Multi-factor data matching method and device

Abstract

An embodiment of the present application provides a multi-factor data matching method and device, which includes: parsing a network data packet, determining a hit matching factor based on a matching factor set, wherein the matching factor set is composed of matching factors included in all matching rules; determining a corresponding factor verification set based on the hit matching factor, performing data matching on the matching rules included in the factor verification set, and obtaining a data matching result of the network data packet, wherein the factor verification set is a subset of an factor attribution set, and the factor attribution set is composed of all matching rules to which the matching factor belongs; the present application can quickly achieve the purpose of matching target data, reduce system resource consumption, and improve data matching efficiency.

Description

Technical Field

[0001] The present application relates to the field of data processing, and specifically to a multi-factor data matching method and device. Background Art

[0002] The growing development of the internet has brought about an explosive growth in data volumes, posing challenges to network security. Content filtering for high-speed network data traffic is a key technology in the security field and is of great significance to network security.

[0003] Faced with intrusion detection and traffic control of Internet data, filtering rules are becoming increasingly complex. The rules contain multiple false keys, such as floating position keywords, fixed position keywords, data packet size, data packet protocol, etc. All false keys must be met to achieve a data packet hit.

[0004] Existing software-based technologies can run flexible software algorithms, such as the AC algorithm and the BM algorithm, on general-purpose processors to achieve multi-keyword matching. However, due to limitations in CPU computing power, storage space, and storage latency, achieving multi-Gbps processing power is challenging, making it difficult to meet the demands of high-speed, real-time processing. Summary of the Invention

[0005] In response to the problems in the prior art, the present application provides a multi-factor data matching method and device, which can quickly achieve the purpose of matching target data, reduce system resource consumption, and improve data matching efficiency.

[0006] In order to solve at least one of the above problems, the present application provides the following technical solutions:

[0007] In a first aspect, the present application provides a multi-factor data matching method, comprising:

[0008] Parsing the network data packet and determining a hit matching element according to a matching element set, wherein the matching element set is composed of matching elements included in all matching rules;

[0009] Determine the corresponding element verification set based on the hit matching element, perform data matching on the matching rules contained in the element verification set, and obtain the data matching result of the network data packet, wherein the element verification set is a subset of the element attribution set, and the element attribution set is composed of all matching rules to which the matching element belongs.

[0010] Furthermore, the parsing of the network data packet and determining the hit matching element according to the matching element set includes:

[0011] Split all preset matching rules to obtain different true key matching elements and false key matching elements;

[0012] A matching element set is constructed based on the true key matching elements and false key matching elements, and the hit true key matching elements and / or false key matching elements are determined based on the matching element set and the parsed network data packet.

[0013] Furthermore, the matching element set constructed according to the true key matching elements and the false key matching elements includes:

[0014] Create a matching feature set and assign it to empty;

[0015] Traversing a matching rule set and splitting each matching rule in the matching rule set into different matching elements, wherein the matching rule set is composed of all matching rules;

[0016] Determine the element type of each different matching element obtained after splitting;

[0017] If it is a true key matching element, determine whether the true key matching element is included in the matching element set. If so, add the matching rule corresponding to the true key matching element to the element belonging set of the true key matching element. Otherwise, generate the element belonging set of the true key matching element according to the matching rule corresponding to the true key matching element, and add the true key matching element to the matching element set to obtain an updated matching element set.

[0018] If it is a false key matching element, determine whether the matching element set contains the false key matching element and / or a true key matching element with the opposite content of the false key matching element. If not, generate the element attribution set of the false key matching element according to the matching rule corresponding to the false key matching element, and add the false key matching element to the matching element set to obtain an updated matching element set.

[0019] Furthermore, before determining the corresponding element verification set according to the hit matching element, the method further includes:

[0020] Create a fake key feature verification set and assign it an empty value;

[0021] The pseudo key matching element and the matching rules contained in the pseudo key element belonging set corresponding to the pseudo key matching element are added to the pseudo key element verification set to obtain an updated pseudo key element verification set.

[0022] Furthermore, before determining the corresponding element verification set according to the hit matching element, the method further includes:

[0023] Creating a true key element verification set and assigning values to the true key matching element and the matching rules contained in the true key element belonging set corresponding to the true key matching element;

[0024] Select the true key element verification set according to the set order, and set the retention count of the matching rules contained in the true key element belonging set of the true key element verification set to zero;

[0025] Retain the matching rule containing only one true key matching element in the true key element belonging set in the true key element verification set, and increase the retention count of the true key element verification set by one;

[0026] If a matching rule in the true key element belonging set does not exist in the true key element belonging set of other true key matching elements of the matching rule, then the matching rule is retained in the true key element verification set, and the retention count of the true key element verification set is increased by one;

[0027] When the retention count of the true key element verification set is still zero, retain one of the matching rules, increase the retention count of the true key element verification set by one, and delete the matching rule from the true key element verification sets of other true key matching elements of the matching rule;

[0028] When the retention count of the true key element verification set is greater than zero, all other matching rules are deleted to obtain an updated true key element verification set.

[0029] Furthermore, the selecting the true key element verification set in a set order includes:

[0030] If there is a matching rule in the true key element verification set that contains only one true key matching element, the priority of the true key element verification set is set to zero;

[0031] Determine the corresponding priority value based on the number of true key matching elements contained in the other true key element verification set;

[0032] The true key element verification set is selected according to the priority numerical order.

[0033] Further, after selecting the true key element verification set according to the priority numerical order, the method further includes:

[0034] Determining the arrangement order of each matching rule in the true key element verification set according to the total number of times each matching rule is referenced in all true key element verification sets;

[0035] Each matching rule in the true key element verification set is traversed in the arrangement order.

[0036] Furthermore, determining a corresponding element verification set according to the hit matching element, performing data matching on the matching rules contained in the element verification set, and obtaining a data matching result of the network data packet includes:

[0037] Constructing a hit element set according to the hit matching elements, and determining an element verification set corresponding to the hit matching elements;

[0038] The hit matching elements are traversed, and data matching is performed on the matching rules contained in the corresponding true key element verification set or false key element verification set, and the data matching pass result of the network data packet is obtained after all matching rules are matched.

[0039] In a second aspect, the present application provides a multi-factor data matching device, comprising:

[0040] An element matching module is used to parse the network data packet and determine the matching element that is matched based on the matching element set, wherein the matching element set is composed of the matching elements included in all matching rules;

[0041] A verification module is selected to determine a corresponding element verification set based on the hit matching element, perform data matching on the matching rules contained in the element verification set, and obtain a data matching result of the network data packet, wherein the element verification set is a subset of the element attribution set, and the element attribution set is composed of all matching rules to which the matching element belongs.

[0042] Furthermore, the element hitting module includes:

[0043] A matching rule splitting unit is used to split all preset matching rules to obtain different true key matching elements and false key matching elements;

[0044] The element set construction unit is used to construct a matching element set based on the true key matching elements and false key matching elements, and determine the hit true key matching elements and / or false key matching elements based on the matching element set and the parsed network data packet.

[0045] Furthermore, the element set construction unit includes:

[0046] The feature set creation subunit is used to create a matching feature set and assign it to be empty;

[0047] a rule splitting subunit, configured to traverse a matching rule set and split each matching rule in the matching rule set into different matching elements, wherein the matching rule set is composed of all matching rules;

[0048] The element type judgment subunit is used to judge the element type of each different matching element obtained after splitting;

[0049] a true key element set construction subunit, for determining, if it is a true key matching element, whether the matching element set contains the true key matching element; if so, adding the matching rule corresponding to the true key matching element to the element belonging set of the true key matching element; otherwise, generating the element belonging set of the true key matching element according to the matching rule corresponding to the true key matching element, and adding the true key matching element to the matching element set to obtain an updated matching element set;

[0050] The false key element set construction sub-unit is used to determine whether the matching element set contains the false key matching element and / or the true key matching element with the opposite content of the false key matching element, if it is a false key matching element; if not, the element attribution set of the false key matching element is generated according to the matching rule corresponding to the false key matching element, and the false key matching element is added to the matching element set to obtain an updated matching element set.

[0051] Furthermore, the selection verification module further includes:

[0052] A pseudo key element verification set creation unit is used to create a pseudo key element verification set and assign it an empty value;

[0053] The pseudo key element verification set determination unit is used to add the pseudo key matching element and the matching rules contained in the pseudo key element belonging set corresponding to the pseudo key matching element to the pseudo key element verification set to obtain an updated pseudo key element verification set.

[0054] Furthermore, the selection verification module further includes:

[0055] a true key element verification set creation unit, configured to create a true key element verification set and assign values to the true key matching element and the matching rules contained in the true key element belonging set corresponding to the true key matching element;

[0056] a retention count creation unit, configured to select the true key element verification set according to a set order, and set the retention count of the matching rule contained in the true key element belonging set of the true key element verification set to zero;

[0057] a first matching rule retaining unit, configured to retain the matching rule containing only one true key matching element in the true key element belonging set in the true key element verification set, and increase the retention count of the true key element verification set by one;

[0058] a second matching rule retaining unit, configured to retain a matching rule in the true key element verification set and increase a retention count of the true key element verification set by one if the matching rule in the true key element belonging set does not exist in the true key element belonging sets of other true key matching elements of the matching rule;

[0059] a third matching rule retaining unit, configured to retain one of the matching rules when the retention count of the true key element verification set is still zero, increase the retention count of the true key element verification set by one, and delete the matching rule from the true key element verification sets of other true key matching elements of the matching rule;

[0060] The matching rule deletion unit is used to delete all other matching rules when the retention count of the true key element verification set is greater than zero, so as to obtain an updated true key element verification set.

[0061] Furthermore, the retention count creation unit includes:

[0062] a priority creation subunit, configured to set the priority of the true key element verification set to zero if a matching rule containing only one true key matching element exists in the true key element verification set;

[0063] A priority determination subunit, configured to determine a corresponding priority value according to the number of true key matching elements contained in the other true key element verification sets;

[0064] The verification set order determination subunit is used to select the true key element verification set according to the priority numerical order.

[0065] Furthermore, the retention count creation unit further includes:

[0066] A matching rule sorting subunit, configured to determine an arrangement order of each matching rule in the true key element verification set according to the total number of times each matching rule is referenced in all true key element verification sets;

[0067] The matching rule sequential traversal subunit is used to traverse each matching rule in the true key element verification set according to the arrangement order.

[0068] Furthermore, the selection verification module includes:

[0069] A hit element set construction unit, configured to construct a hit element set according to the hit matching elements, and determine an element verification set corresponding to the hit matching elements;

[0070] The hit element traversal verification unit is used to traverse the hit matching elements and perform data matching on the matching rules contained in the corresponding true key element verification set or false key element verification set, and obtain the data matching pass result of the network data packet after all matching rules are matched.

[0071] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the multi-factor data matching method when executing the program.

[0072] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the multi-factor data matching method when executed by a processor.

[0073] In a fifth aspect, the present application provides a computer program product, comprising a computer program / instruction, which implements the steps of the multi-factor data matching method when executed by a processor.

[0074] It can be seen from the above technical solution that the present application provides a multi-factor data matching method and device. Through the set factor verification set, after the network data hits a certain matching factor, there is no need to traverse all matching rules, but to verify the specific matching rules in the factor verification set, so as to quickly and accurately complete the overall data matching operation of the network data, thereby quickly achieving the purpose of matching the target data, reducing system resource consumption, and improving data matching efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0076] Figure 1 This is one of the flow charts of the multi-factor data matching method in the embodiment of the present application;

[0077] Figure 2 This is the second flow chart of the multi-factor data matching method in the embodiment of the present application;

[0078] Figure 3 This is the third flow chart of the multi-factor data matching method in the embodiment of the present application;

[0079] Figure 4 This is a fourth flow chart of the multi-factor data matching method in an embodiment of the present application;

[0080] Figure 5 This is the fifth flow chart of the multi-factor data matching method in the embodiment of the present application;

[0081] Figure 6 This is the sixth flow chart of the multi-factor data matching method in the embodiment of the present application;

[0082] Figure 7 This is the seventh flow chart of the multi-factor data matching method in the embodiment of the present application;

[0083] Figure 8 This is the eighth flow chart of the multi-factor data matching method in the embodiment of the present application;

[0084] Figure 9 This is one of the structural diagrams of the multi-factor data matching device in the embodiment of the present application;

[0085] Figure 10 This is the second structural diagram of the multi-factor data matching device in the embodiment of the present application;

[0086] Figure 11 This is the third structural diagram of the multi-factor data matching device in the embodiment of the present application;

[0087] Figure 12 This is the fourth structural diagram of the multi-factor data matching device in the embodiment of the present application;

[0088] Figure 13 This is the fifth structural diagram of the multi-factor data matching device in the embodiment of the present application;

[0089] Figure 14 This is the sixth structural diagram of the multi-factor data matching device in the embodiment of the present application;

[0090] Figure 15 This is the seventh structural diagram of the multi-factor data matching device in the embodiment of the present application;

[0091] Figure 16 This is the eighth structural diagram of the multi-factor data matching device in the embodiment of the present application;

[0092] Figure 17 Schematic diagram of the structure of the electronic device in the embodiment of the present application. DETAILED DESCRIPTION

[0093] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0094] Taking into account the existing technology due to the constraints of CPU computing power, storage space size, storage delay and other aspects, it is not easy to achieve a processing capacity of several Gbps, and therefore it is difficult to meet the needs of high-speed real-time processing. The present application provides a multi-factor data matching method and device. Through the set factor verification set, after the network data hits a certain matching factor, there is no need to traverse all matching rules, but to verify the specific matching rules in the factor verification set, so as to quickly and accurately complete the overall data matching operation of the network data, thereby quickly achieving the purpose of matching the target data, reducing system resource consumption and improving data matching efficiency.

[0095] It is understandable that, for example, a rule is: R1:proto=tcp&dport=80&payload_len=128&keyword="abcd"&keyword="123"&keyword="xyz"offset=3&keyword!="456", then a data packet with a destination port of 80, a payload length of 128, and the payload containing the non-fixed position keyword (floating position) "abcd" and the non-fixed position keyword "123", and the content at the payload offset 3 is "xyz", and there is no "456" in the payload will hit this rule.

[0096] It is understandable that a rule set often includes tens of thousands of rules, so determining whether a data packet hits one or more rules requires a lot of computing work.

[0097] For the convenience of the following description, a rule consists of multiple elements. Elements whose verification is easier to calculate than their failure are called true keys, denoted by t; those whose verification is not true are called false keys, denoted by f. In the above example, the presence of "abcd" in the payload immediately confirms that this element is true, so abcd is a true key. However, to confirm that "456" or other numbers like "aaa" or "bbb" do not appear, we need to infer the absence of other keywords based on the set of keywords after processing all payloads. Therefore, keyword! = "456" is a false key.

[0098] It can be understood that the relationship between the elements is "logical and". When all the elements that constitute a rule are true, the rule is hit.

[0099] For example: R1 contains 7 elements:

[0100] Element 1 is used to determine whether the protocol is TCP, which is the true key.

[0101] Element 2 is used to determine if the destination port is 80, which is the true key.

[0102] Element 3 is used to determine that the payload length is 128, which is a true key.

[0103] Element 4 is used to determine whether the non-fixed position keyword "abcd" exists in the payload, which is a true key.

[0104] Element 5 is used to determine whether f_5 exists in the payload and is a non-fixed position keyword "123", which is a true key.

[0105] Element 6 is used to determine whether f_6 exists in the payload and the content of the position of payload offset 3 is "xyz", which is a true key.

[0106] Element 7 is used to determine if "456" exists in the c_1 payload. It is not found in the payload and is a false key.

[0107] When all the elements are met, rule R1 is hit.

[0108] It's understandable that a rule set contains multiple rules, each containing one or more true or false keys. Furthermore, a true or false key may be included in multiple rules. By parsing and processing a data packet, we can determine the true key hits. Once processing is complete, we obtain the set of true key hits. The challenge now is to determine which rules, based on this set, actually generated the hits.

[0109] In order to quickly achieve the purpose of matching target data, reduce system resource consumption, and improve data matching efficiency, this application provides an embodiment of a multi-factor data matching method, see Figure 1 , the multi-factor data matching method specifically includes the following contents:

[0110] Step S101: parsing a network data packet, and determining a hit matching element according to a matching element set, wherein the matching element set is composed of matching elements included in all matching rules.

[0111] Optionally, after receiving the network data packet, the present application may first parse the data packet and then determine the matching elements that are hit based on a matching element set.

[0112] Optionally, the matching element set is composed of matching elements included in all matching rules.

[0113] Specifically, the present application may first split all preset matching rules to obtain multiple matching elements, and then merge the matching elements to merge the same matching elements into one.

[0114] For example, there are 4 matching rules:

[0115] R1: proto=tcp&dport=80&payload_len=128&keyword=“abcd”&keyword=“123”&keyword=“xyz” offset=3&keyword! ="456".

[0116] R2:proto=udp&dport=80&keyword="abcd"&keyword="defg"&keyword! ="456".

[0117] R3:proto=tcp&dport=8080&keyword="123"&keyword="456"&keyword! = "xyz".

[0118] R4: keyword! = "defg".

[0119] After the four matching rule split elements are merged, they are listed in Table 1 below. That is, the true key matching element is established when the content is judged to be a hit, and the false key matching element is established when the content is judged to be a miss. The matching rules corresponding to each true key matching element and each false key matching element are listed in the last two columns of Table 1 below:

[0120] Table 1

[0121]

[0122] This forms the matching feature set K:

[0123] K={k1,k2,…,k i}

[0124] It can be seen that there is no identical matching element in the matching rule set K, k i Represents matching elements, t i Indicates the true key matching element, in the matching element k i It is established when it is logic 1; f j Indicates a false key matching element. In the matching element k i It is valid when it is logic 0.

[0125] Then, the matching rule is re-expressed by matching feature set K as follows:

[0126] R i ={t i1 ,t i2 …t ip ,f j1 ,f j2 …f jq}

[0127] That is, matching rule R i Matches element t by true key i1 ,t i2 …t ip and the false key matching element f j1 ,f j2 …f jq For details of the set, see Table 2 below:

[0128] Table 2

[0129] Matching rules content R1 {t1,t2,t3,t4,t5,t6,f10} R2 {t2,t4,t7,t8.f10} R3 {t1,t5,t9,t10,f11} R4 {f8}

[0130] For each true key matching feature t i , determine the matching rules of its attribution, that is, the "true key attribution" column in Table 1. This attribution relationship is called the true key element attribution set M i ={R i1 ,R i2 ,…,R ij}, satisfying t i ∈R i1 ,R i2 ,…,R ij For each false key matching element, determine the matching rule to which it belongs, that is, the "false key belonging" column in Table 1.

[0131] Therefore, after parsing a network data packet, the present application can determine through matching that it is a TCP packet with a dport of 8080 and a payload length of 256. Only "abcd", "123", and "456" are found in the payload. In this way, the present application can determine that it has hit the true key matching elements 1, 5, 9, and 10, that is, t1, t5, t9, and t10 are established. At the same time, since there is no "defg" and "xyz" in the data, the false key matching elements f11 and f8 are also established. Combining Table 1 and Table 2, the present application can determine that matching rules R3 and R4 have been hit.

[0132] Step S102: Determine the corresponding element verification set based on the hit matching element, perform data matching on the matching rules contained in the element verification set, and obtain the data matching result of the network data packet, wherein the element verification set is a subset of the element attribution set, and the element attribution set is composed of all matching rules to which the matching element belongs.

[0133] It is understandable that, in the prior art, based on the above content, all matching rules containing the matching element are checked based on an element (e.g., a meta-rule) and the matching element in the matching rules is marked as a hit. Only when all matching elements in a matching rule are marked as hits is the matching rule considered to have hit. This approach requires a large number of queries and comparisons, resulting in a high computational load. Moreover, if the matching element is a pseudo-key type, the prior art solution is difficult to handle.

[0134] Therefore, this application constructs a true key element verification set for each true key matching element. After confirming that a true key matching element hits, it checks its corresponding true key element verification set and traverses the matching rules contained in the true key element verification set to confirm its hit status. At the same time, after completion, this application can also traverse the false key element verification set to confirm the hit status of the matching rules therein, that is, complete the confirmation of the hit rules to improve computing efficiency.

[0135] Specifically, this application can define the true key element verification set as T i , each true key element verification set T i Corresponding to a true key matching element t i ; Define the pseudo-key element verification set as F, and use the data in the above table as an example to construct the verification set as shown in Table 3:

[0136] Table 3

[0137]

[0138] From this, we can conclude that since t1, t5, t9, and t10 hit, we query the corresponding verification set. Since the verification sets for k1, k5, and k10 are all empty, we only verify the verification set corresponding to k9, which contains R3. When we verify R3, we find that its elements t1, t5, t9, t10, and f11 all hold true. Therefore, R3 hits, and the output is generated.

[0139] Then, the pseudo-key element verification set is traversed again, and the content is R4. The matching element f8 of R4 is verified to be 0. If it is established, then R4 hits and an output is generated. In this way, the hit rule judgment of the entire network data packet is completed.

[0140] Optionally, the matching factor verification set T of this application i At least the following characteristics:

[0141] (1) Any matching element verification set T i All matching elements belong to the set M i That is, the true key element verification set of any true key matching element is a subset of its true key element belonging set.

[0142] (2) If the matching rule R i Contains more than one true key matching element, then the matching rule R i It only appears in the matching feature verification set corresponding to one of its true key matching features.

[0143] (3) When there is at least one matching rule with more than one true key matching element, there is at least one matching element verification set T i Is the matching element belonging set M i A proper subset of .

[0144] (4) The matching rules included in the false key element verification set F only contain false keys and do not contain real keys.

[0145] (5) All matching elements verification set T i The sum of the number of elements in V plus the number of elements in V equals the number of all matching rules in the set of matching rules.

[0146] From the above description, it can be seen that the multi-factor data matching method provided in the embodiment of the present application can quickly and accurately complete the overall data matching operation of the network data through the set factor verification set. After the network data hits a certain matching factor, there is no need to traverse all matching rules, but to verify the specific matching rules in the factor verification set. This can quickly achieve the purpose of matching the target data, reduce system resource consumption, and improve data matching efficiency.

[0147] In order to accurately determine the matching elements of the hit, in one embodiment of the multi-element data matching method of the present application, see Figure 2 , the above step S101 may further specifically include the following contents:

[0148] Step S201: Split all preset matching rules to obtain different true key matching elements and false key matching elements.

[0149] Step S202: construct a matching element set based on the true key matching elements and false key matching elements, and determine the hit true key matching elements and / or false key matching elements based on the matching element set and the parsed network data packet.

[0150] Optionally, the matching element set is composed of matching elements included in all matching rules.

[0151] Specifically, the present application may first split all preset matching rules to obtain multiple matching elements, and then merge these matching elements, merging the same matching elements into one, thereby obtaining different true key matching elements and false key matching elements.

[0152] This forms the matching feature set K:

[0153] K={k1,k2,…,k i}

[0154] It can be seen that there is no identical matching element in the matching rule set K, k i Represents matching elements, t i Indicates the true key matching element, in the matching element k i It is established when it is logic 1; f j Indicates a false key matching element. In the matching element k i It is valid when it is logic 0.

[0155] In order to accurately construct a matching element set, in one embodiment of the multi-element data matching method of the present application, see Figure 3 , the above step S202 may further specifically include the following contents:

[0156] Step S301: Create a matching feature set and assign it to empty.

[0157] Step S302: traverse the matching rule set, and split each matching rule in the matching rule set into different matching elements, wherein the matching rule set is composed of all matching rules.

[0158] Step S303: Determine the element type of each different matching element obtained after splitting.

[0159] Step S304: If it is a true key matching element, determine whether the true key matching element is included in the matching element set. If so, add the matching rule corresponding to the true key matching element to the element attribution set of the true key matching element. Otherwise, generate the element attribution set of the true key matching element according to the matching rule corresponding to the true key matching element, and add the true key matching element to the matching element set to obtain an updated matching element set.

[0160] Step S305: If it is a false key matching element, determine whether the matching element set contains the false key matching element and / or a true key matching element with the opposite content of the false key matching element. If not, generate the element affiliation set of the false key matching element according to the matching rule corresponding to the false key matching element, and add the false key matching element to the matching element set to obtain an updated matching element set.

[0161] Optionally, first create a matching feature set K and set it to an empty set, then traverse the matching rule set, decompose the matching rule Ri into various matching features, and then determine the feature type of each different matching feature obtained after the decomposition, confirm the characteristics of each matching feature kj, and determine whether it is a true key matching feature or a false key matching feature.

[0162] Optionally, if it is a true key matching element, it is further determined whether the matching element kj already exists in the matching element set K. If it does, the matching rule Ri corresponding to the true key matching element kj is added to the corresponding true key attribution set. Otherwise, the true key matching element kj is added to the matching element set K, and the corresponding true key element attribution set is created at the same time, with the initial value set to the matching rule Ri, and the number of the true key matching element kj in the matching element set K is obtained to obtain the updated matching element set K.

[0163] Optionally, if it is a false key matching element, determine whether the matching element set contains the false key matching element and / or a true key matching element with the opposite content of the false key matching element, for example, invert the content of the false key matching element kj, and confirm whether the false key matching element kj exists in the matching element set K. If not, add the false key matching element kj to the matching element set K, and create a corresponding false key element belonging set at the same time, and set the initial value to empty.

[0164] In order to accurately construct the pseudo key element verification set, in one embodiment of the multi-element data matching method of the present application, see Figure 4 Before the above step S102, the following contents may also be specifically included:

[0165] Step S401: Create a pseudo-key element verification set and assign it to empty.

[0166] Step S402: adding the pseudo key matching element and the matching rules contained in the pseudo key element belonging set corresponding to the pseudo key matching element to the pseudo key element verification set to obtain an updated pseudo key element verification set.

[0167] Optionally, the present application may first create a pseudo key element verification set and assign it to be empty, and then add the pseudo key matching element and the matching rules contained in the pseudo key element belonging set corresponding to the pseudo key matching element to the pseudo key element verification set to obtain the pseudo key element verification set.

[0168] In addition, if the matching rule does not contain true key matching elements but only contains false key matching elements, the matching rule Ri is added to the false key element verification set F.

[0169] In order to accurately construct the true key element verification set, in one embodiment of the multi-element data matching method of the present application, see Figure 5 Before the above step S102, the following contents may also be specifically included:

[0170] Step S501: Create a true key element verification set and assign values to the true key matching element and the matching rules contained in the true key element belonging set corresponding to the true key matching element.

[0171] Step S502: Select the true key element verification set according to the set order, and set the retention count of the true key element belonging set of the true key element verification set to zero.

[0172] Step S503: retain the matching rule containing only one true key matching element in the true key element belonging set in the true key element verification set, and increase the retention count of the true key element verification set by one.

[0173] Step S504: If a matching rule in the true key element belonging set does not exist in the true key element belonging set of other true key matching elements of the matching rule, then the matching rule is retained in the true key element verification set, and the retention count of the true key element verification set is increased by one.

[0174] Step S505: When the retention count of the true key element verification set is still zero, retain one of the matching rules, and increase the retention count of the true key element verification set by one, and at the same time delete the matching rule from the true key element verification sets of other true key matching elements of the matching rule.

[0175] Optionally, the present application can also calculate the total number of times each matching rule R(i) is referenced in all true key element verification sets, so as to determine the arrangement order of each matching rule in the true key element verification set, and the matching rule to be retained when the retention count of the true key element verification set is still zero (for example, the matching rule with the smallest total number of references).

[0176] Step S506: When the retention count of the true key element verification set is greater than zero, all other matching rules are deleted to obtain an updated true key element verification set.

[0177] Optionally, for all true key matching elements in the matching element set K, the present application may first construct its true key element verification set T i , the initial value can be set to the true key element belonging set M i Then, select a true key matching element k according to the setting method i The true key element verification set T i , set the true key element verification set T i The initial retention count value of the matching rules contained in is 0.

[0178] Then, the application can first select the true key element verification set T i There is only one true key matching element in the matching rule R j , and retain the matching rule R j , and the matching rule R j The retention count increases by 1, completing all matching rules R that meet the conditions j .

[0179] Then, this application can select the true key element verification set T i Other matching rules in R k , if other matching rules R k In which except the current true key matching element t i If all other true key matching elements of the verification element set do not exist, then in the true key element verification set T i Keep the matching rule R k , and its retain count is increased by 1.

[0180] Then, if the true key element belongs to the set M i The retention count in is equal to 0, then this application can verify the set T of true key elements i Keep the matching rule R k , and its retention count increases by 1, while at the same time deleting the matching rule R k Except the current true key matching element t i All other true key matching elements correspond to the R in the element verification set k , and at the corresponding T i Delete the R k , thus obtaining the updated true key element verification set.

[0181] In order to select the true key element verification set in sequence, in one embodiment of the multi-element data matching method of the present application, see Figure 6 , the above step S502 may further specifically include the following contents:

[0182] Step S601: If there is a matching rule in the true key element verification set that contains only one true key matching element, the priority of the true key element verification set is set to zero.

[0183] Step S602: Determine the corresponding priority value according to the number of true key matching elements included in the other true key element verification set.

[0184] Step S603: Select the true key element verification set according to the priority numerical order.

[0185] In some feasible embodiments of the present application, the present application can also calculate the number of elements in each true key element verification set M(i). If there is a matching rule in M(i) that only includes one true key element, the priority of this true key element verification set M(i) can be directly recorded as 0, otherwise the priority is set to the number of true key matching elements contained in this true key element verification set M(i); in addition, the priority of the empty set is 0, and the priority is counted as priority(i).

[0186] Optionally, the present application may sort all true key element verification sets from small to large priority, and select the verification element sets in sequence when processing.

[0187] In order to be able to traverse the matching rules in sequence, in one embodiment of the multi-factor data matching method of the present application, see Figure 7 After the above step S603, the following contents may be included:

[0188] Step S701: determining the arrangement order of each matching rule in the true key element verification set according to the total number of times each matching rule is referenced in all true key element verification sets.

[0189] Step S702: traverse each matching rule in the true key element verification set according to the arrangement order.

[0190] Optionally, the present application may also calculate the total number of times each matching rule R(i) is referenced in all true key element verification sets, thereby determining the order of arrangement of each matching rule in the true key element verification set.

[0191] In order to accurately perform data matching, in one embodiment of the multi-factor data matching method of the present application, see Figure 8 , the above step S102 may further specifically include the following contents:

[0192] Step S801: constructing a hit element set according to the hit matching elements, and determining an element verification set corresponding to the hit matching elements.

[0193] Step S802: traverse the hit matching elements, and perform data matching on the matching rules contained in the corresponding true key element verification set or false key element verification set, and obtain the data matching pass result of the network data packet after all matching rules are matched.

[0194] Optionally, the present application may allocate a hit status register to each matching element, and the hit status register may express whether the corresponding matching element generates a hit.

[0195] Specifically, when a hit element set is obtained, the application can set the hit status corresponding to the true key matching element in the hit element set to 1, and set the hit status of other true key matching elements outside the hit element set to 0. Then run the following algorithm to generate all hits:

[0196] 1. Traverse the set of hit true key hit elements, obtain the true key matching element fi, and obtain the corresponding verification element set Ti.

[0197] 2. Traverse the matching rule Rj in the verification element set Ti. If all matching elements of the matching rule Rj are true, the matching rule Rj is hit, output the hit result and traverse the false key element verification set.

[0198] Specifically, obtain the matching rule Ri, traverse all the false key matching elements of the matching rule Rj, if all are true, the matching rule Rj is hit, and the hit result is output.

[0199] In other embodiments of the present application, it can be understood that in order to achieve matching, before each match, the matching status corresponding to all true keys needs to be cleared to zero, and then after the parsing of the network data packet is completed, the matching status is set to 1 according to the true key hit. In actual situations, there are many true keys, but the number of true keys hit each time is small, and the overhead of clearing to zero is large at this time.

[0200] Therefore, in order to improve performance, this application chooses to write the current packet count into the hit status register when the true key hits. In this way, when verifying whether the true key hits, it directly determines whether the content is equal to the current packet count. If they are equal, it means that the true key hits, otherwise it does not hit.

[0201] In other embodiments of the present application, it is understandable that as network rules become more complex, the following rules with various fields and calculations appear:

[0202] R1:tcp.dport=80&HTTP.url=linux&HTTP.User-Agent=Mozilla&HTTP.cookie[0]+HTTP.cookie[1]==100.

[0203] Optionally, in order to accurately process the network data of the above load, this application can pre-process the rules and decompose them into two parts: pre-rules and verification rules:

[0204] R1:{tcp.dport=80&HTTP.url=linux&HTTP.User-Agent=Mozilla&HTTP.cookie}{HTTP.cookie[0]+HTTP.cookie[1]=0xff}.

[0205] The first bracket contains the prefix rule, which indicates that it is necessary to determine whether the TCP destination port is 80, the URL field of the HTTP protocol contains "linux", the User-Agent of the HTTP protocol contains "Mozilla", and whether HTTP.cookie appears.

[0206] The second bracket indicates that after the preceding rule is matched, further verification is required to see whether the sum of the 0th and 1st bytes of HTTP.cookie is 0xff.

[0207] For the matching of the content of the first bracket, the method provided above in this application can be used to accelerate it, thereby meeting the requirements of complex rule matching.

[0208] In order to quickly achieve the purpose of matching target data, reduce system resource consumption, and improve data matching efficiency, the present application provides an embodiment of a multi-factor data matching device for implementing all or part of the multi-factor data matching method, see Figure 9 The multi-factor data matching device specifically includes the following contents:

[0209] The element matching module 10 is used to parse the network data packet and determine the matching element that is matched based on the matching element set, wherein the matching element set is composed of the matching elements included in all matching rules.

[0210] A verification module 20 is selected to determine a corresponding element verification set based on the hit matching element, perform data matching on the matching rules contained in the element verification set, and obtain a data matching result of the network data packet, wherein the element verification set is a subset of the element attribution set, and the element attribution set is composed of all matching rules to which the matching element belongs.

[0211] From the above description, it can be seen that the multi-factor data matching device provided in the embodiment of the present application can quickly and accurately complete the overall data matching operation of the network data through the set factor verification set. After the network data hits a certain matching factor, there is no need to traverse all matching rules, but to verify the specific matching rules in the factor verification set. This can quickly achieve the purpose of matching the target data, reduce system resource consumption, and improve data matching efficiency.

[0212] In order to accurately determine the matching elements of the hit, in one embodiment of the multi-element data matching device of the present application, see Figure 10 , the element hitting module 10 includes:

[0213] The matching rule splitting unit 11 is used to split all preset matching rules to obtain different true key matching elements and false key matching elements.

[0214] The element set construction unit 12 is used to construct a matching element set based on the true key matching elements and false key matching elements, and determine the hit true key matching elements and / or false key matching elements based on the matching element set and the parsed network data packet.

[0215] In order to accurately construct a matching element set, in one embodiment of the multi-element data matching device of the present application, see Figure 11 , the element set construction unit 12 includes:

[0216] The feature set creation subunit 121 is used to create a matching feature set and assign it to be empty.

[0217] The rule splitting subunit 122 is configured to traverse the matching rule set and split each matching rule in the matching rule set into different matching elements, wherein the matching rule set is composed of all matching rules.

[0218] The element type determination subunit 123 is used to determine the element type of each different matching element obtained after splitting.

[0219] The true key element set construction sub-unit 124 is used to determine whether the true key matching element is included in the matching element set if it is a true key matching element. If so, the matching rule corresponding to the true key matching element is added to the element attribution set of the true key matching element. Otherwise, the element attribution set of the true key matching element is generated according to the matching rule corresponding to the true key matching element, and the true key matching element is added to the matching element set to obtain an updated matching element set.

[0220] The false key element set construction sub-unit 125 is used to determine whether the matching element set contains the false key matching element and / or the true key matching element with the opposite content of the false key matching element, if it is a false key matching element. If not, the element attribution set of the false key matching element is generated according to the matching rule corresponding to the false key matching element, and the false key matching element is added to the matching element set to obtain an updated matching element set.

[0221] In order to accurately construct the false key element verification set, in one embodiment of the multi-element data matching device of the present application, see Figure 12 , the selection verification module 20 further includes:

[0222] The pseudo key element verification set creation unit 21 is used to create a pseudo key element verification set and assign it to be empty.

[0223] The pseudo key element verification set determination unit 22 is used to add the pseudo key matching element and the matching rules contained in the pseudo key element belonging set corresponding to the pseudo key matching element to the pseudo key element verification set to obtain an updated pseudo key element verification set.

[0224] In order to accurately construct the true key element verification set, in one embodiment of the multi-element data matching device of the present application, see Figure 13 , the selection verification module 20 further includes:

[0225] The true key element verification set creation unit 23 is used to create a true key element verification set and assign values to the true key matching element and the matching rules contained in the true key element belonging set corresponding to the true key matching element.

[0226] The retention count creation unit 24 is configured to select the true key element verification set according to a set order, and set the retention count of the matching rule contained in the true key element belonging set of the true key element verification set to zero.

[0227] The first matching rule retaining unit 25 is configured to retain the matching rule containing only one true key matching element in the true key element belonging set in the true key element verification set, and increase the retention count of the true key element verification set by one.

[0228] The second matching rule retention unit 26 is used to retain a matching rule in the true key element attribution set if it does not exist in the true key element attribution set of other true key matching elements of the matching rule, and increase the retention count of the true key element verification set by one.

[0229] The third matching rule retention unit 27 is used to retain one of the matching rules when the retention count of the true key element verification set is still zero, and increase the retention count of the true key element verification set by one, and at the same time delete the matching rule from the true key element verification sets of other true key matching elements of the matching rule.

[0230] The matching rule deleting unit 28 is configured to delete all other matching rules when the retention count of the true key element verification set is greater than zero, so as to obtain an updated true key element verification set.

[0231] In order to select the true key element verification set in sequence, in one embodiment of the multi-element data matching device of the present application, see Figure 14 , the retention count creation unit 24 includes:

[0232] The priority creation subunit 241 is configured to set the priority of the true key element verification set to zero if there is a matching rule in the true key element verification set that contains only one true key matching element.

[0233] The priority determination subunit 242 is used to determine the corresponding priority value according to the number of true key matching elements included in the other true key element verification sets.

[0234] The verification set order determination subunit 243 is used to select the true key element verification set according to the priority numerical order.

[0235] In order to be able to traverse the matching rules in sequence, in one embodiment of the multi-factor data matching device of the present application, see Figure 15 , the retention count creation unit 24 further includes:

[0236] The matching rule sorting subunit 244 is used to determine the arrangement order of each matching rule in the true key element verification set according to the total number of times each matching rule is referenced in all true key element verification sets.

[0237] The matching rule sequential traversal subunit 245 is configured to traverse each matching rule in the true key element verification set according to the arrangement order.

[0238] In order to accurately perform data matching, in one embodiment of the multi-factor data matching device of the present application, see Figure 16 , the selection verification module 20 further includes:

[0239] The hit element set construction unit 291 is used to construct a hit element set according to the hit matching elements, and determine an element verification set corresponding to the hit matching elements.

[0240] The hit element traversal verification unit 292 is used to traverse the hit matching elements and perform data matching on the matching rules contained in the corresponding true key element verification set or false key element verification set, and obtain the data matching pass result of the network data packet after all matching rules are matched.

[0241] To further illustrate this solution, the present application also provides a specific application example of implementing the multi-factor data matching method using the multi-factor data matching device, which specifically includes the following content:

[0242] Assume that after the network data packet is parsed, the locally preset matching rules include R1 to R7. The corresponding relationship between each matching rule (R1 to R7) and each matching element (true keys are represented by letters such as a and b, and false keys are represented by "!" before the letters) and the expression characters of true keys and false keys in the matching element set is shown in Table 4 below:

[0243] Table 4

[0244]

[0245] Optionally, the matching elements of each matching rule are decomposed and merged, and a true key element belonging set M(i) and a false key element verification set F corresponding to each matching element k(i) are constructed, as shown in Table 5, resulting in a matching element set K, including k1, k2, ..., k8. The true key element belonging set Mi corresponding to each matching element is obtained. The matching rule is re-expressed using the true key and false key of the matching rule element set K to construct a verification set, as shown in Table 5 below:

[0246] Table 5

[0247]

[0248]

[0249] Assuming the hit key is acdefg, the results are shown in Table 6, which shows that rules R3 and R6 are hit. Verifying the content of F, R7 is hit, so the results are R3, R6, and R7.

[0250] Table 6

[0251]

[0252] From the above description, it can be seen that when the above 6 true keys are hit, this solution only needs to verify 4+1 matching rules to obtain the matching verification result of the entire network data packet, with fast calculation speed and high efficiency.

[0253] From a hardware perspective, in order to quickly achieve the goal of matching target data, reduce system resource consumption, and improve data matching efficiency, the present application provides an embodiment of an electronic device for implementing all or part of the content of the multi-factor data matching method. The electronic device specifically includes the following content:

[0254] A processor, a memory, a communications interface, and a bus; wherein the processor, the memory, and the communications interface communicate with each other via the bus; the communications interface is used to transmit information between the multi-factor data matching device and related devices such as the core business system, the user terminal, and related databases; the logic controller can be a desktop computer, a tablet computer, a mobile terminal, etc., but this embodiment is not limited thereto. In this embodiment, the logic controller can be implemented with reference to the embodiments of the multi-factor data matching method and the embodiments of the multi-factor data matching device in the embodiments, the contents of which are incorporated herein and repeated parts are not repeated.

[0255] It is understandable that the user terminal may include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, etc. Among them, the smart wearable device may include smart glasses, a smart watch, a smart bracelet, etc.

[0256] In practical applications, portions of the multi-factor data matching method may be executed on the electronic device side as described above, or all operations may be performed on the client device. The specific selection may be based on the processing capabilities of the client device and the limitations of the user's usage scenario. This application does not impose any restrictions on this. If all operations are performed on the client device, the client device may further include a processor.

[0257] The client device may include a communication module (i.e., a communication unit) that can establish a communication connection with a remote server to implement data transmission with the server. The server may include a server on the task scheduling center side, and in other implementation scenarios, may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0258] Figure 17 Schematic block diagram of the system structure of the electronic device 9600 according to an embodiment of the present application. Figure 17 As shown, the electronic device 9600 may include a central processing unit 9100 and a memory 9140; the memory 9140 is coupled to the central processing unit 9100. It is worth noting that the Figure 17 is exemplary; other types of structures may also be used to supplement or replace this structure to implement telecommunication functions or other functions.

[0259] In one embodiment, the multi-factor data matching method function may be integrated into the central processing unit 9100. The central processing unit 9100 may be configured to perform the following control:

[0260] Step S101: parsing a network data packet, and determining a hit matching element according to a matching element set, wherein the matching element set is composed of matching elements included in all matching rules.

[0261] Step S102: Determine the corresponding element verification set based on the hit matching element, perform data matching on the matching rules contained in the element verification set, and obtain the data matching result of the network data packet, wherein the element verification set is a subset of the element attribution set, and the element attribution set is composed of all matching rules to which the matching element belongs.

[0262] From the above description, it can be seen that the electronic device provided in the embodiment of the present application, through the set factor verification set, does not need to traverse all matching rules after the network data hits a matching factor, but verifies the specific matching rule in the factor verification set, thereby quickly and accurately completing the overall data matching operation of the network data, thereby quickly achieving the purpose of matching the target data, reducing system resource consumption, and improving data matching efficiency.

[0263] In another embodiment, the multi-factor data matching device can be configured separately from the central processing unit 9100. For example, the multi-factor data matching device can be configured as a chip connected to the central processing unit 9100, and the multi-factor data matching method function can be implemented under the control of the central processing unit.

[0264] like Figure 17 As shown, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily have to include Figure 17 In addition, the electronic device 9600 may also include all components shown in Figure 17 For components not shown, reference may be made to the prior art.

[0265] like Figure 17 As shown, the central processing unit 9100 is sometimes also referred to as a controller or operation control, and may include a microprocessor or other processor device and / or logic device. The central processing unit 9100 receives input and controls the operation of various components of the electronic device 9600.

[0266] Memory 9140 can be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It can store the aforementioned failure-related information and also store programs that execute the relevant information. The CPU 9100 can execute the programs stored in memory 9140 to implement information storage or processing.

[0267] The input unit 9120 provides input to the central processing unit 9100. The input unit 9120 may be, for example, a keypad or touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used to display objects such as images and text. The display may be, for example, an LCD display, but is not limited thereto.

[0268] The memory 9140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), or a SIM card. Alternatively, it may be a memory that retains information even when power is off, can be selectively erased, and is provided with more data. Examples of such memory are sometimes referred to as EPROMs. The memory 9140 may also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142 for storing application programs and function programs or processes for executing the operation of the electronic device 9600 by the central processing unit 9100.

[0269] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various driver programs for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0270] The communication module 9110 is a transmitter / receiver 9110 that transmits and receives signals via an antenna 9111. The communication module (transmitter / receiver) 9110 is coupled to the central processor 9100 to provide input signals and receive output signals, which may be the same as in a conventional mobile communication terminal.

[0271] Based on different communication technologies, multiple communication modules 9110 can be provided in the same electronic device, such as a cellular network module, a Bluetooth module, and / or a wireless local area network module. The communication module (transmitter / receiver) 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby implementing common telecommunication functions. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. Furthermore, the audio processor 9130 is also coupled to the central processing unit 9100, enabling local recording via the microphone 9132 and playback of stored audio via the speaker 9131.

[0272] Embodiments of the present application also provide a computer-readable storage medium capable of implementing all steps of the multi-factor data matching method in the above-mentioned embodiment, where the execution subject is a server or a client. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the computer program implements all steps of the multi-factor data matching method in the above-mentioned embodiment, where the execution subject is a server or a client. For example, when the processor executes the computer program, the following steps are implemented:

[0273] Step S101: parsing a network data packet, and determining a hit matching element according to a matching element set, wherein the matching element set is composed of matching elements included in all matching rules.

[0274] Step S102: Determine the corresponding element verification set based on the hit matching element, perform data matching on the matching rules contained in the element verification set, and obtain the data matching result of the network data packet, wherein the element verification set is a subset of the element attribution set, and the element attribution set is composed of all matching rules to which the matching element belongs.

[0275] From the above description, it can be seen that the computer-readable storage medium provided in the embodiment of the present application, through the set element verification set, does not need to traverse all matching rules after the network data hits a matching element, but verifies the specific matching rule in the element verification set, thereby quickly and accurately completing the overall data matching operation of the network data, thereby quickly achieving the purpose of matching the target data, reducing system resource consumption, and improving data matching efficiency.

[0276] The embodiments of the present application also provide a computer program product capable of implementing all steps of the multi-factor data matching method in the above-mentioned embodiment, where the execution subject is a server or a client. When the computer program / instructions are executed by a processor, the steps of the multi-factor data matching method are implemented. For example, the computer program / instructions implement the following steps:

[0277] Step S101: parsing a network data packet, and determining a hit matching element according to a matching element set, wherein the matching element set is composed of matching elements included in all matching rules.

[0278] Step S102: Determine the corresponding element verification set based on the hit matching element, perform data matching on the matching rules contained in the element verification set, and obtain the data matching result of the network data packet, wherein the element verification set is a subset of the element attribution set, and the element attribution set is composed of all matching rules to which the matching element belongs.

[0279] From the above description, it can be seen that the computer program product provided in the embodiment of the present application, through the set element verification set, does not need to traverse all matching rules after the network data hits a matching element, but verifies the specific matching rule in the element verification set, thereby quickly and accurately completing the overall data matching operation of the network data, thereby quickly achieving the purpose of matching the target data, reducing system resource consumption, and improving data matching efficiency.

[0280] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0281] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (apparatus), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0282] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0283] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0284] Specific embodiments are used in the present invention to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A multi-factor data matching method, characterized in that: The method comprises: Parsing the network data packet and determining a hit matching element according to a matching element set, wherein the matching element set is composed of matching elements included in all matching rules; Determining a corresponding element verification set based on the hit matching element, performing data matching on the matching rules contained in the element verification set to obtain a data matching result of the network data packet, wherein the element verification set is a subset of an element belonging set, and the element belonging set is composed of all matching rules to which the matching element belongs; The parsing of the network data packet and determining the hit matching element according to the matching element set includes: All preset matching rules are split to obtain different true key matching elements and false key matching elements, wherein the true key matching element is established when the content is judged to be a hit, and the false key matching element is established when the content is judged to be a miss; A matching element set is constructed based on the true key matching elements and false key matching elements, and the hit true key matching elements and / or false key matching elements are determined based on the matching element set and the parsed network data packet.

2. The multi-factor data matching method according to claim 1, characterized in that: The matching element set constructed according to the true key matching elements and the false key matching elements includes: Create a matching feature set and assign it to empty; Traversing a matching rule set and splitting each matching rule in the matching rule set into different matching elements, wherein the matching rule set is composed of all matching rules; Determine the element type of each different matching element obtained after splitting; If it is a true key matching element, determine whether the true key matching element is included in the matching element set. If so, add the matching rule corresponding to the true key matching element to the element belonging set of the true key matching element. Otherwise, generate the element belonging set of the true key matching element according to the matching rule corresponding to the true key matching element, and add the true key matching element to the matching element set to obtain an updated matching element set. If it is a false key matching element, determine whether the matching element set contains the false key matching element and / or a true key matching element with the opposite content of the false key matching element. If not, generate the element attribution set of the false key matching element according to the matching rule corresponding to the false key matching element, and add the false key matching element to the matching element set to obtain an updated matching element set.

3. The multi-factor data matching method according to claim 2, characterized in that: Before determining the corresponding element verification set according to the hit matching element, the method includes: Create a fake key feature verification set and assign it an empty value; The pseudo key matching element and the matching rules contained in the pseudo key element belonging set corresponding to the pseudo key matching element are added to the pseudo key element verification set to obtain an updated pseudo key element verification set.

4. The multi-factor data matching method according to claim 3, characterized in that: Before determining the corresponding element verification set according to the hit matching element, the method includes: Creating a true key element verification set and assigning values to the true key matching element and the matching rules contained in the true key element belonging set corresponding to the true key matching element; Select the true key element verification set according to the set order, and set the retention count of the true key element verification set to zero; Retain the matching rule containing only one true key matching element in the true key element belonging set in the true key element verification set, and increase the retention count of the true key element verification set by one; If a matching rule in the true key element belonging set does not exist in the true key element belonging set of other true key matching elements of the matching rule, then the matching rule is retained in the true key element verification set, and the retention count of the true key element verification set is increased by one; When the retention count of the true key element verification set is still zero, retain one of the matching rules, increase the retention count of the true key element verification set by one, and delete the matching rule from the true key element verification sets of other true key matching elements of the matching rule; When the retention count of the true key element verification set is greater than zero, all other matching rules are deleted to obtain an updated true key element verification set.

5. The multi-factor data matching method according to claim 4, characterized in that: The step of selecting the true key element verification set in a set order includes: If there is a matching rule in the true key element verification set that contains only one true key matching element, the priority of the true key element verification set is set to zero; Determine the corresponding priority value based on the number of true key matching elements contained in the other true key element verification set; The true key element verification set is selected according to the priority numerical order.

6. The multi-factor data matching method according to claim 5, characterized in that: After selecting the true key element verification set according to the priority numerical order, the method further includes: Determining the arrangement order of each matching rule in the true key element verification set according to the total number of times each matching rule is referenced in all true key element verification sets; Each matching rule in the true key element verification set is traversed in the arrangement order.

7. The multi-factor data matching method according to claim 4, characterized in that: The determining a corresponding element verification set according to the hit matching element, performing data matching on the matching rules included in the element verification set, and obtaining a data matching result of the network data packet includes: Constructing a hit element set according to the hit matching elements, and determining an element verification set corresponding to the hit matching elements; The hit matching elements are traversed, and data matching is performed on the matching rules contained in the corresponding true key element verification set or false key element verification set, and the data matching pass result of the network data packet is obtained after all matching rules are matched.

8. A multi-factor data matching device, characterized in that: include: An element matching module is used to parse the network data packet and determine the matching element that is matched based on the matching element set, wherein the matching element set is composed of the matching elements included in all matching rules; A selection verification module is configured to determine a corresponding element verification set based on the hit matching element, perform data matching on the matching rules contained in the element verification set, and obtain a data matching result of the network data packet, wherein the element verification set is a subset of the element belonging set, and the element belonging set is composed of all matching rules to which the matching element belongs; The element hitting module includes: A matching rule splitting unit is used to split all preset matching rules to obtain different true key matching elements and false key matching elements, wherein the true key matching element is established when the content is judged to be a hit, and the false key matching element is established when the content is judged to be a miss; The element set construction unit is used to construct a matching element set based on the true key matching elements and false key matching elements, and determine the hit true key matching elements and / or false key matching elements based on the matching element set and the parsed network data packet.

9. The multi-factor data matching device according to claim 8, characterized in that: The element set construction unit includes: The feature set creation subunit is used to create a matching feature set and assign it to be empty; a rule splitting subunit, configured to traverse a matching rule set and split each matching rule in the matching rule set into different matching elements, wherein the matching rule set is composed of all matching rules; The element type judgment subunit is used to judge the element type of each different matching element obtained after splitting; a true key element set construction subunit, for determining, if it is a true key matching element, whether the matching element set contains the true key matching element; if so, adding the matching rule corresponding to the true key matching element to the element belonging set of the true key matching element; otherwise, generating the element belonging set of the true key matching element according to the matching rule corresponding to the true key matching element, and adding the true key matching element to the matching element set to obtain an updated matching element set; The false key element set construction sub-unit is used to determine whether the matching element set contains the false key matching element and / or the true key matching element with the opposite content of the false key matching element, if it is a false key matching element; if not, the element attribution set of the false key matching element is generated according to the matching rule corresponding to the false key matching element, and the false key matching element is added to the matching element set to obtain an updated matching element set.

10. The multi-factor data matching device according to claim 9, characterized in that: The selection verification module also includes: A pseudo key element verification set creation unit is used to create a pseudo key element verification set and assign it an empty value; The pseudo key element verification set determination unit is used to add the pseudo key matching element and the matching rules contained in the pseudo key element belonging set corresponding to the pseudo key matching element to the pseudo key element verification set to obtain an updated pseudo key element verification set.

11. The multi-factor data matching device according to claim 10, characterized in that: The selection verification module also includes: a true key element verification set creation unit, configured to create a true key element verification set and assign values to the true key matching element and the matching rules contained in the true key element belonging set corresponding to the true key matching element; a retention count creation unit, configured to select the true key element verification set according to a set order, and set the retention count of the matching rule contained in the true key element belonging set of the true key element verification set to zero; a first matching rule retaining unit, configured to retain the matching rule containing only one true key matching element in the true key element belonging set in the true key element verification set, and increase the retention count of the true key element verification set by one; a second matching rule retaining unit, configured to retain a matching rule in the true key element verification set and increase a retention count of the true key element verification set by one if the matching rule in the true key element belonging set does not exist in the true key element belonging sets of other true key matching elements of the matching rule; a third matching rule retaining unit, configured to retain one of the matching rules when the retention count of the true key element verification set is still zero, increase the retention count of the true key element verification set by one, and delete the matching rule from the true key element verification sets of other true key matching elements of the matching rule; The matching rule deletion unit is used to delete all other matching rules when the retention count of the true key element verification set is greater than zero, so as to obtain an updated true key element verification set.

12. The multi-factor data matching device according to claim 11, characterized in that: The retention count creation unit includes: a priority creation subunit, configured to set the priority of the true key element verification set to zero if a matching rule containing only one true key matching element exists in the true key element verification set; A priority determination subunit, configured to determine a corresponding priority value according to the number of true key matching elements contained in the other true key element verification sets; The verification set order determination subunit is used to select the true key element verification set according to the priority numerical order.

13. The multi-factor data matching device according to claim 12, characterized in that: The retention count creation unit further includes: A matching rule sorting subunit, configured to determine an arrangement order of each matching rule in the true key element verification set according to the total number of times each matching rule is referenced in all true key element verification sets; The matching rule sequential traversal subunit is used to traverse each matching rule in the true key element verification set according to the arrangement order.

14. The multi-factor data matching device according to claim 11, characterized in that: The selection verification module also includes: A hit element set construction unit, configured to construct a hit element set according to the hit matching elements, and determine an element verification set corresponding to the hit matching elements; The hit element traversal verification unit is used to traverse the hit matching elements and perform data matching on the matching rules contained in the corresponding true key element verification set or false key element verification set, and obtain the data matching pass result of the network data packet after all matching rules are matched.

15. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the multi-factor data matching method according to any one of claims 1 to 7 are implemented.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the multi-factor data matching method according to any one of claims 1 to 7 are implemented.

17. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the multi-factor data matching method according to any one of claims 1 to 7 are implemented.

Images