IP information query method and device

Abstract

The embodiment of the present invention provides an IP information query method and device, the method comprising determining the corresponding IP address from the detected IP information query request, performing bit segmentation processing on the IP address according to the set mask bit, determining the first IP string, determining whether the first IP string exists in the first cascade IP record, and if so, when it is determined that the IP information associated with the first IP string does not exist in the first cascade IP record, matching the IP address with each IP address in the second cascade IP record, thereby determining the IP information corresponding to the IP address. In this way, the scheme can effectively save the time consumed by performing conversion operations on the IP address by segmenting the IP address according to the mask bit, and only performs the second-level query on the IP address for which the IP information is not stored in the first cascade IP record, thereby effectively improving the query efficiency of the IP information.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of network and information security, and in particular to an IP information query method and device. Background Art

[0002] With the development of computer technology, IP address query is needed in some big data processing. Generally, in order to query the relevant information corresponding to an IP, it is usually necessary to query according to an IP database.

[0003] At present, there are usually two IP information query methods, that is, the first IP information query method is: each IP address is stored in a database (such as Redis or mysql, etc.) in advance in the form of an address segment, and the starting IP and the ending IP of each IP address segment in the database need to be converted into long integers for storage in advance, so as to facilitate subsequent matching queries for IP addresses. When it is necessary to query the relevant information corresponding to a certain IP address, the IP address needs to be converted into a long integer, and then the converted IP address is matched with each converted IP address segment to query the relevant information corresponding to the IP address to be queried. However, this IP address query method needs to match the query after the IP address is converted, so it takes a long time, resulting in low query efficiency of IP information. The second IP information query method is: each IP address is directly stored in a database (such as Redis or mysql, etc.) in advance, and when it is necessary to query the relevant information corresponding to a certain IP address, the IP address is directly compared with each IP address in the database, so as to query the relevant information corresponding to the IP address to be queried. However, when facing large-scale IP queries, this IP address query method needs to be compared with each IP address in the database, resulting in low query efficiency of IP information, high requirements for cache capacity, and large investment in hardware resources.

[0004] In summary, there is an urgent need for an IP information query method to effectively improve the query efficiency of IP information. Summary of the invention

[0005] The embodiment of the present invention provides an IP information query method and device, which are used to effectively improve the query efficiency of IP information.

[0006] In a first aspect, an embodiment of the present invention provides an IP information query method, comprising:

[0007] When an IP information query request for any network protocol IP address is detected, determining the corresponding IP address from the IP information query request;

[0008] According to the set mask bit, the IP address is segmented bit by bit to determine the first IP character string;

[0009] Determine whether the first IP string exists in the first cascade IP record;

[0010] If so, when it is determined that there is no IP information associated with the first IP string in the first cascade IP record, the IP address is matched with each IP address in the second cascade IP record, and the IP information corresponding to the IP address is determined when the match is successful.

[0011] In the above technical scheme, when querying the IP information corresponding to the IP address in the prior art scheme, it is necessary to convert the IP address for matching or directly match the IP address, but there is a problem that a certain amount of time is consumed for IP address matching, resulting in low efficiency in querying the IP information. In view of this, the technical scheme in the present invention is to segment the IP address according to the mask bit, rather than taking different weights and adding them after converting the IP address, so that the time overhead can be effectively reduced, and only the IP address that does not have the associated IP information in the first cascade IP record is further hierarchically queried in the second cascade IP record, and for the IP address that has the associated IP information in the first cascade IP record, the corresponding IP information can be timely and accurately queried in the first cascade IP record, so that the storage overhead of the IP address can be effectively reduced, and the query efficiency of the IP information can be effectively improved. Specifically, when an IP information query request for any IP address is detected, the corresponding IP address can be parsed from the IP information query request, and according to the set mask bits, the IP address can be bit-segmented to obtain the first IP string. This can save the time spent on adding different weights after converting the IP address. Then determine whether the first IP string exists in the first cascade IP record, which is equivalent to performing a first-level match on the IP address. If it is determined that the first IP string exists in the first cascade IP record but there is no IP information associated with the first IP string, it is necessary to match the IP address corresponding to the first IP string with each IP address in the second cascade IP record, and determine the IP information corresponding to the IP address when the match is successful. That is to say, only under the premise that a first IP string is stored in the first cascade IP record but the IP information associated with the first IP string is not stored, the second-level query is performed on the IP address corresponding to the first IP string. In this way, the query time for the IP address corresponding to the IP information associated with the first IP string stored in the first cascade IP record can be reduced (because the IP address corresponding to the IP information associated with the first IP string stored in the first cascade IP record is only subjected to the first-level query), and the overhead of storing a large number of single IP addresses can be effectively reduced. In this way, the scheme can effectively save the time consumed by adding different weights after converting the IP address by splitting the IP address according to the mask bits, and only perform a second-level query on the IP address corresponding to the IP information associated with a first IP string stored in the first cascade IP record but not the first IP string, thereby effectively improving the query efficiency of the IP information.

[0012] Optionally, the method further comprises:

[0013] When it is determined that the first cascade IP record contains IP information associated with the first IP character string, the IP information is determined to be the IP information corresponding to the IP address.

[0014] In the above technical solution, when it is determined that the first cascade IP record stores the first IP string and the IP information associated with the first IP string, the IP information corresponding to the first IP string can be directly queried from the first cascade IP record. The IP information is the IP information of the IP address corresponding to the first IP string, and there is no need to perform a second-level query on the IP address, thereby effectively reducing the number of queries on the IP address, thereby effectively improving the query efficiency of the IP information.

[0015] Optionally, the first cascade IP record is used to indicate a first-level query for an IP address; the second cascade IP record is used to indicate a second-level query for an IP address; and the second-level query is a hierarchical query of the first-level query.

[0016] In the above technical solution, each IP address is divided into two types of IP addresses according to the attributes of each IP address (the label attributes carried by each IP address after the IP address is allocated according to different regions, such as countries or cities, or according to different enterprises), namely, IP addresses with the attributes of the entire IP segment and IP addresses without the attributes of the entire IP segment. Since at least one IP address with the attribute of the entire IP usually belongs to the same region or the same enterprise, that is, based on the relatively concentrated characteristics of a certain segment (such as segment C) in the IP address, the second character string corresponding to at least one IP address with the attribute of the entire IP and the corresponding IP information are stored in the first cascade IP record, and the IP address without the attribute of the entire IP segment (that is, a small number of scattered IPs are not located in the entire IP segment) and the corresponding IP information are stored in the second cascade IP record, so that the subsequent queries located in the entire IP segment (IP start address-IP end address) can be effectively reduced. Among them, the first cascade IP record is used for the first level query for the IP address; the second cascade IP record is used for the second level query for the IP address, that is, the second level query is performed only for the IP address that needs to be queried in a hierarchical manner. For example, the first IP string corresponding to a certain IP address exists in the first cascade IP record, but the IP information associated with the first IP string does not exist in the first cascade IP record. Therefore, if you want to query the IP information associated with the first IP string, you need to perform a second level query for the IP address in the second cascade IP record, which is equivalent to performing a hierarchical query on the IP address. Only in this way can you query the IP information corresponding to the IP address.

[0017] Optionally, performing bit-wise segmentation processing on the IP address according to the set mask bit to determine the first IP character string includes:

[0018] According to the set mask bits, the IP address is bit-segmented in a preset direction to obtain the first IP character string that conforms to the set mask bits; wherein the preset direction is from left to right or from right to left.

[0019] In the above technical solution, after determining the set mask bit, the set mask bit is used as the segmentation basis, and the IP address is segmented bit by bit in a preset direction (such as from left to right or from right to left), so that the first IP character string that meets the set mask bit can be accurately obtained.

[0020] Optionally, the bitwise segmentation of the IP address in a preset direction to obtain the first IP character string that conforms to the set mask bit includes:

[0021] If the set mask bit is 24, the IP address is segmented bit by bit from left to right to obtain the first IP string consisting of segments A, B and C of the IP address; or segment D of the IP address is segmented bit by bit from right to left to obtain the first IP string consisting of segments A, B and C of the IP address;

[0022] If the set mask bit is 16, the IP address is bit-segmented from left to right to obtain the first IP character string consisting of segment A and segment B of the IP address; or, segment C and segment D of the IP address are bit-segmented from right to left to obtain the first IP character string consisting of segment A and segment B of the IP address.

[0023] In the above technical scheme, based on the characteristics of the IP address (i.e., the IP address is composed of segment A, segment B, segment C and segment D, each segment is converted to binary and occupies 8 bits, i.e., 8 bits) and according to the current behavior of using IP addresses in various industries or regions, it can be known that there are two types of mask bits that are usually set, one is 24 and the other is 16, that is, when the set mask bit is 24, the IP address is processed by bit segmentation in order from left to right, or the D segment of the IP address is processed by bit excision in order from right to left, and the first IP string composed of segment A, segment B and segment C can be accurately obtained. When the set mask bit is 16, the IP address is processed by bit segmentation in order from left to right, or the C segment and the D segment of the IP address are processed by bit excision in order from right to left, and the first IP string composed of segment A and segment B can be accurately obtained. In this way, the scheme facilitates the subsequent rapid query of the IP information corresponding to the IP address through the first IP string.

[0024] Optionally, the first cascade IP record and the second cascade IP record are determined in the following manner:

[0025] Obtain from the IP attribution database each IP address with the whole IP segment attribute, each IP information corresponding to each IP address with the whole IP segment attribute, and each IP address without the whole IP segment attribute, each IP information corresponding to each IP address without the whole IP segment attribute;

[0026] According to the set mask bit, each IP address with the whole IP segment attribute and each IP address without the whole IP segment attribute are respectively subjected to bit segmentation processing to obtain each second IP character string corresponding to each IP address with the whole IP segment attribute and each second IP character string corresponding to each IP address without the whole IP segment attribute;

[0027] The second IP character strings corresponding to the IP addresses with the whole IP segment attribute, the IP information corresponding to the IP addresses with the whole IP segment attribute, and the second IP character strings corresponding to the IP addresses without the whole IP segment attribute are stored in the first cascade IP record, and the IP addresses without the whole IP segment attribute and the IP information corresponding to the IP addresses without the whole IP segment attribute are stored in the second cascade IP record.

[0028] In the above technical scheme, through the IP attribution library, it can be determined which IP addresses in the IP attribution library belong to the whole IP segment and which IP addresses belong to the non-whole IP segment (i.e. scattered IP). Then, when dividing each IP address into two-level IP records (i.e., the first cascade IP record and the second cascade IP record), it is necessary to first determine the mask bit, such as according to the current usage of IP addresses in various regions (such as city level) and various industries, that is, based on the relatively concentrated characteristics of a certain segment of the IP address (such as segment C), to determine a mask bit (such as 24). For example, some cities are allocated a whole IP segment (such as the whole C segment), and the whole IP segment contains multiple IP addresses, or some cities are allocated a non-whole IP segment, such as one or several scattered IP addresses. Based on the relatively concentrated characteristics of a certain segment of the IP address (such as segment C), when querying a certain IP address belonging to the C segment, the corresponding IP information can be quickly obtained through the IP character string composed of segments A, B and C of the IP address (since segments A, B and C already represent the attributes of the IP address, there is no need to match segment D, and therefore there is no need to match the entire IP address. For IP addresses with the attributes of the entire IP segment, only a part of the information in the IP address is needed to quickly and accurately complete the match). In order to facilitate the subsequent query efficiency of the IP address, each IP address with the attributes of the entire IP segment and each IP address without the attributes of the entire IP segment will be bit-segmented according to the set mask bits. At the same time, for IP addresses with the entire IP segment attribute, the corresponding IP information can be queried through the first-level query without the need for a second-level hierarchical query. However, for IP addresses that do not have the entire IP segment attribute, a second-level hierarchical query is required to determine whether the corresponding IP information can be queried. Therefore, the first cascade IP record only stores the corresponding IP information for IP addresses with the entire IP segment attribute (since IP addresses with the entire IP segment attribute do not need to match the D segment of the IP address, only the A segment, B segment and C segment of the IP address are needed to quickly and accurately complete the match), which can effectively reduce the number of queries for IP addresses with the entire IP segment attribute; the second cascade IP record only stores the corresponding IP information for IP addresses that do not have the entire IP segment attribute (since IP addresses that do not have the entire IP segment attribute need to match the D segment of the IP address, a secondary query for the D segment will be set, that is, a hierarchical query for the D segment, so as to query the IP information corresponding to the IP address that does not have the entire IP segment attribute). Therefore, this solution can effectively improve the query performance of IP information by constructing two-level IP records (i.e., first cascade IP records and second cascade IP records) for IP information queries for IP addresses with different IP attributes (such as whole IP segment attributes and non-whole IP segment attributes).

[0029] Optionally, determining whether the first IP character string exists in the first cascade IP record includes:

[0030] The first IP string is matched with each second IP string in the first cascade IP record in sequence through a preset matching method, so as to determine whether the first IP string exists in the first cascade IP record.

[0031] In the above technical solution, when a first-level query is performed on a certain IP address through the first cascade IP record, that is, the first IP character string corresponding to the IP address is matched with each second IP character string in the first cascade IP record in sequence. When it is determined that the first IP character string matches a second IP character string successfully, the IP information associated with the second IP character string can be determined as the IP information corresponding to the IP address.

[0032] In a second aspect, an embodiment of the present invention further provides an IP information query device, comprising:

[0033] A detection unit, configured to, when an IP information query request for any network protocol IP address is detected, determine a corresponding IP address from the IP information query request;

[0034] A processing unit is used to perform bit-by-bit segmentation processing on the IP address according to the set mask bits to determine a first IP string; determine whether the first IP string exists in a first cascade IP record; if so, when it is determined that there is no IP information associated with the first IP string in the first cascade IP record, match the IP address with each IP address in a second cascade IP record, and determine the IP information corresponding to the IP address when the match is successful.

[0035] Optionally, the processing unit is further configured to:

[0036] When it is determined that the first cascade IP record contains IP information associated with the first IP character string, the IP information is determined to be the IP information corresponding to the IP address.

[0037] Optionally, the first cascade IP record is used to indicate a first-level query for an IP address; the second cascade IP record is used to indicate a second-level query for an IP address; and the second-level query is a hierarchical query of the first-level query.

[0038] Optionally, the processing unit is specifically configured to:

[0039] According to the set mask bits, the IP address is bit-segmented in a preset direction to obtain the first IP character string that conforms to the set mask bits; wherein the preset direction is from left to right or from right to left.

[0040] Optionally, the processing unit is specifically configured to:

[0041] If the set mask bit is 24, the IP address is segmented bit by bit from left to right to obtain the first IP string consisting of segments A, B and C of the IP address; or segment D of the IP address is segmented bit by bit from right to left to obtain the first IP string consisting of segments A, B and C of the IP address;

[0042] If the set mask bit is 16, the IP address is bit-segmented from left to right to obtain the first IP character string consisting of segment A and segment B of the IP address; or, segment C and segment D of the IP address are bit-segmented from right to left to obtain the first IP character string consisting of segment A and segment B of the IP address.

[0043] Optionally, the processing unit is specifically configured to:

[0044] Obtain from the IP attribution database each IP address with the whole IP segment attribute, each IP information corresponding to each IP address with the whole IP segment attribute, and each IP address without the whole IP segment attribute, each IP information corresponding to each IP address without the whole IP segment attribute;

[0045] According to the set mask bit, each IP address with the whole IP segment attribute and each IP address without the whole IP segment attribute are respectively subjected to bit segmentation processing to obtain each second IP character string corresponding to each IP address with the whole IP segment attribute and each second IP character string corresponding to each IP address without the whole IP segment attribute;

[0046] The second IP character strings corresponding to the IP addresses with the whole IP segment attribute, the IP information corresponding to the IP addresses with the whole IP segment attribute, and the second IP character strings corresponding to the IP addresses without the whole IP segment attribute are stored in the first cascade IP record, and the IP addresses without the whole IP segment attribute and the IP information corresponding to the IP addresses without the whole IP segment attribute are stored in the second cascade IP record.

[0047] Optionally, the processing unit is specifically configured to:

[0048] The first IP string is matched with each second IP string in the first cascade IP record in sequence through a preset matching method, so as to determine whether the first IP string exists in the first cascade IP record.

[0049] In a third aspect, an embodiment of the present invention provides a computing device, comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes any IP information query method described in the first aspect.

[0050] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium storing a computer program executable by a computing device, wherein when the program runs on the computing device, the computing device executes any of the IP information query methods described in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] Figure 1 A flowchart of an IP information query method provided by an embodiment of the present invention;

[0053] Figure 2 A schematic diagram of a C domain dictionary table and a D domain dictionary table constructed based on a static IP address list provided in an embodiment of the present invention;

[0054] Figure 3 A schematic diagram of the structure of an IP information query device provided by an embodiment of the present invention;

[0055] Figure 4 A schematic diagram of the structure of a computing device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] Figure 1The flow of an IP information query method provided by an embodiment of the present invention is exemplarily shown, and the flow can be executed by an IP information query device.

[0058] like Figure 1 As shown in the figure, the process specifically includes:

[0059] Step 101, when an IP information query request for any network protocol IP address is detected, a corresponding IP address is determined from the IP information query request.

[0060] In an embodiment of the present invention, in some big data processing, an IP address query may be required to query the relevant IP information of the IP address. Based on this, if a user wants to query the relevant IP information of a certain IP address, it is necessary to generate an IP information query request through the client in the terminal device used (such as a laptop, desktop computer, smart phone or other network device, etc.), and the IP information query request contains the IP address. Alternatively, an IP information query instruction is generated by editing on the client in the terminal device used, and the IP information query instruction contains the IP address. Among them, the IP information query method is executed by an IP information query device, and the IP information query device can be a network device (such as a computer, etc.) or a communication device that can support the network device to implement the functions required by the method, such as a chip system. Among them, multiple users can batch initiate multiple IP information query requests or multiple IP information query instructions to the network device in parallel, and the network device performs batch processing for batch IP information query requests or IP information query instructions. Among them, a user can also batch generate multiple IP information query requests or multiple IP information query instructions at the same time, and send the multiple IP information query requests or multiple IP information query instructions to the network device. For example, taking an IP information query request or an IP information query instruction as an example, an IP information query request or an IP information query instruction generated by a user is sent to the network device. After detecting the IP information query request or the IP information query instruction sent by the user, the network device can parse and process the IP information query request or the IP information query instruction, thereby resolving the corresponding IP address.

[0061] Step 102: According to the set mask bits, the IP address is segmented bit by bit to determine a first IP character string.

[0062] In an embodiment of the present invention, after parsing out the IP address contained in a certain IP information query request, the network device can perform bit-by-bit segmentation processing on the IP address according to the set mask bit, thereby determining the first IP string. Among them, the set mask bit is set in advance based on the needs of the actual application scenario (that is, the mask bits required for different application scenarios may be different). That is, since each IP string stored in the first cascade IP record is also segmented and generated for each IP address according to the set mask bit, it is convenient to improve the query efficiency of the IP address. Therefore, after parsing out the IP address, it is also necessary to perform bit-by-bit segmentation processing on the IP according to the set mask bit, that is, using the set mask bit as the segmentation basis, and based on the preset direction, the first IP string that meets the set mask bit can be accurately obtained. Among them, the preset direction is from left to right or from right to left.

[0063] Among them, when the IP address is bitwise segmented in a preset direction, based on the characteristics of the IP address (i.e., the IP address is composed of segment A, segment B, segment C and segment D, each segment occupies 8 bits when converted to binary, i.e., 8 bits) and the current behavior of using the IP address in various industries or regions (such as city level), that is, based on the relatively concentrated characteristics of a segment (such as segment C) of the IP address, for example, some cities are allocated a whole IP segment (such as segment C), and the whole IP segment contains multiple IP addresses, or some cities are allocated a non-whole segment IP, such as one or several scattered IP addresses, it can be known that there are two types of mask bits that are usually set, one is 24 and the other is 16. That is, if the set mask bit is 24, the IP address is bitwise segmented in a left-to-right order, or the D segment of the IP address is bitwise removed in a right-to-left order, and the first IP string composed of segment A, segment B and segment C can be accurately obtained. If the mask bit is set to 16, the IP address is segmented bit by bit from left to right, or the C segment and the D segment of the IP address are removed bit by bit from right to left, and the first IP string composed of the A segment and the B segment of the IP address can be accurately obtained. In this way, the solution facilitates the subsequent rapid query of the IP information corresponding to the IP address through the first IP string.

[0064] Exemplarily, taking the mask bit as 24 as an example, and taking the preset direction as from left to right as an example, the IP address contained in a certain IP information query request generated by a certain user is abcd, then a segmentation is performed according to the position of mask = / 24, that is, the IP address is segmented bit by bit in the order from left to right, and the segmentation stops at c, because the segmentation to c just meets 24 bits. In this way, the IP string "abc" can be extracted from the IP address, and the IP string is matched with each second IP string in the first cascade IP record in turn. If no match is found, the IP address corresponding to the IP string is discarded. If a match is found, it is determined whether the IP string belongs to the entire IP segment or a non-entire IP segment. Since in the first cascade IP record, the IP string belonging to the entire IP segment is stored in the form of a key-value pair (that is, the IP string is used as the key, and the IP information corresponding to the IP string is used as the value), the IP string belonging to a non-whole IP segment is only stored in the first cascade IP record, and the IP information corresponding to the IP string is not stored. If the IP string belongs to the entire IP segment, the corresponding IP information can be directly obtained in the first cascade IP record without performing a second-level query in the second cascade IP record. If the IP string belongs to a non-whole IP segment, the corresponding IP information cannot be obtained in the first cascade IP record, and a second-level query is required in the second cascade IP record. Alternatively, taking the IP address 45.115.45.3 contained in an IP information query request generated by a user as an example, a split is performed according to the position of mask = / 24, that is, the IP address is split bit by bit from left to right, and the split stops at 5 before 3, because 5 before 3 just meets 24 bits, so the IP string "45.115.45" can be extracted from the IP address.

[0065] Step 103: Determine whether the first IP character string exists in the first cascade IP record.

[0066] In the embodiment of the present invention, before determining whether the first IP string exists in the first cascade IP record, the first cascade IP record and the second cascade IP record need to be determined in advance. It should be noted that, by following the attributes of each IP address (after the IP address is allocated according to different regions, such as countries or cities, etc., or according to different enterprises, etc., the label attributes carried by each IP address) each IP address can be divided into two types of IP addresses, namely, an IP address with the entire IP segment attribute and an IP address without the entire IP segment attribute. Since at least one IP address with the entire IP attribute usually belongs to the same region or the same enterprise, etc., that is, based on the relatively concentrated characteristics of a certain segment (such as segment C) in the IP address, therefore, the second string corresponding to at least one IP address with the entire IP attribute and the corresponding IP information are stored in the first cascade IP record in the form of a key-value pair, and the IP address without the entire IP segment attribute (i.e., a small number of scattered IPs are not located in the entire IP segment) and the corresponding IP information are stored in the second cascade IP record in the form of a key-value pair, so that the query located in the entire IP segment (IP start address-IP end address) can be effectively reduced later. Among them, the first cascade IP record is used to indicate the first-level query for the IP address; the second cascade IP record is used to indicate the second-level query for the IP address; the second-level query is a hierarchical query of the first-level query. For example, the first IP string corresponding to a certain IP address exists in the first cascade IP record, but the IP information associated with the first IP string does not exist in the first cascade IP record. Therefore, if you want to query the IP information associated with the first IP string, you need to perform a second-level query for the IP address in the second cascade IP record, which is equivalent to a hierarchical query for the IP address, so that it is possible to query the IP information corresponding to the IP address.

[0067] Specifically, when determining the first cascade IP record and the second cascade IP record, the IP belonging library can be used to determine which IP addresses in the IP belonging library belong to the whole IP segment and which IP addresses belong to the non-whole IP segment (i.e., scattered IPs). That is, each IP address with the whole IP segment attribute, each IP information corresponding to each IP address with the whole IP segment attribute, and each IP address without the whole IP segment attribute, each IP information corresponding to each IP address without the whole IP segment attribute can be obtained from the IP belonging library. At this time, it is also necessary to perform bit-by-bit segmentation processing for each IP address with the whole IP segment attribute and each IP address without the whole IP segment attribute according to the set mask bit and in a preset direction (such as from left to right or from right to left), so as to accurately obtain each second IP string corresponding to each IP address with the whole IP segment attribute and each second IP string corresponding to each IP address without the whole IP segment attribute. Thus, compared with the first existing IP information query method, this solution does not require IP conversion operations (for example, the first existing IP information query method uses a classic red-black tree algorithm, and the specific search method is: if the key being searched is equal to the key of the root node, the search is successful. Otherwise, continue searching in the appropriate subtree, and if the key being searched is smaller, select the left subtree, and if it is larger, select the right subtree. If the tree is empty, the search is a miss. As we continue to search downward, the size of the subtree represented by the current node is also decreasing. At the same time, the starting address and the ending address of the IP segment need to be converted into long integers, and then different weights are added before constructing a red-black tree. When there are too many IP segments, the red-black tree will also become very large, and the depth of the tree will increase, which will lead to reduced query efficiency), which can effectively reduce time overhead, thereby improving the query efficiency for IP addresses. Then, according to the functions of the first cascade IP record and the second cascade IP record, each second IP character string corresponding to each IP address with the whole IP segment attribute and each IP information corresponding to each IP address with the whole IP segment attribute are stored in the first cascade IP record in the form of key-value pairs, and each second IP character string corresponding to each IP address without the whole IP segment attribute is stored in the first cascade IP record; each IP address without the whole IP segment attribute and each IP information corresponding to each IP address without the whole IP segment attribute are stored in the second cascade IP record in the form of key-value pairs. In this way, for an IP address with the whole IP segment attribute, the corresponding IP information can be queried by performing a first-level query in the first cascade IP record, without the need for a second-level query in the second cascade IP record.For example, for a certain area, multiple IP addresses with a whole C segment attribute are allocated to the area, and the first cascade IP record also stores the second IP character strings composed of segments A, B and C. Since segments A, B and C already represent the attributes of the IP address, there is no need to match segment D, and therefore there is no need to match the entire IP address. For IP addresses with the whole C segment attribute, only a part of the information in the IP address is needed to quickly and accurately complete the match, thereby effectively reducing the number of queries for IP addresses with the whole IP segment attribute. For IP addresses that do not have the entire IP segment attribute, the associated IP information cannot be found in the first cascade IP record, and a second-level query is required in the second cascade IP record. That is, in addition to matching the IP string composed of segments A, B, and C in the first cascade IP record, the IP address that does not have the entire IP segment attribute also needs to match segment D of the IP address in the second cascade IP record (that is, the entire IP address is matched in the second cascade IP record) in order to query the IP information corresponding to the IP address that does not have the entire IP segment attribute.

[0068] For example, according to the characteristics that the static IP address list (i.e., the IP address attribution library) is relatively concentrated in a certain mask segment (such as the C segment of the IP address), these masks with large-scale whole IP segments are divided to construct cascaded IP domains to reduce queries within the whole segment of IP. In order to give full play to the fast search performance of the database (such as redis), the horizontal key value of the comparison library can be expanded to the order of 10 million, and the number of vertical cascaded Redis libraries is controlled at 2-3. For example, in order to realize the scenario of identifying threat IPs in information security risk control work, it is necessary to quickly query the attribution location for IP in the DNS (Domain Name System) recursive resolution data. Among them, the total number of IPv4 (Internet Protocol Version 4, Internet Protocol Version 4) addresses in the world exceeds 4.2 billion, which is expressed in decimal in the database as: 0.0.0.0-255.255.255.255. In this IP attribution database, the country and city information to which the IP belongs is stored by interval, wherein the IP segment is generally divided into cities with at least 1 C (ABC0-ABC255 contains 256 / 32 IPs) as the basic unit, and a small number of addresses are divided into smaller units than 1 C. However, it is not advisable to split all IP segments into scattered IPs for storage specifically for these small number of network addresses. Therefore, the technical solution in the present invention constructs a two-level IP record (i.e., a first cascade IP record and a second cascade IP record) for IP information query for IP addresses with different IP attributes (such as whole IP segment attributes and non-whole IP segment attributes), and caches them through Redis, which can effectively improve the query performance of IP information.

[0069] Specifically, in a certain database (such as Redis), two-level database tables (i.e., the first cascade IP record and the second cascade IP record) of domain C (i.e., the A segment, B segment, and C segment of the IP address) and domain D (i.e., the A segment, B segment, C segment, and D segment of the IP address, that is, the complete IP address) are constructed for each IP address. The C domain dictionary table includes the entire IP segment and the non-entire IP segment. In this way, most IP addresses only need to search for the C segment of / 24, and a small number of scattered IP addresses are not in the entire IP segment and need to query the D segment. This can greatly improve the efficiency of IP information query and reduce the overhead consumed by querying IP information. For example, first construct C The domain dictionary table, that is, the C-segment prefix string with a mask of / 24. For the IP address of the entire IP segment, the C-domain dictionary table needs to store the corresponding IP information (such as the attribute value of the IP address, for example, which region or city the IP address belongs to). For the scattered IP addresses of non-integral IP segments, the C-domain dictionary table only stores the C-segment prefix string of the IP address with a mask of / 24, and does not store the corresponding IP information. Of course, a D-domain dictionary table will be set up for the scattered IP addresses of non-integral IP segments to store the A segment, B segment, C segment, and D segment of the IP address, that is, the IP string with a mask of / 32, and the corresponding IP information.

[0070] For example, taking a large-scale static IP library as shown in Table 1 as an example, the implementation process of constructing the C-domain dictionary table and the D-domain dictionary table is described.

[0071] Table 1

[0072] IP address value range IP Information 45.115.44.0～45.115.46.255 XXXX area 001 46.103.2.0～46.103.2.255 XXXX Area 002 … … 47.132.44.2～47.132.44.255 Area 009

[0073] From Table 1, we can find that there are multiple whole IP segments, such as 45.115.44-45.115.45, 45.115.45-45.115.46, etc. Among them, a few regions have scattered IP addresses, such as the IP address corresponding to region 009. In addition, it should be noted that since the C segment in the IP address corresponding to region 001 is relatively concentrated, that is, 45.115.44-45.115.45, 45.115.45-45.115.46 are all associated with region 001, it can be seen that the A segment, B segment and C segment in the IP address already represent the attributes of the IP address (i.e. the attributes corresponding to region 001), so the IP information corresponding to the IP address (i.e. region 001) can be determined by matching the IP character string composed of A segment, B segment and C segment, and there is no need to match the D segment. For example, the IP address corresponding to 009 in a certain area does not exist in the entire IP segment. It is a scattered IP address and needs further query, that is, it is necessary to query through the D domain to find the corresponding IP information.

[0074] For each IP address in Table 1, by performing bitwise segmentation processing on each IP address according to the set mask bit (for example, 24), the IP character string corresponding to each IP address can be obtained. For example, according to the segmentation basis of the mask bit 24, the IP address 45.115.44.0 in Table 1 is segmented bitwise in a left-to-right order to obtain the IP character string "45.115.44" corresponding to the IP address, or according to the segmentation basis of the mask bit 24, the IP address 46.103.2.0 in Table 1 is segmented bitwise in a left-to-right order to obtain the IP character string "46.103.2" corresponding to the IP address. And, for scattered IP addresses that are not complete IP segments, it is necessary to construct the D domain, that is, to create a mapping relationship between the complete IP address and the IP information. In this way, the C domain dictionary table and the D domain dictionary table for the IP address as shown in Table 2 can be constructed.

[0075] Table 2

[0076]

[0077]

[0078] When determining whether the first IP string exists in the first cascade IP record, the first IP string is matched with each second IP string in the first cascade IP record in sequence through a preset matching method (such as a cosine similarity algorithm, a Pearson correlation coefficient algorithm or other character matching rules, etc.), so as to determine whether the first IP string exists in the first cascade IP record. If there is a second IP string in the first cascade IP record that successfully matches the first IP string, it can be determined that the first IP string exists in the first cascade IP record; if there is no second IP string in the first cascade IP record that successfully matches the first IP string, it can be determined that the first IP string does not exist in the first cascade IP record, so the IP address can be discarded without the need for subsequent matching procedures. Exemplarily, taking the cosine similarity algorithm as an example, the cosine similarity algorithm is used to determine the similarity values ​​of the first IP string and the second IP strings in the first cascade IP record, and the similarity values ​​are compared to determine the maximum similarity value. If the maximum similarity value is greater than or equal to a preset threshold, it is determined that the second IP string corresponding to the maximum similarity value successfully matches the first IP string. For example, taking the IP address 45.115.44.0 as an example, the IP address is bit-wise segmented according to the set mask bit (such as 24) to obtain the first IP string "45.115.44". The similarity values ​​of the first IP string "45.115.44" and the second IP strings in the first cascade IP record are determined by the cosine similarity algorithm, and the similarity values ​​are compared to determine the maximum similarity value (for example, 0.85). If the maximum similarity value 0.85 is greater than a preset threshold value (for example, 0.8), it is determined that the second IP string "45.115.44" corresponding to the maximum similarity value successfully matches the first IP string "45.115.44". Alternatively, a direct character matching method is adopted, that is, the first IP string is sequentially matched with each second IP string in the first cascade IP record, that is, each character in the first string is sequentially compared with each character of any second IP string. If there is a second IP string that successfully matches the first IP string, it is determined that the first IP string exists in the first cascade IP record.

[0079] Or, as Figure 2Taking the C domain dictionary table and D domain dictionary table constructed by another static IP address list shown as an example, taking the IP address value range corresponding to a certain city (such as 172.10.1.0~172.10.9.255) as an example, there are multiple whole IP segments in the IP address value range corresponding to the city, indicating that the IP address corresponding to the city has the whole IP segment attribute. Exemplarily, taking an IP address in the city as an example, for example, taking 172.10.1.0 as an example, according to the segmentation basis of mask bit 24, the IP address is segmented bit by bit in order from left to right, and the IP string "172.10.1" is obtained. The IP string is matched with each IP string in the C domain dictionary table (that is, the first cascade IP record). If there is an IP string in the C domain dictionary table that matches the IP string successfully, it is determined that the IP string exists in the C domain dictionary table, and it is determined whether the IP string has the whole IP segment attribute, or it is determined whether there is IP information associated with the first IP string in the C domain dictionary table. If so, the IP information corresponding to the IP string "172.10.1" (such as value 1) can be directly obtained from the C domain dictionary table, that is, the value "1" is obtained. In this way, the matching of the IP address is completed. If there is no IP string in the C domain dictionary table that matches the IP string successfully, it means that the IP string matching fails, and the IP address corresponding to the IP string can be discarded. Alternatively, taking the IP address value range corresponding to another city (such as 172.10.10.1-172.10.10.127) as an example, the IP address value range corresponding to the city does not have an entire IP segment, indicating that the IP address corresponding to the city does not have an entire IP segment attribute.For example, taking an IP address in the city as an example, for example, taking 172.10.10.1 as an example, according to the segmentation basis of mask bit 24, the IP address is segmented bit by bit in a left-to-right order to obtain the IP string "172.10.10", and the IP string is matched with each IP string in the C domain dictionary table. If there is an IP string in the C domain dictionary table that successfully matches the IP string, it is determined that the IP string exists in the C domain dictionary table, and it is determined whether the IP string has the whole IP segment attribute, or it is determined whether there is IP information associated with the first IP string in the C domain dictionary table. If not, it can be known that the IP string belongs to a non-whole IP segment, and the IP address "172.10.10.1" needs to be matched with each IP address in the D domain dictionary table at the second level. If there is an IP address in the D domain dictionary table that successfully matches the IP address, the IP information corresponding to the IP address 172.10.10.1 (such as value a) can be obtained, that is, the value "a" is obtained. In this way, the match for the IP address is completed. If there is no IP address in the D domain dictionary table that successfully matches the IP address, the IP address match fails, and there is no IP information associated with the IP address.

[0080] Step 104: If it is determined that the first IP string exists in the first cascade IP record, then when it is determined that the IP information associated with the first IP string does not exist in the first cascade IP record, the IP address is matched with each IP address in the second cascade IP record, and the IP information corresponding to the IP address is determined when the match is successful.

[0081] In an embodiment of the present invention, after determining that the first IP string exists in the first cascade IP record, it can be determined whether the first IP string has the attribute of the entire IP segment, that is, it can be determined whether the first IP string belongs to the entire IP segment or to a non-entire IP segment. If it is determined that the first IP string has the attribute of the entire IP segment, the corresponding IP information can be directly obtained from the first cascade IP record without performing a second-level query in the second cascade IP record to obtain the corresponding IP information. That is, when it is determined that the first cascade IP record contains IP information associated with the first IP string, the IP information can be determined as the IP information corresponding to the IP address, thereby effectively reducing the number of queries for the IP address, thereby effectively improving the query efficiency of the IP information; if it is determined that the first IP string has the attribute of the entire IP segment, the corresponding IP information can be directly obtained from the first cascade IP record without performing a second-level query in the second cascade IP record to obtain the corresponding IP information. If it is determined that the first IP string does not have the whole IP segment attribute, the corresponding IP information cannot be obtained in the first cascade IP record. At this time, it is necessary to perform a second-level query in the second cascade IP record for the IP address that does not have the whole IP segment attribute to query the corresponding IP information. In this way, the scheme does not need to perform interval comparison for the IP address, and the overhead of calculating and comparing the interval edge can be saved, thereby improving the matching efficiency for the IP address. In addition, the scheme can greatly save the investment of hardware resources (mainly memory) (for example, if the IP table scale is expanded to 300 million or 3.2 billion, in order to achieve the same query capability, the existing second IP information query method needs to invest several times of hardware resources to achieve), and at the same time, it can reduce the number of queries for IP addresses located in the whole IP segment. Alternatively, it can be determined whether there is IP information associated with the first IP string in the first cascade IP record. If it is determined that there is IP information associated with the first IP string in the first cascade IP record, the corresponding IP information can be directly obtained from the first cascade IP record, without the need to perform a second-level query in the second cascade IP record to obtain the corresponding IP information. If it is determined that the IP information associated with the first IP string does not exist in the first cascade IP record, it is necessary to match the IP address corresponding to the first IP string with each IP address in the second cascade IP record to determine whether the IP information corresponding to the IP address is stored in the second cascade IP record. If there is an IP address in the second cascade IP record that successfully matches the IP address corresponding to the first IP string, the IP information associated with the IP address in the second cascade IP record can be used as the IP information of the IP address corresponding to the first IP string. If there is no IP address in the second cascade IP record that successfully matches the IP address corresponding to the first IP string, it means that the IP address corresponding to the first IP string does not exist in the second cascade IP record.

[0082] Exemplarily, taking an IP address of 45.115.45.3 as an example, according to the segmentation basis of mask bit 24, the IP address is segmented bit by bit in order from left to right, and the IP string "45.115.45" is obtained. The IP string is matched with each IP string in the C domain dictionary table (that is, the first cascade IP record). If there is an IP string in the C domain dictionary table that successfully matches the IP string, it is determined that the IP string exists in the C domain dictionary table, and it is determined whether the IP string belongs to the entire IP segment, or it is determined whether there is IP information associated with the first IP string in the C domain dictionary table. If so, the IP information corresponding to the IP string (such as a certain area 001) can be directly obtained from the C domain dictionary table, that is, the value "a certain area 001" is obtained. In this way, the match for the IP address is completed. Alternatively, taking an IP address of 47.132.44.3 as an example, according to the segmentation basis of mask bit 24, the IP address is segmented bit by bit in a left-to-right order to obtain the IP string "47.132.44", and the IP string is matched with each IP string in the C domain dictionary table. If there is an IP string in the C domain dictionary table that successfully matches the IP string, it is determined that the IP string exists in the C domain dictionary table, and it is determined whether the IP string belongs to the entire IP segment, or whether there is IP information associated with the first IP string in the C domain dictionary table. If not, it can be learned that the IP string belongs to a non-entire IP segment, and it is necessary to perform a second-level match between the IP address and each IP address in the D domain dictionary table to determine whether there is IP information corresponding to the IP address in the D domain dictionary table. If there is an IP address in the D domain dictionary table that successfully matches the IP address, the IP information corresponding to the IP address (such as a certain area 009) can be obtained, that is, the value "a certain area 009" is obtained. Alternatively, taking an IP address of 47.132.44.1 as an example, according to the segmentation basis of mask bit 24, the IP address is segmented bit by bit in order from left to right to obtain the IP string "47.132.44", and the IP string is matched with each IP string in the C domain dictionary table. If there is an IP string in the C domain dictionary table that matches the IP string successfully, it is determined that the IP string exists in the C domain dictionary table, and it is determined whether the IP string belongs to the entire IP segment, or it is determined whether there is IP information associated with the first IP string in the C domain dictionary table. If not, it can be learned that the IP string belongs to a non-entire IP segment, and the IP address needs to be matched with each IP address in the D domain dictionary table at the second level, but the IP address "47.132.44.1" does not exist in the D domain dictionary table. Therefore, it is determined that the match for the IP address "47.132.44.1" in the D domain dictionary table fails.Alternatively, taking an IP address of 46.0.0.0 as an example, according to the segmentation basis of mask bit 24, the IP address is segmented bit by bit in order from left to right to obtain the IP string "46.0.0", and the IP string is matched with each IP string in the C domain dictionary table. However, the IP string "46.0.0" does not exist in the C domain dictionary table. Therefore, it is determined that the match for the IP string "46.0.0" in the C domain dictionary table fails.

[0083] The above embodiments show that, in the prior art solutions, when querying the IP information corresponding to the IP address, it is necessary to convert the IP address for matching or directly match the IP address, but there is a problem that a certain amount of time is consumed for IP address matching, resulting in low efficiency in querying the IP information. In view of this, the technical solution in the present invention is to segment the IP address according to the mask bit, rather than taking different weights and adding them after converting the IP address, so that the time overhead can be effectively reduced, and only the IP address that does not have the associated IP information in the first cascade IP record is further hierarchically queried in the second cascade IP record, and for the IP address that has the associated IP information in the first cascade IP record, the corresponding IP information can be timely and accurately queried in the first cascade IP record, so that the storage overhead of the IP address can be effectively reduced, and the query efficiency of the IP information can be effectively improved. Specifically, when an IP information query request for any IP address is detected, the corresponding IP address can be parsed from the IP information query request, and according to the set mask bits, the IP address can be bit-segmented to obtain the first IP string. This can save the time spent on adding different weights after converting the IP address. Then determine whether the first IP string exists in the first cascade IP record, which is equivalent to performing a first-level match on the IP address. If it is determined that the first IP string exists in the first cascade IP record but there is no IP information associated with the first IP string, it is necessary to match the IP address corresponding to the first IP string with each IP address in the second cascade IP record, and determine the IP information corresponding to the IP address when the match is successful. That is to say, only under the premise that a first IP string is stored in the first cascade IP record but the IP information associated with the first IP string is not stored, the second-level query is performed on the IP address corresponding to the first IP string. In this way, the query time for the IP address corresponding to the IP information associated with the first IP string stored in the first cascade IP record can be reduced (because the IP address corresponding to the IP information associated with the first IP string stored in the first cascade IP record is only subjected to the first-level query), and the overhead of storing a large number of single IP addresses can be effectively reduced. In this way, the scheme can effectively save the time consumed by adding different weights after converting the IP address by splitting the IP address according to the mask bits, and only perform a second-level query on the IP address corresponding to the IP information associated with a first IP string stored in the first cascade IP record but not the first IP string, thereby effectively improving the query efficiency of the IP information.

[0084] Based on the same technical concept, Figure 3 An IP information query device provided by an embodiment of the present invention is exemplarily shown, and the device can execute the process of the IP information query method.

[0085] like Figure 3 As shown, the device comprises:

[0086] The detection unit 301 is used to determine the corresponding IP address from the IP information query request when an IP information query request for any network protocol IP address is detected;

[0087] The processing unit 302 is used to perform bit-by-bit segmentation processing on the IP address according to the set mask bits to determine the first IP string; determine whether the first IP string exists in the first cascade IP record; if so, when it is determined that there is no IP information associated with the first IP string in the first cascade IP record, match the IP address with each IP address in the second cascade IP record, and determine the IP information corresponding to the IP address when the match is successful.

[0088] Optionally, the processing unit 302 is further configured to:

[0089] When it is determined that the first cascade IP record contains IP information associated with the first IP character string, the IP information is determined to be the IP information corresponding to the IP address.

[0090] Optionally, the first cascade IP record is used to indicate a first-level query for an IP address; the second cascade IP record is used to indicate a second-level query for an IP address; and the second-level query is a hierarchical query of the first-level query.

[0091] Optionally, the processing unit 302 is specifically configured to:

[0092] According to the set mask bits, the IP address is bit-segmented in a preset direction to obtain the first IP character string that conforms to the set mask bits; wherein the preset direction is from left to right or from right to left.

[0093] Optionally, the processing unit 302 is specifically configured to:

[0094] If the set mask bit is 24, the IP address is segmented bit by bit from left to right to obtain the first IP string consisting of segments A, B and C of the IP address; or segment D of the IP address is segmented bit by bit from right to left to obtain the first IP string consisting of segments A, B and C of the IP address;

[0095] If the set mask bit is 16, the IP address is bit-segmented from left to right to obtain the first IP character string consisting of segment A and segment B of the IP address; or, segment C and segment D of the IP address are bit-segmented from right to left to obtain the first IP character string consisting of segment A and segment B of the IP address.

[0096] Optionally, the processing unit 302 is specifically configured to:

[0097] Obtain from the IP attribution database each IP address with the whole IP segment attribute, each IP information corresponding to each IP address with the whole IP segment attribute, and each IP address without the whole IP segment attribute, each IP information corresponding to each IP address without the whole IP segment attribute;

[0098] According to the set mask bit, each IP address with the whole IP segment attribute and each IP address without the whole IP segment attribute are respectively subjected to bit segmentation processing to obtain each second IP character string corresponding to each IP address with the whole IP segment attribute and each second IP character string corresponding to each IP address without the whole IP segment attribute;

[0099] The second IP character strings corresponding to the IP addresses with the whole IP segment attribute, the IP information corresponding to the IP addresses with the whole IP segment attribute, and the second IP character strings corresponding to the IP addresses without the whole IP segment attribute are stored in the first cascade IP record, and the IP addresses without the whole IP segment attribute and the IP information corresponding to the IP addresses without the whole IP segment attribute are stored in the second cascade IP record.

[0100] Optionally, the processing unit 302 is specifically configured to:

[0101] The first IP string is matched with each second IP string in the first cascade IP record in sequence through a preset matching method, so as to determine whether the first IP string exists in the first cascade IP record.

[0102] Based on the same technical concept, the embodiment of the present invention also provides a computing device, such as Figure 4 As shown, it includes at least one processor 401 and a memory 402 connected to the at least one processor. The specific connection medium between the processor 401 and the memory 402 is not limited in the embodiment of the present invention. Figure 4 For example, the processor 401 and the memory 402 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0103] In the embodiment of the present invention, the memory 402 stores instructions that can be executed by at least one processor 401 , and the at least one processor 401 can execute the steps included in the aforementioned IP information query method by executing the instructions stored in the memory 402 .

[0104] Among them, the processor 401 is the control center of the computing device, and can use various interfaces and lines to connect various parts of the computing device, and realize data processing by running or executing instructions stored in the memory 402 and calling data stored in the memory 402. Optionally, the processor 401 may include one or more processing units, and the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes the issuance of instructions. It is understandable that the above-mentioned modem processor may not be integrated into the processor 401. In some embodiments, the processor 401 and the memory 402 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0105] The processor 401 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the IP information query method may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0106] The memory 402 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 402 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 402 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 402 in the embodiment of the present invention can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0107] Based on the same technical concept, an embodiment of the present invention also provides a computer-readable storage medium, which stores a computer program executable by a computing device. When the program runs on the computing device, the computing device executes the steps of the above-mentioned IP information query method.

[0108] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0109] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0110] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0111] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0112] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0113] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of this application and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for querying IP information, characterized in that: include: When an IP information query request for any network protocol IP address is detected, determining the corresponding IP address from the IP information query request; According to the set mask bit, the IP address is segmented bit by bit to determine the first IP character string; Determine whether the first IP string exists in the first cascade IP record; If so, when it is determined that there is no IP information associated with the first IP string in the first cascade IP record, the IP address is matched with each IP address in the second cascade IP record, and the IP information corresponding to the IP address is determined when the match is successful; the first cascade IP record stores the second string corresponding to at least one IP address with the whole IP segment attribute and the corresponding IP information in the form of a key-value pair, and the second cascade IP record stores the IP address without the whole IP segment attribute and the corresponding IP information in the form of a key-value pair.

2. The method according to claim 1, characterized in that The method further comprises: When it is determined that the first cascade IP record contains IP information associated with the first IP character string, the IP information is determined to be the IP information corresponding to the IP address.

3. The method according to claim 1, characterized in that The first cascade IP record is used to indicate a first-level query for an IP address; the second cascade IP record is used to indicate a second-level query for an IP address; the second-level query is a hierarchical query of the first-level query.

4. The method according to claim 1, characterized in that The step of performing bit-wise segmentation processing on the IP address according to the set mask bit to determine the first IP character string includes: According to the set mask bits, the IP address is bit-segmented in a preset direction to obtain the first IP character string that conforms to the set mask bits; wherein the preset direction is from left to right or from right to left.

5. The method according to claim 4, characterized in that The bitwise segmentation process of the IP address in a preset direction to obtain the first IP character string that conforms to the set mask bit includes: If the set mask bit is 24, the IP address is segmented bit by bit from left to right to obtain the first IP string consisting of segments A, B and C of the IP address; or segment D of the IP address is segmented bit by bit from right to left to obtain the first IP string consisting of segments A, B and C of the IP address; If the set mask bit is 16, the IP address is bit-segmented from left to right to obtain the first IP character string consisting of segment A and segment B of the IP address; or, segment C and segment D of the IP address are bit-segmented from right to left to obtain the first IP character string consisting of segment A and segment B of the IP address.

6. The method according to claim 3, characterized in that The first cascade IP record and the second cascade IP record are determined in the following manner: Obtain from the IP attribution database each IP address with the whole IP segment attribute, each IP information corresponding to each IP address with the whole IP segment attribute, and each IP address without the whole IP segment attribute, each IP information corresponding to each IP address without the whole IP segment attribute; According to the set mask bit, each IP address with the whole IP segment attribute and each IP address without the whole IP segment attribute are respectively subjected to bit segmentation processing to obtain each second IP character string corresponding to each IP address with the whole IP segment attribute and each second IP character string corresponding to each IP address without the whole IP segment attribute; The second IP character strings corresponding to the IP addresses with the whole IP segment attribute, the IP information corresponding to the IP addresses with the whole IP segment attribute, and the second IP character strings corresponding to the IP addresses without the whole IP segment attribute are stored in the first cascade IP record, and the IP addresses without the whole IP segment attribute and the IP information corresponding to the IP addresses without the whole IP segment attribute are stored in the second cascade IP record.

7. The method according to claim 6, characterized in that Determining whether the first IP string exists in the first cascade IP record includes: The first IP string is matched with each second IP string in the first cascade IP record in sequence through a preset matching method, so as to determine whether the first IP string exists in the first cascade IP record.

8. An IP information query device, characterized in that: include: A detection unit, configured to, when an IP information query request for any network protocol IP address is detected, determine a corresponding IP address from the IP information query request; A processing unit is used to perform bit-wise segmentation processing on the IP address according to the set mask bits to determine the first IP string; determine whether the first IP string exists in the first cascade IP record; if so, when it is determined that the IP information associated with the first IP string does not exist in the first cascade IP record, match the IP address with each IP address in the second cascade IP record, and determine the IP information corresponding to the IP address when the match is successful; the first cascade IP record stores a second string corresponding to at least one IP address with a whole IP segment attribute and corresponding IP information in the form of a key-value pair, and the second cascade IP record stores an IP address without a whole IP segment attribute and corresponding IP information in the form of a key-value pair.

9. A computing device, characterized in that The method comprises at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: It stores a computer program executable by a computing device, and when the program is run on the computing device, the computing device executes the method according to any one of claims 1 to 7.

Images