query minute; the query month, query week, query day, query hour and query minute constitute a plurality of query time intervals.

[0054] S104: Acquire multiple query data tables corresponding to multiple query time intervals.

[0055] S105: Extract hot data from multiple query data tables.

[0056] S106. Search and query cold data within the time range through Elasticsearch.

[0057] S107: Combine hot data and cold data to obtain a data set.

[0058] In this embodiment, the method can first interact with mongdb to obtain the data related to this time period in the multi-level data cache layer through ApiServer according to the time range of the query condition, and then interact with Elasticsearch to obtain a small amount of cold data that is not in the multi-level data cache layer but within the time range of the query condition.

[0059] In this embodiment, the method can combine hot data and cold data to obtain a data set.

[0060] In this embodiment, the method can create multi-level cache data based on multiple network security logs, and then extract the cache data of the corresponding range from the multi-level cache data based on the user's query condition range, and then supplement a small amount of data that is not in the cache range, so as to aggregate into a final data set and return it to the user. The data in the multi-level cache data is hot data, and the data that is no longer in the cache range is cold data.

[0061] S108. Perform top-k ranking on the data set to obtain a top-k ranking result.

[0062] In this embodiment, the method can return the final top-k ranking result to the Web through the ApiServer.

[0063] For example, to query the recent (query time range is t days and h hours) top-k network security log troubleshooting status (today is week x). Calculate using the following formula:

[0064] (t–x) / 7=u(quotient)…y(remainder);

[0065] First, split t days according to the cache data layer, take the data of the most recent u weeks from cache_week, take the data of x days and y days from cache_day, and take the data of h hours from cache_hour. Re-aggregate and count the cache data of the three, and finally return the top-k ranking results.

[0066] See also Figure 5 , Figure 5An example architecture diagram of a top-k ranking query device or a top-k ranking storage device is shown. It should be understood that the top-k ranking query device or the top-k ranking storage device can actually be the same device.

[0067] By implementing this implementation method, the time required to query the top-k ranking situation can be shortened to about 1 second under the condition of a single machine with 16G resources and a total of 2TB of network security log data, thereby improving the query efficiency by dozens of times. It can be seen that this method can pre-process multi-level data cache based on a k*N times fixed threshold, and realize the optimization of querying the top-k ranking of network security logs based on a single machine with limited resources and processing a large amount of network security logs.

[0068] In the embodiment of the present application, the execution subject of the method can be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0069] In the embodiment of the present application, the execution subject of the method can also be a smart device such as a smart phone, a tablet computer, etc., and there is no limitation on this in the present embodiment.

[0070] It can be seen that the top-k ranking query method described in this embodiment can improve the query speed of the top-k ranking by performing time-sharing multi-level caching on the received network security logs, so that the method can perform time-sharing multi-level queries according to the received query requests; at the same time, due to the preprocessing, the number of disk I / O reads and writes can be greatly reduced, thereby greatly reducing the burden on the system and further improving the stability of the system.

[0071] Example 2

[0072] Please see Figure 2 , Figure 2 A flowchart of a top-k ranking query method is provided for an embodiment of the present application. The top-k ranking query method includes:

[0073] S201. Obtain multiple network security logs sent simultaneously by multiple firewalls through Logstash.

[0074] In this embodiment, in the method, there are n firewalls that send network security logs to Logstash at the same time.

[0075] In this embodiment, logstash receives network security logs and connects to Elasticsearch to store the network security logs in the database.

[0076] In this embodiment, the method is applied to the scenario where the management center of the distributed firewall is installed in a stand-alone environment. Specifically, the method first uses Logstash to receive network security logs, and then connects to Elasticsearch through Logstash to store network security logs. Among them, assuming that the memory resources of a single machine are 16G, the total amount of data that needs to be processed for network security logs is 2TB, and the maximum value of the top number of network security logs that users can query is 500, and a suitable fixed multiple selected according to the actual data volume is 20. The fixed threshold (the top number of data to be stored in the cache after data aggregation and sorting) is based on the maximum value of the user query ranking multiplied by a fixed multiple, so the value here is 10000.

[0077] In this embodiment, the above 500 is the number of logs displayed in the top-k query result, and 10000 is the total amount of data in a single query. These two values ​​are example values.

[0078] S202: Divide the receiving time of multiple network security logs according to preset time division levels to obtain multiple receiving time intervals.

[0079] In this embodiment, the method can call Elasticsearch through a multi-level cache module to aggregate and sort the full amount of network security logs in each receiving time interval, and take the ranking results before the fixed threshold of 10,000 as the first-level data cache. When the number of first-level data caches reaches a certain amount, it is aggregated into a second-level data cache, and multi-level cache data is generated in sequence. Among them, the multi-level data cache layer generated by preprocessing is stored in the mongdb temporary database.

[0080] In this embodiment, the original data of the network security log stored in the Elasticsearch database is cold data, and the query time is long; the cached data processed by the multi-level cache is hot data, and the query speed is fast. The multi-level cache is to achieve aggregation sorting through the query statement of Elasticsearch, and then store the cached data in the database.

[0081] S203: Generate multiple query data tables based on multiple receiving time intervals for multiple network security logs.

[0082] In this embodiment, the method uses a multi-level cache approach to pre-process multiple network security logs.

[0083] See also Figure 6 , Figure 6 A flowchart of a top-k ranking storage instance provided in an embodiment of the present application.

[0084] For example, multi-level caching is to aggregate the full amount of network security log data in this fixed time period at fixed time points (for example, 1 hour), and take the front k*N (as a threshold) data as hourly cache data. When the number of hourly caches reaches a certain value, it is aggregated into daily basic cache data based on the hourly cache data. When the number of caches on the same day reaches a certain value, it is aggregated into weekly basic cache data based on the daily cache data. This is executed in sequence to eventually form multi-level cache data of hours, days, weeks, and months.

[0085] It can be understood that every hour, every day, every week and every month refer to the time intervals of hours, days, weeks and months. In these time intervals, the method can obtain data for multiple hours, and the data for each hour is a query data table; then when twenty-four hours of a day have passed, the twenty-four query data tables can be aggregated into a monthly query data table; and so on, the method obtains a weekly query data table and a monthly query data table. It can be seen that the method can obtain multiple query data tables.

[0086] By implementing this implementation method, a large number of network security logs can be pre-processed with multi-level cache in a single machine environment with limited resources, thereby solving the two problems of slow top-k ranking queries and unlimited resource expansion as the amount of data continues to grow.

[0087] In this embodiment, the method can store the statistical results of the first 10,000 network security logs in this time period into the cache_minute table of mongdb every 15 minutes, forming minute-level cache data; every hour, the minute data within this hour is taken out from the cache_minute table for aggregation, and the statistical results are stored in the cache_hour table of mongdb; according to this rule, cache data of cache_day, cache_week, and cache_month are stored in turn, forming a multi-level and table-based data cache layer. Among them, multiple query data tables include cache_minute table, cache_hour table, cache_day table, cache_week table, and cache_month table.

[0088] See also Figure 5 , Figure 5 An example architecture diagram of a top-k ranking query device or a top-k ranking storage device is shown. It should be understood that the top-k ranking query device or the top-k ranking storage device can actually be the same device.

[0089] In this embodiment, the method can periodically maintain multiple cache tables of mongdb through a multi-level cache monitoring plug-in to ensure the continuity and accuracy of the data, regularly delete expired data, and then control the overall records of the data cache layer within a reasonable range.

[0090] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0091] In the embodiment, the execution subject of the method can also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0092] It can be seen that the top-k ranking query method described in this embodiment can introduce a multi-level cache to pre-process the network security log, so that the subsequent steps can perform top-k ranking queries based on the pre-processing results, thereby improving the top-k ranking query requests. At the same time, since the method pre-processes the network security log, the method can greatly reduce the number of disk I / O reads and writes, thereby greatly reducing the burden on the system and ensuring the stability of the system.

[0093] Example 3

[0094] Please see Figure 3 , Figure 3 A schematic diagram of the structure of a top-k ranking query device provided in an embodiment of the present application. Figure 3 As shown, the top-k ranking query device includes:

[0095] The extraction unit 310 is used to extract the query time range included in the query request when receiving the query request of the top-k ranking;

[0096] A division unit 320, configured to divide the query time range according to a preset time division level to obtain a plurality of query time intervals;

[0097] An acquisition unit 330 is used to acquire a plurality of query data tables corresponding to a plurality of query time intervals one by one;

[0098] The extraction unit 310 is further used to extract data according to the multiple query data tables to obtain a data set;

[0099] The ranking unit 340 is used to perform top-k ranking on the data set to obtain a top-k ranking result.

[0100] As an optional implementation, the division unit 320 is specifically used to divide the query time range into query month, query week, query day, query hour and query minute; the query month, query week, query day, query hour and query minute constitute multiple query time intervals.

[0101] As an optional implementation manner, the top-k ranking query device further includes:

[0102] The detection unit 350 is used to detect the top-k ranking query request initiated by the Web through the ApiServer.

[0103] As an optional implementation, the extraction unit 310 includes:

[0104] An extraction subunit 311 is used to extract hot data from multiple query data tables;

[0105] A search subunit 312 is used to search for cold data within a query time range through Elasticsearch;

[0106] The combining subunit 313 is used to combine the hot data and the cold data to obtain a data set.

[0107] In the embodiment of the present application, the explanation of the top-k ranking query device can refer to the description in Example 1, and will not be further elaborated in this embodiment.

[0108] It can be seen that the top-k ranking query device described in this embodiment can, when receiving a top-k ranking query request, determine the corresponding multiple time periods according to the query request, then obtain the network security logs in each time period, and perform top-k ranking on these logs to obtain the top-k ranking results. It can be seen that the implementation of this embodiment can use a multi-level cache method to participate in the top-k ranking query under the limited resources of a single machine, thereby avoiding all data from participating in the query, thereby improving the query efficiency of the top-k ranking results.

[0109] Example 4

[0110] Please see Figure 4 , Figure 4 A schematic diagram of the structure of a top-k ranking query device provided in an embodiment of the present application. Figure 4 As shown, the top-k ranking query device includes:

[0111] The receiving unit 410 is used to obtain multiple network security logs sent simultaneously by multiple firewalls through Logstash;

[0112] A division unit 420, configured to divide the receiving time of the plurality of network security logs according to a preset time division level to obtain a plurality of receiving time intervals;

[0113] The generating unit 430 is used to generate multiple query data tables according to multiple receiving time intervals of multiple network security logs.

[0114] In the embodiment of the present application, the explanation of the top-k ranking query device can refer to the description in Example 2, and will not be further elaborated in this embodiment.

[0115] It can be seen that the top-k ranking query device described in this embodiment can store the received network security logs according to time periods, so that some network security logs can be distributedly stored according to time, which is convenient for calling and querying.

[0116] An embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the top-k ranking query method in embodiment 1 of the present application or the top-k ranking warehousing method in embodiment 2 of the present application.

[0117] An embodiment of the present application provides a computer-readable storage medium storing computer program instructions. When the computer program instructions are read and executed by a processor, the top-k ranking query method in embodiment 1 of the present application or the top-k ranking storage method in embodiment 2 of the present application is executed.

[0118] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0119] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0120] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0121] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0122] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0123] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A top-k ranking query method, characterized in that: include: When receiving a query request for top-k ranking, extracting a query time range included in the query request; Divide the query time range according to a preset time division level to obtain multiple query time intervals; the time division level includes a monthly level, a weekly level, a daily level, an hourly level and a sub-level; Acquire multiple query data tables corresponding to the multiple query time intervals one by one; Extract data according to the multiple query data tables to obtain a data set; Perform a top-k ranking on the data set to obtain a top-k ranking result.

2. The top-k ranking query method according to claim 1, characterized in that: Before the step of extracting the query time range included in the query request when receiving the query request of the top-k ranking, the method further includes: Detect top-k ranking query requests initiated by the Web through ApiServer.

3. The top-k ranking query method according to claim 1, characterized in that: The step of dividing the query time range according to the preset time division level to obtain multiple query time intervals includes: The query time range is divided into query month, query week, query day, query hour and query minute; the query month, query week, query day, query hour and query minute constitute a plurality of query time intervals.

4. The top-k ranking query method according to claim 1, characterized in that: The step of extracting data according to the multiple query data tables to obtain a data set includes: Extracting hot data from the multiple query data tables; Search for cold data within the query time range through Elasticsearch; The hot data and the cold data are combined to obtain a data set.

5. A top-k ranking storage method, characterized in that: include: Use Logstash to obtain multiple network security logs sent by multiple firewalls at the same time; Divide the receiving time of the plurality of network security logs according to a preset time division level to obtain a plurality of receiving time intervals; the time division level includes a monthly level, a weekly level, a daily level, an hourly level and a sub-level; The multiple network security logs are used to generate multiple query data tables according to the multiple receiving time intervals.

6. A top-k ranking query device, characterized in that: The query device comprises: an extraction unit, configured to extract, when receiving a query request for top-k ranking, a query time range included in the query request; A division unit, used to divide the query time range according to a preset time division level to obtain multiple query time intervals; the time division level includes a monthly level, a weekly level, a daily level, an hourly level and a sub-level; An acquisition unit, configured to acquire a plurality of query data tables corresponding one-to-one to the plurality of query time intervals; The extraction unit is further used to extract data according to the multiple query data tables to obtain a data set; The ranking unit is used to perform top-k ranking on the data set to obtain a top-k ranking result.

7. The top-k ranking query device according to claim 6, characterized in that: The division unit is specifically used to divide the query time range into query month, query week, query day, query hour and query minute; the query month, query week, query day, query hour and query minute constitute multiple query time intervals.

8. A top-k ranking storage device, characterized in that: The storage device comprises: The receiving unit is used to obtain multiple network security logs sent by multiple firewalls simultaneously through Logstash; A division unit, used to divide the receiving time of the plurality of network security logs according to a preset time division level to obtain a plurality of receiving time intervals; the time division level includes a monthly level, a weekly level, a daily level, an hourly level and a sub-level; The generating unit is used to generate a plurality of query data tables according to the plurality of receiving time intervals from the plurality of network security logs.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the top-k ranking query method according to any one of claims 1 to 4.

10. A readable storage medium, characterized in that: The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the top-k ranking query method according to any one of claims 1 to 4 is executed.

Images