A memory data operation method, device and computer readable storage medium

By using a combination of high-concurrency hash mapping and doubly linked lists on the client side, the problem of high file I/O consumption in client-side memory data operations is solved, enabling more efficient memory data operations and improving the processing speed of the proactive defense system.

CN115391402BActive Publication Date: 2026-02-10QI AN XIN TECHNOLOGY GROUP INC +1
View PDF 1 Cites 0 Cited by

Patent Information

Application Number
CN202211032429.X
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2022-08-26
Publication Date
2026-02-10
Estimated Expiration
2042-08-26

AI Technical Summary

Technical Problem

Existing technologies suffer from high file I/O consumption and are unsuitable for client-side memory data operations, failing to meet the matching speed requirements of rule engines, or are only applicable to the server side.

Method used

A combination of high-concurrency hash mapping and doubly linked lists is used. Particle lock mechanism is used to reduce competition between multiple threads and the latest data is stored in the doubly linked list to improve cache hit rate.

Benefits of technology

This reduces memory data operation contention between multiple threads, improves cache hit rate, and thus enhances the overall event processing speed of the proactive defense system.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN115391402B_ABST
    Figure CN115391402B_ABST
Patent Text Reader

Abstract

The application relates to a memory data operation method, device and computer readable storage medium. The method comprises the following steps: when a memory data operation request is received, performing corresponding operation on a high-concurrency hash mapping corresponding to a client memory; if the corresponding operation on the high-concurrency hash mapping corresponding to the client memory is successful, acquiring a linked list lock of a bidirectional linked list corresponding to the high-concurrency hash mapping, wherein a head node of the bidirectional linked list is used for storing the latest data, and the linked list lock is used for locking the operation on the bidirectional linked list; if the linked list lock of the bidirectional linked list is successfully acquired, performing an operation corresponding to the client memory data operation request on the bidirectional linked list; and releasing the linked list lock of the bidirectional linked list after the operation corresponding to the client memory data operation request on the bidirectional linked list is completed. The technical scheme can realize the fast operation of the memory data on the client.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] This application relates to the field of computer network security, and in particular to a method, apparatus and computer-readable storage medium for memory data manipulation. Background Technology

[0002] In the field of computer network security, for each synchronization event reported by the terminal driver layer, the proactive defense client rule engine needs to extract the corresponding feature information from the relevant files of that synchronization event. Processing each event generates at least one file input / output (I / O), inevitably leading to resource consumption. To reduce file I / O and improve the matching speed of the rule engine, the feature information extracted from the relevant files of the synchronization event can be cached in memory. When the feature information of that file is needed again, it can be retrieved from memory. This involves memory data operation methods, such as querying from memory, adding to memory, and deleting data from memory. Related technologies either use SQLite or LevelDB to implement memory data operations, or Redis or Memcached. However, using SQLite or LevelDB for memory data operations still involves file I / O, which cannot meet the rule engine's requirements for matching speed. Using Redis or Memcached for memory data operations is actually only suitable for the server side, not the client side. Summary of the Invention

[0003] To address or partially address the problems existing in related technologies, this application provides a memory data operation method, device, and computer-readable storage medium, which enables fast memory data operation on the client side.

[0004] The first aspect of this application provides a method for memory data manipulation, including:

[0005] When a memory data operation request is received, the corresponding operation is performed on the high-concurrency hash mapping corresponding to the client's memory.

[0006] If the operation on the high-concurrency hash map corresponding to the memory is successful, the list lock of the doubly linked list corresponding to the high-concurrency hash map is acquired. The head node of the doubly linked list is used to store the latest data, and the list lock is used to lock the operation on the doubly linked list.

[0007] If the lock of the doubly linked list is successfully acquired, then the operation corresponding to the memory data operation request is performed on the doubly linked list.

[0008] After the operation corresponding to the memory data operation request is completed on the doubly linked list, the list lock of the doubly linked list is released.

[0009] A second aspect of this application provides a memory data manipulation apparatus, comprising:

[0010] The first operation module is used to perform corresponding operations on the high-concurrency hash mapping corresponding to the client memory when a memory data operation request is received.

[0011] The acquisition module is used to acquire the list lock of the doubly linked list corresponding to the high-concurrency hash map if the corresponding operation on the high-concurrency hash map corresponding to the memory is successful. The head node of the doubly linked list is used to store the latest data, and the list lock is used to lock the operation on the doubly linked list.

[0012] The second operation module is used to perform an operation on the doubly linked list corresponding to the memory data operation request if the list lock of the doubly linked list is successfully acquired.

[0013] The release module is used to release the list lock of the doubly linked list after the operation corresponding to the memory data operation request is completed on the doubly linked list.

[0014] A third aspect of this application provides an electronic device, comprising:

[0015] Processor; and

[0016] A memory that stores executable code, which, when executed by the processor, causes the processor to perform the method described above.

[0017] A fourth aspect of this application provides a computer-readable storage medium having executable code stored thereon, which, when executed by a processor of an electronic device, causes the processor to perform the method described above.

[0018] The technical solution provided in this application can include the following beneficial effects: Unlike related technologies that still involve file I / O when caching data or are only applicable to the server side, the high-concurrency hash mapping in this application adopts mechanisms such as particle locks, which can perform corresponding operations on the high-concurrency hash mapping corresponding to the client memory, and works in conjunction with the doubly linked list corresponding to the high-concurrency hash mapping. On the one hand, due to the adoption of a lock contention mitigation mechanism, the competition for data operations in memory cache between multiple threads is reduced; on the other hand, the head node of the doubly linked list corresponding to the high-concurrency hash mapping stores the latest data, ensuring that the data cached in memory is hot data, which can improve the cache hit rate, thereby improving the overall processing speed of proactive defense for events.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0020] The above and other objects, features and advantages of this application will become more apparent from the more detailed description of exemplary embodiments thereof in conjunction with the accompanying drawings, wherein the same reference numerals generally represent the same components in the exemplary embodiments thereof.

[0021] Figure 1 A flowchart illustrating the application scenario of the memory data manipulation method in this application;

[0022] Figure 2 This is a schematic flowchart illustrating a memory data operation method according to an embodiment of this application;

[0023] Figure 3 This is a flowchart illustrating the memory data operation method when a memory data operation request is made to query data cached in the client's memory, as shown in an embodiment of this application.

[0024] Figure 4 This is a flowchart illustrating the memory data operation method when a memory data operation request is made to add target data to the client's memory, as shown in the embodiments of this application.

[0025] Figure 5 This is a flowchart illustrating the memory data operation method when a memory data operation request is made to delete target data from the client's memory, as shown in the embodiments of this application.

[0026] Figure 6 This is a schematic diagram of the structure of the memory data manipulation device shown in the embodiments of this application;

[0027] Figure 7 This is a schematic diagram of the structure of an electronic device shown in an embodiment of this application. Detailed Implementation

[0028] Embodiments of this application will now be described in more detail with reference to the accompanying drawings. While embodiments of this application are shown in the drawings, it should be understood that this application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to make this application more thorough and complete, and to fully convey the scope of this application to those skilled in the art.

[0029] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0030] It should be understood that although the terms "first," "second," "third," etc., may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0031] In the field of computer network security, for each synchronization event reported by the terminal driver layer, the proactive defense client rule engine needs to extract the corresponding feature information from the relevant files of that synchronization event. Processing each event generates at least one file input / output (I / O), inevitably leading to resource consumption. To reduce file I / O and improve the matching speed of the rule engine, the feature information extracted from the relevant files of the synchronization event can be cached in memory. When the feature information of that file is needed again, it can be retrieved from memory. This involves memory data operation methods, such as querying from memory, adding to memory, and deleting data from memory. Related technologies either use SQLite or LevelDB to implement memory data operations, or Redis or Memcached. However, using SQLite or LevelDB for memory data operations still involves file I / O, which cannot meet the rule engine's requirements for matching speed. Using Redis or Memcached for memory data operations is actually only suitable for the server side, not the client side.

[0032] To address the aforementioned issues, this application provides a memory data operation method that enables fast memory data operations on the client side.

[0033] The technical solutions of the embodiments of this application are described in detail below with reference to the accompanying drawings.

[0034] See Figure 1This is an application scenario for the memory data manipulation method of this application, which can be specifically applied to proactive defense systems or products. When the terminal's driver layer detects events such as process creation and process loading of dynamic libraries, it synchronously throws these events to the client rule engine of the proactive defense system. The rule engine extracts the corresponding feature information from the relevant files of these events and makes a decision on whether to block or allow the event. After obtaining the decision result, the driver layer chooses to block or allow the event. As can be seen from the above description, the client rule engine generates one file I / O operation for each event thrown by the driver layer, and file I / O consumes a lot of system resources. In order to reduce or avoid the resource consumption due to file I / O, the rule engine can cache the feature information extracted from the event in a segment of memory. When the next event thrown by the driver layer is received, it only needs to check the cached feature information in memory to make a decision on whether to allow or block the event, without having to extract the corresponding feature information from the relevant files of these events again. The aforementioned feature information that goes to the memory matching cache involves operations on memory data, such as querying, adding, and deleting. The results of these operations on memory data determine the efficiency of the rule engine's matching, which in turn determines the overall processing speed of proactive defense for events.

[0035] Please see Figure 2 This is a flowchart illustrating a memory data operation method according to an embodiment of this application. The method mainly includes steps S201 to S204, as described below:

[0036] Step S201: When a memory data operation request is received, perform the corresponding operation on the high-concurrency hash mapping corresponding to the client memory.

[0037] Based on the aforementioned description of the application scenario of the technical solution of this application, the memory data operation request here can be a request from the rule engine of the proactive defense system to perform some operation on the data cached in memory, such as a request to query, add, or delete data. In the embodiments of this application, the high-concurrency hash map (ConcurrentHashMap) is based on the hash map (HashMap), which divides the data into multiple segments, and then locks one segment for each operation, reducing the probability of multi-threaded lock contention and improving concurrency efficiency. As for HashMap, its essence is an array plus a linked list. The hash value can be obtained according to the key, and then the array index can be calculated. If multiple keys correspond to the same index, they are linked together using a linked list, and the newly inserted data is placed at the front. The hash table involved in the above-mentioned HashMap or ConcurrentHashMap mainly stores three kinds of information: 1) the key corresponding to the data cached in memory; 2) the data cached in memory; 3) the address of the key corresponding to the data cached in memory in the doubly linked list, where the data cached in memory can be feature information extracted from events thrown from the driver layer. Since hash tables are essentially still based on key-value (kv) storage, the data cached in memory is actually the value corresponding to the key in the cached data. In this embodiment, the doubly linked list corresponds to a high-concurrency hash map, and each node of the doubly linked list represents the key corresponding to the data cached in memory.

[0038] As one embodiment of this application, a memory data operation request can be to query data cached in the client's memory. Performing a corresponding operation on the high-concurrency hash map corresponding to the client's memory can be: querying whether the hash map corresponding to the client's memory contains target data corresponding to the key of the key-value pair; if the hash map corresponding to the client's memory contains target data corresponding to the key of the key-value pair, then the query operation on the hash map corresponding to the memory is confirmed to be successful. Whether the hash map contains target data corresponding to the key of the key-value pair is equivalent to whether there is data in memory corresponding to the key of the key-value pair, i.e., the value corresponding to the key.

[0039] In another embodiment of this application, a memory data operation request can be a request to add target data to the client memory. Performing a corresponding operation on the high-concurrency hash map corresponding to the client memory can be: inserting the target data into the hash map corresponding to the client memory. Since the client memory corresponds to a hash map, inserting the target data into the hash map corresponding to the client memory is equivalent to adding the target data to the client memory. Its application scenario could be that the rule engine misses the cache, that is, it does not find the feature information corresponding to the event thrown by the driver layer in the client memory. Therefore, it extracts the corresponding feature information from the event-related file and adds it to the client memory so that the corresponding feature information can be queried from the client memory the next time the driver layer throws an event.

[0040] In another embodiment of this application, a memory data operation request may be to delete target data from client memory. The corresponding operation on the high-concurrency hash map corresponding to the client memory may be: querying the hash map corresponding to the client memory using key-value pairs to see if the target data corresponding to the key of the key-value pair exists; if the hash map corresponding to the client memory contains the target data corresponding to the key of the key-value pair, then deleting the target data corresponding to the key of the key-value pair from the hash map. The application scenario of the above embodiment is that an event-related file thrown by the driver layer changes, and in order to maintain the latest feature information in the client memory, the previously cached feature information corresponding to the event is deleted from the client memory.

[0041] Step S202: If the operation on the high-concurrency hash map corresponding to memory is successful, the list lock of the doubly linked list corresponding to the high-concurrency hash map is acquired. The head node of the doubly linked list is used to store the latest data, and the list lock is used to lock the operation on the doubly linked list.

[0042] A doubly linked list is a linked list that can be operated on at both the head and other positions. For example, adding a node to the head, deleting a node, or moving a node to the head. In this embodiment, each node in the doubly linked list represents a key corresponding to data cached in memory. The head node stores the latest data, which includes new nodes added directly to the head node, or nodes moved from any position in the doubly linked list to the new head node. Since the head node of a doubly linked list always stores the latest data, the least recently used data is always evicted from memory, while the most frequently used data is retained. This improves the cache hit rate during proactive defense, thereby increasing the speed of event handling. The linked list lock is used to lock operations on the doubly linked list. Once a thread acquires the lock, only that thread can operate on the doubly linked list; other threads cannot. This protects the node data in the doubly linked list, making operations on it safer.

[0043] When a memory data operation request involves querying data cached in the client's memory, as an embodiment of this application, acquiring the list lock of the doubly linked list corresponding to the high-concurrency hash map can be done by acquiring a non-exclusive lock of the doubly linked list. Here, a non-exclusive lock is a type of list lock relative to an exclusive lock. An exclusive lock can be understood as a list lock that requires waiting; in other words, after a thread has already acquired such a list lock, other threads that need to operate on the doubly linked list must wait for the first thread to release the list lock, i.e., the exclusive lock. The non-exclusive lock, on the other hand, operates on the opposite mechanism. It is a so-called "try-to-lock" mechanism, meaning that after other threads have already acquired a non-exclusive lock, when a thread needs to operate on the doubly linked list, it can attempt to acquire the right to use the non-exclusive lock. If it cannot acquire the right to use the non-exclusive lock (i.e., the non-exclusive lock has not been released), it abandons the attempt to acquire the right to use the non-exclusive lock and directly returns the queried target data. Since the right to acquire a non-exclusive lock is given up, it is equivalent to not operating on the doubly linked list. Although the accuracy of eviction of client memory data is sacrificed, the mutual waiting when multiple threads query client memory data is avoided, thus improving query performance.

[0044] In one embodiment of this application, when a memory data operation request is to add target data to the client's memory, if the operation on the high-concurrency hash map corresponding to the memory is successful, acquiring the lock on the doubly linked list corresponding to the high-concurrency hash map can be done as follows: if the addition operation on the hash map corresponding to the client's memory is successful, then an exclusive lock on the doubly linked list is acquired. As mentioned earlier, the data at the tail node of the doubly linked list corresponds to the coldest data cached in the client's memory. To maintain the freshness of the data cached in the client's memory, the coldest data must be evicted when the client's memory exceeds its capacity threshold. Therefore, if the addition operation on the high-concurrency hash map corresponding to the memory is successful, then when the client's memory exceeds its capacity threshold, an exclusive lock on the doubly linked list is acquired so that the tail node of the doubly linked list can be deleted, and then the node corresponding to the successfully added data from the hash map can be added to the head of the doubly linked list. After that, the exclusive lock on the doubly linked list is released. It should be noted that since a doubly linked list is a linked list that can be modified by different threads by inserting and / or deleting nodes, this also means that data security issues may arise. For example, thread Th1 inserts and / or deletes nodes in a doubly linked list, and thread Th2 performs the same operation. The nodes in the doubly linked list need to be consistent with the data in the corresponding high-concurrency hash map in memory. If different threads perform the same or different operations on the same doubly linked list, it will be impossible to ensure that the nodes remain consistent with the data in the corresponding high-concurrency hash map. Since an exclusive lock is a linked list lock that requires waiting, after successfully adding a node to the hash map in memory, the thread acquiring the exclusive lock adds the node corresponding to the target data to the head of the doubly linked list. Because other threads have not yet acquired the exclusive lock (according to the definition of an exclusive lock, it must wait to acquire it), they cannot perform node addition, deletion, or other modification operations on the doubly linked list. This ensures that the nodes in the doubly linked list remain consistent with the data in the corresponding high-concurrency hash map in memory, thus guaranteeing data security.

[0045] When the memory data operation request is to delete target data from the client's memory, as an embodiment of this application, acquiring the list lock of the doubly linked list corresponding to the high-concurrency hash map can be done by acquiring the exclusive lock of the doubly linked list corresponding to the high-concurrency hash map. The exclusive lock here is as described above, and will not be repeated here.

[0046] Step S203: If the lock of the doubly linked list is successfully acquired, then the operation corresponding to the memory data operation request is performed on the doubly linked list.

[0047] When a memory data operation request is to query data in the client's memory cache, as an embodiment of this application, if the lock of the doubly linked list is successfully acquired, the operation corresponding to the memory data operation request on the doubly linked list can be: if the non-exclusive lock of the doubly linked list is successfully acquired, the node corresponding to the target data is deleted from the doubly linked list, the node corresponding to the target data is inserted into the head of the doubly linked list, and the target data is returned; and / or if the non-exclusive lock of the doubly linked list is not successfully acquired, the target data is returned. In this embodiment of the application, the prerequisite for successfully acquiring the non-exclusive lock of the doubly linked list is that the query operation on the high-concurrency hash map corresponding to the client's memory has been successful, that is, the target data has been found in the hash map. According to the convention of the latest data in the head of the doubly linked list in the aforementioned embodiment, if the target data is found in the hash map, then the target data becomes the hot data in the client's memory cache. Therefore, the node corresponding to the target data should be moved to the head of the doubly linked list, that is, the node corresponding to the target data is inserted into the head of the doubly linked list, and this node becomes the new head of the doubly linked list. Of course, before inserting the head of the list, according to the rules of doubly linked lists, the node corresponding to the target data found in the hash map needs to be deleted from the doubly linked list. If the non-exclusive lock of the doubly linked list is not successfully acquired, the target data is returned directly.

[0048] In one embodiment of this application, when a memory data operation request is to add target data to the client's memory, if the lock of the doubly linked list is successfully acquired, the operation corresponding to the memory data operation request can be performed on the doubly linked list as follows: if the exclusive lock of the doubly linked list is successfully acquired, the node corresponding to the target data is added to the head of the doubly linked list. Similar to the prerequisite for successfully acquiring the non-exclusive lock of the doubly linked list being a successful query operation on the hash map corresponding to the client's memory, the prerequisite for successfully acquiring the exclusive lock of the doubly linked list here is a successful operation to add target data to the hash map corresponding to the client's memory. According to the aforementioned embodiment's convention regarding the latest data at the head of the doubly linked list, after the target data is added to the hash map, this target data becomes hot data in the client's memory cache. Therefore, the node corresponding to the target data successfully added to the hash map should be added to the head of the doubly linked list; that is, the node corresponding to the target data is inserted into the head of the doubly linked list, and this node becomes the new head of the doubly linked list. The reason why this embodiment needs to obtain an exclusive lock for the doubly linked list is similar to the reason why the aforementioned embodiment needs to obtain an exclusive lock when adding nodes to the doubly linked list. Please refer to the relevant descriptions in the aforementioned embodiments, which will not be repeated here.

[0049] When a memory data operation request is to delete target data from the client's memory, as an embodiment of this application, performing the operation corresponding to the memory data operation request on the doubly linked list can be: deleting the node in the doubly linked list corresponding to the target data deleted from the high-concurrency hash map.

[0050] Step S204: After the operation corresponding to the memory data operation request is completed, release the list lock of the doubly linked list.

[0051] After the operation corresponding to the memory data operation request is completed, the lock of the doubly linked list is released. This release allows other threads to acquire the right to use the doubly linked list lock. Specifically, for an embodiment where the memory data operation request is to query data cached in the client's memory, releasing the doubly linked list lock after the operation corresponding to the memory data operation request is completed can be done after inserting the node corresponding to the queried target data into the head of the doubly linked list. For an embodiment where the memory data operation request is to add target data to the client's memory, releasing the doubly linked list lock after the operation corresponding to the memory data operation request is completed can be done after successfully adding the target data to the high-concurrency hash map. For an embodiment where the memory data operation request is to delete target data from the client's memory, releasing the doubly linked list lock after the operation corresponding to the memory data operation request is completed can be done after deleting the node in the doubly linked list corresponding to the target data deleted from the high-concurrency hash map.

[0052] Furthermore, it should be noted that, to further reduce competition for memory data operations among multiple threads, such as reducing contention for linked list locks, in the above embodiments of this application, the cached data in the client memory can be distributed and cached across multiple memory locations based on the key-value pairs of the data cached in the client memory. Specifically, based on the key-value pairs of the cached data in the client memory, a hash value corresponding to the key is calculated. This hash value is then modulo the number of client memory locations. The result of the modulo operation is the value corresponding to the key, which is the identifier of the target memory where the cached data in the client memory should be cached. The value corresponding to the key is then stored in the memory location corresponding to this identifier. Since the cached data in the client memory is distributed and stored across multiple memory locations, each memory location corresponds to a doubly linked list and a linked list lock. When subsequent operations are needed on the doubly linked list, it is equivalent to multiple threads competing for a single linked list lock instead of multiple threads competing for multiple linked list locks, greatly increasing the probability of a thread acquiring the right to use the linked list lock.

[0053] To more clearly illustrate the technical solution of this application, the following descriptions will be based on three examples: a memory data operation request for querying data cached in the client's memory, a memory data operation request for adding target data to the client's memory, and a memory data operation request for deleting target data from the client's memory.

[0054] Please see Figure 3 This describes the flow of memory data operation methods when a memory data operation request is made to query data cached in the client's memory. It mainly includes steps S301 to S308, which are explained in detail below:

[0055] Step S301: Query the hash mapping corresponding to the client memory.

[0056] You can query whether the hash mapping corresponding to the key-value pair exists in the client memory using the key of the key-value pair. The target data here is feature information extracted from event-related files thrown from the driver layer or feature information stored when operating on the client memory before.

[0057] Step S302: Does the target data exist that corresponds to the key of the key-value pair?

[0058] If the hash mapping in the client's memory contains the target data corresponding to the key of the key-value pair, the process proceeds to step S303; otherwise, the process ends directly, and the query fails or returns empty data.

[0059] Step S303: Acquire the non-exclusive lock for the doubly linked list.

[0060] As mentioned earlier, the mechanism for using non-exclusive locks is the so-called try-to-lock mechanism. Here, acquiring a non-exclusive lock on a doubly linked list means attempting to acquire the lock of the doubly linked list.

[0061] Step S304: Is the non-exclusive lock of the doubly linked list occupied?

[0062] If the non-exclusive lock of the doubly linked list is occupied at this time, the process proceeds to step S308; otherwise, the process proceeds to step 305.

[0063] Step S305: Delete the node corresponding to the target data from the doubly linked list.

[0064] As mentioned earlier, hash maps primarily store three types of information: 1) the key corresponding to the data cached in memory; 2) the data cached in memory; and 3) the address of the key corresponding to the data cached in memory within a doubly linked list. The nodes of the doubly linked list represent or store the key corresponding to the data cached in memory. The data cached in memory is feature information extracted from event-related files thrown by the driver layer or feature information stored during previous operations on client memory. Since the hash map corresponding to client memory contains target data corresponding to the key-value pair, meaning the target data corresponding to the key-value pair was successfully retrieved from the hash map corresponding to client memory, this target data becomes hot data in the memory cache. Because it is hot data, its corresponding key, i.e., the node in the doubly linked list, should be placed at the head of the doubly linked list. However, before doing so, this node must be deleted from the doubly linked list.

[0065] Step S306: Insert the node corresponding to the target data into the head of the doubly linked list.

[0066] The node corresponding to the target data is the same node that was deleted from the doubly linked list in step S305. After this node is inserted into the head of the doubly linked list, it becomes the new head of the doubly linked list.

[0067] Step S307: Release the non-exclusive lock on the doubly linked list.

[0068] Inserting the node corresponding to the target data into the head of the doubly linked list signifies the completion of the operation on the doubly linked list. The non-exclusive lock of the doubly linked list is then released so that it can be given to other threads.

[0069] Step S308: Return the target data.

[0070] The returned target data is the feature information successfully retrieved from the client's memory.

[0071] Please see Figure 4 This is the flow of the memory data operation method when a memory data operation request requests the addition of target data to the client's memory. It mainly includes steps S401 to S411, which are described in detail below:

[0072] Step S401: Insert the target data into the hash map corresponding to the client memory.

[0073] The target data inserted into the hash map is feature information extracted from event-related files thrown from the driver layer.

[0074] Step S402: Was the target data successfully inserted?

[0075] If the insertion is successful, proceed to step S403; otherwise, end the process directly.

[0076] Step S403: Mark whether the client memory exceeds the capacity threshold.

[0077] It should be noted that, in this embodiment, since the client memory corresponds to the hash map, and the hash map corresponds to the doubly linked list, the result of each operation on the hash map or the doubly linked list will also be reflected in the changes in the data in the client memory. For example, adding data to the hash map means that the data in the client memory will also increase; similarly, deleting data from the hash map means that the data in the client memory will also decrease, and so on. Since the client memory capacity is limited, when target data is successfully inserted into the hash map, it can be marked whether the client memory exceeds the capacity threshold. This mark can exist as a variable and its value. In this embodiment, a Boolean variable A can be used to represent whether the client memory exceeds the capacity threshold. For example, when the value of variable A is logical "0", it means that the client memory has not exceeded the capacity threshold; when the value of variable A is logical "1", it means that the client memory exceeds the capacity threshold. Then, the above value of variable A is saved to memory, and subsequently, only the value of variable A needs to be checked to determine whether the client memory exceeds the capacity threshold. Afterwards, the process proceeds to step S404.

[0078] Step S404: Obtain the exclusive lock for the doubly linked list.

[0079] Acquiring an exclusive lock for a doubly linked list is to gain the right to operate on the doubly linked list.

[0080] Step S405: Does the client memory exceed the capacity threshold?

[0081] As mentioned earlier, in step S403, the client memory was marked as exceeding the capacity threshold. Therefore, step S405 determines whether the client memory exceeds the capacity threshold by directly checking the marker. For example, if the aforementioned variable A's value of logical "1" indicates that the client memory exceeds the capacity threshold, and a value of logical "0" indicates that the client memory does not exceed the capacity threshold, then if the value of variable A in memory is found to be logical "1", it indicates that the client memory exceeds the capacity threshold, and the process proceeds to step S406. If the value of variable A in memory is found to be logical "0", it indicates that the client memory does not exceed the capacity threshold, and the process proceeds to step S407.

[0082] Step S406: Delete the tail node of the doubly linked list.

[0083] Since the tail node of the doubly linked list corresponds to the coldest data in the hash map or client memory cache, in order to maintain the hot data in the hash map or client memory cache, the tail node of the doubly linked list is deleted when the client memory exceeds the capacity threshold, that is, the coldest data in the hash map or client memory cache is deleted.

[0084] Step S407: Add the node corresponding to the target data to the head of the doubly linked list.

[0085] When the client memory does not exceed the capacity threshold, nodes can still be inserted into the doubly linked list. Therefore, the node corresponding to the target data of the successfully inserted hash map can be added to the head of the doubly linked list, and this node becomes the new head of the doubly linked list.

[0086] Step S408: Release the exclusive lock on the doubly linked list.

[0087] Deleting the tail node of a doubly linked list and adding a new head node signifies the completion of operations on the doubly linked list. Releasing the exclusive lock on the doubly linked list allows the lock resource to be released to other threads.

[0088] Step S409: Does the client memory exceed the capacity threshold?

[0089] If the client's memory exceeds the capacity threshold, the process proceeds to step S410, which deletes the data corresponding to the tail node of the doubly linked list from the hash map; otherwise, the process terminates directly. The technical solution for determining whether the client's memory exceeds the capacity threshold is the same as the solution used in step S405 above, and can be found in the aforementioned explanation; it will not be repeated here.

[0090] Step S410: Delete the data corresponding to the tail node of the doubly linked list from the hash map.

[0091] The process can be terminated after deleting the data corresponding to the tail node of the doubly linked list from the hash map.

[0092] In step S406, the tail node is deleted from the doubly linked list. Here, the data corresponding to the tail node of the doubly linked list deleted from the hash map refers to the data deleted from the hash map that corresponds to the tail node deleted from the doubly linked list in step S406.

[0093] Please see Figure 5 This is the flow of the memory data operation method when a memory data operation request is made to delete target data from the client's memory. It mainly includes steps S501 to S506, which are described in detail below:

[0094] Step S501: Query the hash mapping corresponding to the client memory.

[0095] You can query whether the hash map in the client's memory contains the target data corresponding to the key of the key-value pair. The target data here is the feature information that should be deleted from the hash map in the client's memory.

[0096] Step S502: Does the hash map contain the target data?

[0097] The target data here is the feature information that should be deleted from the hash map corresponding to the client's memory. If it exists, the process proceeds to step S503; otherwise, the process ends directly.

[0098] Step S503: Obtain the exclusive lock for the doubly linked list.

[0099] Step S504: Delete the node corresponding to the target data from the doubly linked list.

[0100] Step S505: Release the exclusive lock on the doubly linked list.

[0101] Deleting the node corresponding to the target data from the doubly linked list means that the operation on the doubly linked list is complete, and the exclusive lock of the doubly linked list is released, allowing the lock resource to be given to other threads.

[0102] Step S506: Delete the target data from the hash map corresponding to the client memory.

[0103] From the above Figure 2 As can be seen from the example of memory data operation methods, unlike related technologies that still involve file I / O when caching data or are only applicable to the server side, the high-concurrency hash mapping in this application employs mechanisms such as particle locks to perform corresponding operations on the high-concurrency hash mapping corresponding to the client memory, and works in conjunction with the doubly linked list corresponding to the high-concurrency hash mapping. On the one hand, by adopting a lock contention mitigation mechanism, the competition for data operations in memory cache among multiple threads is reduced; on the other hand, the head node of the doubly linked list corresponding to the high-concurrency hash mapping stores the latest data, ensuring that the data cached in memory is hot data, which can improve the cache hit rate, thereby improving the overall processing speed of proactive defense for events.

[0104] Corresponding to the aforementioned application function implementation method embodiments, this application also provides a memory data operation device, an electronic device, and corresponding embodiments.

[0105] See Figure 6 This is a schematic diagram of the memory data manipulation device shown in an embodiment of this application. For ease of explanation, only the parts related to the embodiments of this application are shown. Figure 6 The example memory data manipulation device mainly includes a first operation module 601, an acquisition module 602, a second operation module 603, and a release module 604, wherein:

[0106] The first operation module 601 is used to perform corresponding operations on the high-concurrency hash mapping corresponding to the client memory when a memory data operation request is received.

[0107] The acquisition module 602 is used to acquire the list lock of the doubly linked list corresponding to the high-concurrency hash map if the corresponding operation on the high-concurrency hash map corresponding to the client memory is successful. The head node of the doubly linked list is used to store the latest data, and the list lock is used to lock the operation on the doubly linked list.

[0108] The second operation module 603 is used to perform operations on the doubly linked list corresponding to the client's memory data operation request if the linked list lock of the doubly linked list is successfully acquired.

[0109] Release module 604 is used to release the lock of the doubly linked list after the operation corresponding to the client's memory data operation request is completed.

[0110] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated further here.

[0111] from Figure 6 As can be seen from the example memory data manipulation device, unlike related technologies that still involve file I / O when caching data or are only applicable to the server side, the technical solution of this application can perform corresponding operations on the high-concurrency hash map corresponding to the client memory, and cooperate with the doubly linked list corresponding to the high-concurrency hash map. On the one hand, due to the use of a locking mechanism, namely acquiring the list lock of the doubly linked list corresponding to the high-concurrency hash map, the competition for data operations in memory cache among multiple threads is reduced; on the other hand, the head node of the doubly linked list corresponding to the high-concurrency hash map stores the latest data, so that the data cached in memory is hot data, which can improve the cache hit rate, thereby improving the overall processing speed of proactive defense for events.

[0112] Figure 7 This is a schematic diagram of the structure of an electronic device shown in an embodiment of this application.

[0113] See Figure 7 The electronic device 700 includes a memory 710 and a processor 720.

[0114] The processor 720 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0115] Memory 710 may include various types of storage units, such as system memory, read-only memory (ROM), and permanent storage devices. ROM may store static data or instructions required by the processor 720 or other modules of the computer. Permanent storage devices may be read-write storage devices. Permanent storage devices may be non-volatile storage devices that retain stored instructions and data even when the computer is powered off. In some embodiments, permanent storage devices use mass storage devices (e.g., magnetic or optical disks, flash memory) as permanent storage devices. In other embodiments, permanent storage devices may be removable storage devices (e.g., floppy disks, optical drives). System memory may be a read-write storage device or a volatile read-write storage device, such as dynamic random access memory. System memory may store some or all of the instructions and data required by the processor during operation. Furthermore, memory 710 may include any combination of computer-readable storage media, including various types of semiconductor memory chips (e.g., DRAM, SRAM, SDRAM, flash memory, programmable read-only memory), and disks and / or optical disks may also be used. In some embodiments, memory 710 may include a removable storage device that is readable and / or writable, such as a laser disc (CD), a read-only digital multifunction optical disc (e.g., DVD-ROM, dual-layer DVD-ROM), a read-only Blu-ray disc, a high-density optical disc, a flash memory card (e.g., SD card, mini SD card, Micro-SD card, etc.), a magnetic floppy disk, etc. Computer-readable storage media do not contain carrier waves or transient electronic signals transmitted wirelessly or via wired connections.

[0116] The memory 710 stores executable code, which, when processed by the processor 720, can cause the processor 720 to execute part or all of the methods described above.

[0117] Furthermore, the method according to this application can also be implemented as a computer program or computer program product, which includes computer program code instructions for performing some or all of the steps in the method described above.

[0118] Alternatively, this application may be implemented as a computer-readable storage medium (or a non-transitory machine-readable storage medium or a machine-readable storage medium) storing executable code (or computer program or computer instruction code) thereon, which, when executed by a processor of an electronic device (or server, etc.), causes the processor to perform part or all of the steps of the methods described above according to this application.

[0119] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for manipulating memory data, characterized in that, The method includes: When a memory data operation request is received, the corresponding operation is performed on the high-concurrency hash mapping corresponding to the client's memory. If the operation on the high-concurrency hash map corresponding to the memory is successful, the list lock of the doubly linked list corresponding to the high-concurrency hash map is acquired. The head node of the doubly linked list is used to store the latest data, and the list lock is used to lock the operation on the doubly linked list. If the lock of the doubly linked list is successfully acquired, then the operation corresponding to the memory data operation request is performed on the doubly linked list. After the operation corresponding to the memory data operation request is completed on the doubly linked list, the list lock of the doubly linked list is released; When the memory data operation request is to query the data cached in the client memory, the lock of the doubly linked list corresponding to the high-concurrency hash map is acquired, which is to acquire the non-exclusive lock of the doubly linked list. When the memory data operation request is to add target data to the client memory, if the corresponding operation on the high-concurrency hash map corresponding to the memory is successful, the lock of the doubly linked list corresponding to the high-concurrency hash map is acquired, which means that the exclusive lock of the doubly linked list corresponding to the high-concurrency hash map is acquired. When the memory data operation request is to delete target data from the client's memory, the lock of the doubly linked list corresponding to the high-concurrency hash map is acquired, which means that the exclusive lock of the doubly linked list corresponding to the high-concurrency hash map is acquired.

2. The memory data operation method according to claim 1, characterized in that, The memory data operation request includes querying data cached in the client memory, and the corresponding operation on the high-concurrency hash mapping corresponding to the client memory includes: By using key-value pairs, query whether the hash mapping corresponding to the client memory exists and whether the target data corresponds to the key of the key-value pair exists; If the hash map corresponding to the client memory contains target data corresponding to the key of the key-value pair, then the query operation on the hash map corresponding to the memory is confirmed to be successful.

3. The memory data operation method according to claim 2, characterized in that, The step of acquiring the list lock of the doubly linked list corresponding to the hash map includes: acquiring the non-exclusive lock of the doubly linked list.

4. The memory data operation method according to claim 3, characterized in that, If the lock of the doubly linked list is successfully acquired, the operation corresponding to the memory data operation request is performed on the doubly linked list, including: If the non-exclusive lock of the doubly linked list is successfully acquired, then the node corresponding to the target data is deleted from the doubly linked list, the node corresponding to the target data is inserted into the head of the doubly linked list, and the target data is returned; and / or If the non-exclusive lock of the doubly linked list is not successfully acquired, the target data is returned.

5. The memory data operation method according to claim 1, characterized in that, The memory data operation request includes a request to add target data to the client memory, and the corresponding operation on the high-concurrency hash map corresponding to the client memory includes: inserting the target data into the high-concurrency hash map corresponding to the client memory.

6. The memory data operation method according to claim 5, characterized in that, If the operation on the high-concurrency hash map corresponding to the memory is successful, then the lock on the doubly linked list corresponding to the high-concurrency hash map is acquired, including: If the addition operation to the hash map corresponding to the memory is successful, the exclusive lock of the doubly linked list is acquired.

7. The memory data operation method according to claim 6, characterized in that, If the lock of the doubly linked list is successfully acquired, the operation corresponding to the memory data operation request is performed on the doubly linked list, including: If the exclusive lock of the doubly linked list is successfully acquired, the node corresponding to the target data is added to the head of the doubly linked list.

8. The memory data operation method according to claim 1, characterized in that, The memory data operation request includes a request to delete target data from the client memory, and the corresponding operation on the high-concurrency hash mapping corresponding to the client memory includes: By using key-value pairs, query whether the hash mapping corresponding to the client memory exists and whether the target data corresponds to the key of the key-value pair exists; If the hash map corresponding to the client memory contains target data corresponding to the key of the key-value pair, then delete the target data corresponding to the key of the key-value pair from the hash map; The step of acquiring the list lock of the doubly linked list corresponding to the hash map includes: acquiring the exclusive lock of the doubly linked list corresponding to the hash map; The operation performed on the doubly linked list in accordance with the memory data operation request includes: deleting the node in the doubly linked list corresponding to the target data to be deleted from the high-concurrency hash map; Releasing the lock on the doubly linked list includes: releasing the exclusive lock on the doubly linked list.

9. The memory data operation method according to any one of claims 1 to 8, characterized in that, The method further includes: Based on the key values ​​of the data cached in memory, the data cached in memory is distributed and cached in multiple memory locations.

10. A memory data manipulation device, characterized in that, The device includes: The first operation module is used to perform corresponding operations on the high-concurrency hash mapping corresponding to the client memory when a memory data operation request is received. The acquisition module is used to acquire the list lock of the doubly linked list corresponding to the high-concurrency hash map if the corresponding operation on the high-concurrency hash map corresponding to the memory is successful. The head node of the doubly linked list is used to store the latest data, and the list lock is used to lock the operation on the doubly linked list. The second operation module is used to perform an operation on the doubly linked list corresponding to the memory data operation request if the list lock of the doubly linked list is successfully acquired. The release module is used to release the list lock of the doubly linked list after the operation corresponding to the memory data operation request is completed on the doubly linked list; When the memory data operation request is to query the data cached in the client memory, the lock of the doubly linked list corresponding to the high-concurrency hash map is acquired, which is to acquire the non-exclusive lock of the doubly linked list. When the memory data operation request is to add target data to the client memory, if the corresponding operation on the high-concurrency hash map corresponding to the memory is successful, the lock of the doubly linked list corresponding to the high-concurrency hash map is acquired, which means that the exclusive lock of the doubly linked list corresponding to the high-concurrency hash map is acquired. When the memory data operation request is to delete target data from the client's memory, the lock of the doubly linked list corresponding to the high-concurrency hash map is acquired, which means that the exclusive lock of the doubly linked list corresponding to the high-concurrency hash map is acquired.

11. An electronic device, characterized in that, include: processor; as well as A memory having executable code stored thereon, which, when executed by the processor, causes the processor to perform the method as described in any one of claims 1 to 9.

12. A computer-readable storage medium having executable code stored thereon, which, when executed by a processor of an electronic device, causes the processor to perform the method as claimed in any one of claims 1 to 9.

Citation Information

Patent Citations

  • Linked list processing method and device

    CN110727675A