A multi-data stream security analysis method and device with dynamic index

Abstract

The application provides a kind of multi-data stream security analysis method and device with dynamic index.The method comprises: obtaining corresponding dynamic indexable expression chain based on the correlation analysis expression of multi-data stream;Dynamic indexable expression graph is obtained based on the dynamic indexable expression chain;Determine the dynamic expression path in the dynamic indexable expression graph based on the graph node in the dynamic indexable expression graph and the edge between graph nodes;Determine the index corresponding to the flow table based on the dynamic expression path, and perform network security analysis on the multi-data stream based on the index of the flow table.The multi-data stream security analysis method with dynamic index provided by the application can perform dynamic index analysis on multi-data stream correlation analysis expression, improve real-time multi-data stream correlation analysis performance, and improve the efficiency of multi-data stream security analysis and detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer processing, in particular to a multi-data flow security analysis method and device with dynamic index. In addition, it also relates to an electronic device, a non-transitory computer-readable storage medium and a computer program product. BACKGROUND

[0002] With the rapid development of Internet technology and the gradual deepening of digital transformation in various industries, people's life and work have been greatly facilitated. However, with the development of technology and the spread of knowledge, the number of network attack methods has also increased significantly, and various new attack methods have emerged in an endless stream. Multi-data flow network security analysis has brought great challenges and pressures to people.

[0003] In the prior art, when multi-data flow network security analysis processing is needed, all data flows are usually traversed to find the target data flow. This method has low efficiency in multi-data flow searching and network security analysis, which makes it difficult to quickly discover and handle potential security risks and attacks. Therefore, how to design a more efficient multi-data flow security processing method to improve the efficiency and accuracy of multi-data flow processing has become a difficult problem to be solved. SUMMARY

[0004] Therefore, the present application provides a multi-data flow security analysis method and device with dynamic index to solve the defects of high limitation of existing multi-data flow security processing scheme, thereby reducing the efficiency of network security analysis.

[0005] The present application provides a multi-data flow security analysis method with dynamic index, comprising:

[0006] Based on the correlation analysis expression of the multi-data flow to be analyzed, a corresponding dynamic indexable expression chain is obtained; wherein the dynamic indexable expression chain includes at least two dynamic indexable expressions, and the dynamic indexable expressions are associated through the same flow table identifier; the flow table stores data flow and the correlation between the data flow; the data of each data flow in the multi-data flow is network security behavior data;

[0007] Based on the dynamic indexable expression chain, a dynamic index expression graph is obtained; wherein the dynamic index expression graph includes multiple graph nodes and edges between the graph nodes; the graph nodes include dynamic indexable expressions corresponding to flow tables, and the edges include the correlation between the dynamic indexable expressions corresponding to the two connected graph nodes;

[0008] determine a dynamic expression path in the dynamic index expression graph based on the graph nodes in the dynamic index expression graph; determine an index corresponding to a flow table based on the dynamic expression path, and perform network security analysis on the multiple data streams based on the index of the flow table; the dynamic expression path comprises graph nodes with the same identifier of the flow table.

[0009] Further, the determining of the index corresponding to the flow table based on the dynamic expression path specifically comprises:

[0010] obtaining at least two dynamic expression paths in the dynamic expression path;

[0011] determining a shortest dynamic expression path in the at least two dynamic expression paths, and taking the shortest dynamic expression path as the index corresponding to the flow table.

[0012] Further, the determining of the dynamic expression path in the dynamic index expression graph based on the graph nodes in the dynamic index expression graph and edges between the graph nodes comprises:

[0013] traversing all graph nodes and edges in the dynamic index expression graph, in a case where a value of a current graph node field of a current dynamic expression path is empty, taking the value of the current graph node as the value of the current graph node field, adding one to a path node number in the current dynamic expression path, and adding the current graph node, an edge connected between the current graph node and a previous graph node of the current graph node, and the previous graph node in a path record stack; the current dynamic expression path is a path corresponding to a current flow table indicated by the current graph node;

[0014] in a case where the current path node number is equal to a flow table number, combining each current dynamic expression path to obtain the dynamic expression path corresponding to the current graph node.

[0015] Further, the method further comprises:

[0016] in a case where the current path node number is less than the flow table number and a value of the previous graph node field is not empty, traversing a neighbor node table corresponding to the current graph node, and taking a value of each neighbor graph node in the neighbor node table as a value of a neighbor graph node field of the current dynamic expression path; wherein the neighbor graph node comprises the previous graph node;

[0017] adding an edge connected between the current graph node and the neighbor graph node in the path record stack.

[0018] Further, the method further comprises: traversing elements in the dynamic index expression graph, and adding other graph nodes in each element except the current graph node to a neighbor node table corresponding to the current graph node.

[0019] Further, the network security analysis based on the flow table index of the multiple data streams specifically comprises:

[0020] Obtaining a flow table identifier of the multiple data streams, and obtaining a flow table corresponding to the flow table identifier of the multiple data streams;

[0021] Determining whether the flow table of the multiple data streams is an equivalent table; the equivalent table is a table satisfying an equivalent expression chain; the equivalent expression chain comprises an equivalent relationship between key names of at least three flow tables;

[0022] If the flow table of the multiple data streams is an equivalent table, performing associated calculation based on the flow table of the multiple data streams and a first table link list corresponding to the flow table of the multiple data streams to obtain an association result; the first table link list comprises at least one flow table having an equivalent relationship with the flow table of the multiple data streams in the equivalent expression chain;

[0023] Performing processing on the multiple data streams based on a preset network security analysis processing flow and the association result.

[0024] Further, the processing on the multiple data streams based on the preset network security analysis processing flow and the association result specifically comprises:

[0025] Based on a preset deletion processing flow, deleting to-be-deleted data streams corresponding to the association result, the to-be-deleted data streams comprising timeout data streams; and / or, based on a preset insertion processing flow, adding to-be-inserted data streams corresponding to the association result to a preset hit table; and / or, based on a preset update processing flow, performing update processing on to-be-updated data streams corresponding to the association result.

[0026] The application further provides a multiple data stream security analysis device with a dynamic index, comprising:

[0027] A dynamic indexable expression chain obtaining unit is configured to obtain a corresponding dynamic indexable expression chain based on an associated analysis expression of to-be-analyzed multiple data streams; wherein the dynamic indexable expression chain comprises at least two dynamic indexable expressions, and the dynamic indexable expressions are associated by an identifier of a same flow table; the flow table stores data streams and an association relationship between the data streams; and data of each data stream in the multiple data streams is network security behavior data.

[0028] The dynamic index expression graph obtaining unit is configured to obtain a dynamic index expression graph based on the dynamic indexable expression chain; the dynamic index expression graph comprises a plurality of graph nodes and edges between the graph nodes; the graph nodes comprise dynamic indexable expressions corresponding to flow tables, and the edges comprise association relationships of dynamic indexable expressions corresponding to two connected graph nodes;

[0029] The data analysis processing unit is configured to determine a dynamic expression path in the dynamic index expression graph based on the graph nodes and the edges between the graph nodes in the dynamic index expression graph, determine an index corresponding to a flow table based on the dynamic expression path, and perform network security analysis on the plurality of data streams based on the index of the flow table; the dynamic expression path comprises graph nodes with the same identifier of the flow table.

[0030] Further, the data analysis processing unit is specifically configured to:

[0031] obtain at least two dynamic expression paths in the dynamic expression path;

[0032] determine a shortest dynamic expression path in the at least two dynamic expression paths, and take the shortest dynamic expression path as the index corresponding to the flow table.

[0033] Further, the dynamic index expression graph obtaining unit is specifically configured to:

[0034] traverse the dynamic indexable expression chain to obtain the dynamic indexable expression;

[0035] determine a first expression of a first type of the dynamic indexable expression and a graph node of a first type corresponding to the first expression as a first element in the dynamic index expression graph; the first element is used to indicate a storage location of information of a flow table corresponding to the first expression;

[0036] determine a second expression of a second type of the dynamic indexable expression and a graph node of a second type corresponding to the second expression as a second element in the dynamic index expression graph; the second element is used to indicate a storage location of information of a flow table corresponding to the second expression;

[0037] obtain the dynamic index expression graph based on the first element and the second element.

[0038] Further, the data analysis processing unit is specifically configured to:

[0039] traversing all graph nodes and edges in the dynamic index expression graph, in a case that a value of a current graph node field of a current dynamic expression path is empty, taking the value of the current graph node as the value of the current graph node field, adding one to a number of path nodes in the current dynamic expression path, and adding the current graph node, an edge connecting the current graph node and a previous graph node of the current graph node, and the previous graph node in a path record stack; the current dynamic expression path is a path corresponding to a current flow table indicated by the current graph node;

[0040] in a case that the number of current path nodes is equal to the number of flow tables, combining each of the current dynamic expression paths to obtain the dynamic expression path corresponding to the current graph node.

[0041] Further, the apparatus further comprises:

[0042] a path record stack determination unit, configured to, in a case that the number of current path nodes is less than the number of flow tables and the value of the previous graph node field is not empty, traverse a neighbor node table corresponding to the current graph node, and take a value of each neighbor graph node in the neighbor node table as a value of a neighbor graph node field of the current dynamic expression path; wherein the neighbor graph node comprises the previous graph node; and add an edge connecting the current graph node and the neighbor graph node in the path record stack.

[0043] Further, the apparatus further comprises a node addition unit, configured to traverse elements in the dynamic index expression graph, and add each of the elements except the current graph node to a neighbor node table corresponding to the current graph node.

[0044] Further, the data analysis processing unit is specifically configured to:

[0045] obtain flow table identifiers of the multiple data streams, and obtain flow tables of the multiple data streams corresponding to the flow table identifiers;

[0046] determine whether the flow tables of the multiple data streams are equivalent tables; the equivalent tables are tables satisfying an equivalent expression chain; the equivalent expression chain comprises equivalent relationships between key names of at least three flow tables;

[0047] if the flow tables of the multiple data streams are equivalent tables, perform association calculation based on the flow tables of the multiple data streams and a first table link list corresponding to the flow tables of the multiple data streams to obtain an association result; the first table link list comprises at least one flow table having an equivalent relationship with the flow tables of the multiple data streams in the equivalent expression chain;

[0048] perform processing on the multiple data streams based on a preset network security analysis processing flow and the association result.

[0049] Further, the multiple data streams are processed based on the preset network security analysis processing flow and the association result, and the processing specifically includes:

[0050] Based on a preset deletion processing flow, a to-be-deleted data stream corresponding to the association result is deleted, the to-be-deleted data stream including a timeout data stream; and / or, based on a preset insertion processing flow, a to-be-inserted data stream corresponding to the association result is added to a preset hit table; and / or, based on a preset update processing flow, a to-be-updated data stream corresponding to the association result is updated.

[0051] The application further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the multiple data stream security analysis method with dynamic index as described above when executing the program.

[0052] The application further provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program implements the multiple data stream security analysis method with dynamic index as described above when executed by a processor.

[0053] The application further provides a computer program product, which includes a computer program, and the computer program implements the multiple data stream security analysis method with dynamic index as described above when executed by a processor.

[0054] The multiple data stream security analysis method with dynamic index provided by the application can dynamically index analyze the multiple data stream association analysis expression, improve the real-time multiple data stream association analysis performance, and improve the efficiency of the multiple data stream security analysis and detection. BRIEF DESCRIPTION OF DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0056] Figure 1Is the flow chart of the multi-data stream security analysis method with dynamic index provided by the application;

[0057] Figure 2 Is the dynamic indexable expression chain mapping diagram with dynamic index provided by the application;

[0058] Figure 3 Is the equivalent indexable expression mapping diagram without dynamic index provided by the application;

[0059] Figure 4 Is the dynamic index analysis flow chart of the correlation analysis expression provided by the application;

[0060] Figure 5 Is the search key equivalent indexable expression chain flow chart provided by the application;

[0061] Figure 6 Is the indexable expression analyzer flow chart provided by the application;

[0062] Figure 7 Is the single table field expression analyzer flow chart provided by the application;

[0063] Figure 8 Is the indexable expression graph construction flow chart provided by the application;

[0064] Figure 9 Is the graph node neighbor table construction flow chart provided by the application;

[0065] Figure 10 Is the dynamic indexable expression graph analysis flow chart provided by the application;

[0066] Figure 11 Is the GraphNode node analysis flow chart provided by the application;

[0067] Figure 12 Is the GraphNode neighbor node analysis flow chart provided by the application;

[0068] Figure 13 Is the data stream data insertion flow chart provided by the application;

[0069] Figure 14 Is the equivalent table insertion flow chart provided by the application;

[0070] Figure 15 Is the dynamic equivalent table insertion flow chart provided by the application;

[0071] Figure 16 Is the linked equivalent table processing flow chart provided by the application;

[0072] Figure 17 Is the linked dynamic equivalent table processing flow chart provided by the application;

[0073] Figure 18 is a data flow diagram of the association table provided by the present application;

[0074] Figure 19 is a data flow diagram of the data flow deletion provided by the present application;

[0075] Figure 20 is a data flow diagram of the data flow update provided by the present application;

[0076] Figure 21 is a data flow diagram of the data flow notification provided by the present application;

[0077] Figure 22 is a structural diagram of the multi-data flow security analysis device with dynamic index provided by the present application;

[0078] Figure 23 is a structural diagram of the electronic device provided by the present application. DETAILED DESCRIPTION

[0079] In order to make the objectives, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described clearly and completely below in combination with the drawings in the present application. Obviously, the described embodiments are some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0080] It should be noted that the terms "first", "second", and the like used in the present application are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0081] The embodiments of the multi-data flow security analysis method with dynamic index described in the present application will be described in detail below. As shown in Figure 1 Fig. 1 is a flow diagram of the multi-data flow security analysis method with dynamic index provided by the embodiment of the present application, and the specific process includes the following steps:

[0082] Step 101: obtaining a corresponding dynamic indexable expression chain based on an association analysis expression of a plurality of data streams to be analyzed; wherein the dynamic indexable expression chain comprises at least two dynamic indexable expressions, and the dynamic indexable expressions are associated by the same identifier of a flow table; the flow table stores data streams and an association relationship between the data streams; and data of each data stream in the plurality of data streams is network security behavior data.

[0083] Specifically, before performing the present step, an association analysis expression input by a user needs to be obtained in advance. The association analysis expression includes an association relationship between parameters of data streams stored in each flow table, and the data streams include network behavior data. The structure of the association analysis expression can be defined as: join [flow table definition] if [association expression definition]. That is, the structure of the association analysis expression can include two parts: flow table definition and association expression definition. The flow table definition is [input stream name] as [flow table name], for example: stream1 as table1 stream2 as table2, stream3 as table3, where stream1, stream2 and stream3 correspond to the names of three different input data streams, table1, table2 and table3 are the names of corresponding flow tables, stream1 is defined as table1, stream2 is defined as table2, and stream3 is defined as table3. The association expression is a Boolean expression, and the expression result is true or false, for example: table1.sip == table2.sip and table2.sport < table3.sport, the expression semantics are that the expression is true when the source IP of the flow table table1 is equal to the sip of the flow table table2 and the source port of the flow table table2 is less than the flow table table3, otherwise false. A complete association analysis expression is as follows: join stream1 as table1 stream2 as table2, stream3 as table3 if table1.sip == table2.sip and table2.sport < table3.sport.

[0084] It should be noted that the association analysis expression is written by the user according to the analysis scene, and in theory, there can be any writing method. Among all the writing methods, there is a type of association expression that can use the dynamic index construction method to greatly reduce the number of table data that needs to be associated each time, thereby improving the performance of the association analysis. The definition of this special association expression includes the following:

[0085] In the dynamic index expression definition, the single table field expression contains table field expressions and only contains the fields of the same table, that is, this expression only refers to the fields of one table, and there is no reference to the fields of other tables in this expression. This case is defined as a single table field expression, for example: table1.dport+table1.sport==80, where only the dport and sport fields of table table1 are used, so it is a single table field expression; the following example is not a single table field expression: table1.dport+table2.sport==80, where the dport of table table1 and the sport of table table2 are used, so it is not a single table field expression. Dynamic index is a concept relative to equal index, and the scenario that can be used by equal index is more limited, because it needs to have an equal expression chain containing all flow tables, and the conditions that can meet this requirement are usually less. In order to make full use of the equal expression in the correlation analysis expression, the condition of equal index can be relaxed, and the concept of dynamic index is introduced. Dynamic index does not require an equal expression chain containing all flow tables, and it only needs an expression chain composed of multiple equal expressions, which contains all flow tables, and these expressions can be associated into an expression chain through the same flow table, for example: join stream1 as table1, stream2 as table2, stream3 as table3 if table1.sip==table2.sip and table2.dip==table3.dip, in the above example, there are two equal expressions: table1.sip==table2.sip, table2.dip==table3.dip, which are associated through the same flow table table2, and can form a dynamic equal expression chain=>table1.sip==table2.sip<->table2.dip==table3.dip, where table1.sip==table2.sip and table2.dip==table3.dip form a dynamic equal expression chain.

[0086] The indexable expression is defined as [single table field expression]==[single table field expression], where the single table field expressions on the left and the right correspond to different flow tables, that is, if the single table field expression on the left corresponds to table1, then the single table field expression on the right cannot correspond to table1, and vice versa. The table field expression is composed of the flow table name, the character point., and the field name, such as the source ip field of the flow table table1: table1.sip.

[0087] A key Boolean expression is defined as a Boolean expression whose value can determine the value of the whole associated expression, in the example join stream1 as table1 stream2 as table2, stream3 as table3 if table1.sip == table2.sip and table2.sport < table3.sport, [table1.sip == table2.sip] and [table2.sport < table3.sport] are both key Boolean expressions because they can determine the value of the whole associated expression; a simpler key Boolean expression can be defined as a Boolean expression which can be directly connected by and logical operation expression chain, for example: [key Boolean expression 1] and [key Boolean expression 2] and [key Boolean expression 3] or [non-key Boolean expression].

[0088] An equal indexable expression chain can refer to a mathematical example of equality transmission: given A == B, B == C, then it can be deduced => A == C, so the definition of an equal indexable expression chain is that multiple [indexable expressions] constitute an expression chain, and the expressions can be deduced to be equal to each other through the equality condition, for example: table1.sip == table2.sip and table2.sip == table3.dip and table3.dip == table4.sip In the above example, there are always three [indexable expressions]: table1.sip == table2.sip, table2.sip == table3.dip, table3.dip == table4.sip, which are connected through the two equal conditions of table2.sip and table3.dip, and can constitute an equal chain => table1.sip == table2.sip == table3.dip == table4.sip, here table1.sip == table2.sip and table2.sip == table3.dip and table3.dip == table4.sip constitute an equal indexable expression chain.

[0089]

[0090] ​The equivalent indexable expression chain has high requirements for the conditions of existence, so a large number of expressions are difficult to meet the conditions of constructing an index through the equivalent indexable expression chain. The dynamic indexable expression chain is defined as an expression chain composed of multiple indexable expressions, that is, the dynamic indexable expression chain includes at least two dynamic indexable expressions, and the dynamic indexable expressions can be associated into an expression chain through the same flow table, that is, the dynamic indexable expressions are associated through the same identifier of the flow table. For example, table1.sip==table2.sip and table2.dip==table3.dip, in the above example, there are always two indexable expressions: table1.sip==table2.sip and table2.dip==table3.dip, which are associated through the same flow table table2, and can constitute a dynamic equivalent chain => table1.sip==table2.sip<->table2.dip==table3.dip, here table1.sip==table2.sip and table2.dip==table3.dip constitute a dynamic indexable expression chain.

[0091] Three conditions must be met to determine whether an association analysis expression has a dynamic index: (1) contains a dynamic indexable expression chain; (2) all indexable expressions in the dynamic indexable expression chain are key Boolean expressions; (3) the dynamic indexable expression chain contains all flow tables in the flow table definition. For example, join stream1 as table1 stream2 as table2, stream3 as table3 if table1.sip==table2.sip and (table1.sport<table2.sport or table1.dport==table3.dport) and

[0092] In the above expression, table1.sip==table2.sip and table2.dip==table3.dip are indexable expressions and key Boolean expressions;

[0093] tablel.sip == table2.sip and table2.dip == table3.dip are [dynamic indexable expression chain] where table2 is the same flow table, through which tablel.sip and table3.dip can be associated into a chain of interrelated expressions tablel.sip == table2.sip and table2.dip == table3.dip

[0094] table2.sip and table2.dip == table3.dip contain tablel, table2, table3, contain [flow table definition] streaml as tablel, stream2 as table2, stream3 as table3, the above conditions are synthesized, the example associated analysis expression index is tablel.sip == table2.sip and table2.dip == table3.dip, and tablel.sip == table2.sip and table2.dip == table3.dip are constructed at the time of construction

[0095] table2.sip and table2.dip == table3.dip respectively construct the data structure of the index of tablel, table2, table3.

[0096] In the multi-data stream associated analysis expression dynamic index analysis method, if each [equality indexable expression] is regarded as an edge, the left value and the right value of the expression correspond to two nodes on the graph, and all [equality indexable expressions] in the [dynamic indexable expression chain] are mapped into the nodes and edges of the graph, then the expression dynamic index analysis method can be abstracted as how to find a path on the graph mapped by the [dynamic indexable expression chain], which contains all flow tables, and each flow table appears at most twice in succession on the path. Still taking the above expression as an example: join streaml as tablel, stream2 as table2, stream3 as table3 if tablel.sip == table2.sip and (tablel.sport < table2.sport or tablel.dport == table3.dport) and table2.dip == table3.dip, where tablel.sip == table2.sip and table2.dip == table3.dip are [dynamic indexable expression chain], the mapped graph is as shown in Figure 2 .

[0097] The expression dynamic index analysis can be equivalent to finding a path in the graph that connects all flow tables: table1.sip<->table2.sip<->table2.dip<->table2.dip (where table2.sip<->table2.dip is a dynamic path). Referring to an example without index: join stream1 as table1 stream2 as table2, stream3 as table3, stream4 as table4 if table1.sip==table2.sip and (table1.sport<table2.sport or table1.dport==table3.dport) and table3.dip==table4.dip, where table1.sip==table2.sip and table3.dip==table4.dip are [equality indexable expressions] in the expression, and the mapping graph is as shown in

[0098] In this example, table2 and table3 do not have equality indexable expressions, and thus there is no shortest dynamic expression path that connects all flow tables and contains table1, table2, table3 and table4, and thus the expression has no dynamic equality index (i.e., dynamic index). Figure 3

[0099] As shown in Figure 5 In the process of obtaining the dynamic indexable expression chain corresponding to the correlation analysis expression, the correlation analysis expression needs to be converted into a logic tree based on the correlation between the parameters of the data streams stored in each flow table, all nodes in the logic tree are traversed, a first node used to represent an operation is determined, and it is determined whether a first child node of the first node, a left child node and a right child node of the first child node form an indexable expression; the flow table identifiers of two flow tables included in the indexable expression are different, when the first child node of the first node and the left child node and the right child node of the first child node form the indexable expression, the expression corresponding to the left child node, the identifier of the flow table corresponding to the left child node, the expression corresponding to the right child node, and the identifier of the flow table corresponding to the right child node are added to an initial expression chain, and when all nodes in the logic tree are traversed, the initial expression chain is determined as the dynamic indexable expression chain.

[0100] As shown in Figure 6 ​As shown, determining whether the first child node of the first node, the left child node of the first child node and the right child node of the first child node constitute an indexable expression, the corresponding specific implementation process comprises: when it is determined that the first child node is a child node representing an equal operation, it is determined whether the left child node and all child nodes related to the left child node are a first single table field expression node, and whether the right child node and all child nodes related to the right child node are a second single table field expression node; when it is determined that the left child node and all child nodes related to the left child node are the first single table field expression node, and the right child node and all child nodes related to the right child node are the second single table field expression node, it is determined whether the first child node of the first node, the left child node of the first child node and the right child node of the first child node constitute an indexable expression based on the identifier of the flow table corresponding to the first single table field expression node and the identifier of the flow table corresponding to the second single table field expression node.

[0101] As shown, Figure 7 As shown, determining whether the first child node of the first node, the left child node of the first child node and the right child node of the first child node constitute an indexable expression based on the identifier of the flow table corresponding to the first single table field expression node and the identifier of the flow table corresponding to the second single table field expression node, the corresponding specific implementation process comprises: when it is determined that the left child node and all child nodes related to the left child node are the first single table field expression node, updating the first number of times that the first single table field expression refers to the first table field based on the identifier of the flow table corresponding to the first single table field expression node; when it is determined that the right child node and all child nodes related to the right child node are the second single table field expression node, updating the second number of times that the second single table field expression refers to the second table field based on the identifier of the flow table corresponding to the second single table field expression node; when it is determined that the first number of times is greater than zero, the second number of times is greater than zero, and the identifier of the flow table corresponding to the first single table field expression node is different from the identifier of the flow table corresponding to the second single table field expression node, it is determined that the first child node of the first node and the left child node and the right child node of the first child node constitute an indexable expression. The flow table is a data table

[0102]

[0103] Figure 8 Figure 8

[0104]

[0105]

[0106]

[0107]

[0108]

[0109]

[0110] <data>; (2) delete data stream data deleteStreamData(data) flow, i.e. a deletion process flow, whose flow content is to delete corresponding data stream data <data>; (3) update data stream data updateStreamData(oldData newData) flow, i.e. update processing flow, the flow content is to update the corresponding data stream data, including two steps: 1. delete data stream data

[0111] <olddata>;2. insert stream data <newdata>; (4) a notification data stream data timeout onStreamDataExpire(data) procedure whose procedure content is receiving data stream data <data>timeout notification, and delete the corresponding data stream data after receiving the notification <data>.

[0112] Specifically, the insert stream data flow insertStreamData(data) has a flow parameter joinTableSlot[N] defined as an associated calculation table slot, which saves all table data that needs to be associated with calculation, and joinTableSlot[n] corresponds to each stream table that needs to be associated with calculation, and the data type is a list, 0<=n<N. The insert stream data flow specifically includes five key flows: (1) insert equal table, the calling method of the flow content is insertEqualTable(equalTable, data), wherein table is an equal table of data type EqualTable, and data is input data; (2) insert dynamic equal table, the calling method of the flow content is insertDynamicEqualTable(dynamicEqualTable, data), wherein dynamicEqualTable is a dynamic equal table of data type DynamicEqualTable, and data is input data; (3) process linked equal table, the calling method of the flow content is processEqualTableLink(fromTableID, equalTable, keyValue), fromTableID is the current stream table id, the equalTable is a linked equal table of data type EqualTable, and keyValue is a linked index value; (4) process linked dynamic equal table, the calling method is processDynamicEqualTableLink(fromTableID, dynamicEqualTable, keyValue), fromTableID is the current stream table id, dynamicEqualTable is a linked dynamic equal table of data type DynamicEqualTable, and keyValue is a linked index value; and (5) associated table data joinTableRows, the calling method of the flow content is joinTableRows(joinTableSlot, joinRowSlot, tableIndex), wherein joinTableSlot is an associated calculation table slot, joinRowSlot is an associated calculation data slot, and tableIndex is a table index.

[0113] As shown in Figure 13 , which is an insert stream data flowchart, specifically including: (1) calling insertStreamData(data), input stream data <data>(2) Dataflow classifier <streamclassifier>Computing <data>corresponding flow table tableSlot[index] from the table slot using the flow table index index, and determine whether the type of the flow table tableSlot[index] is an equal table EqualTable. If yes, execute step (4). If not, execute step (5). (4) Call the insert equal table procedure insertEqualTable(tableSlot[index], data) (see the insert equal table section), and execute step (6) after completion. (5) Call the insert dynamic equal table procedure insertDynamicEqualTable(tableSlot[index], data) (see the insert dynamic equal table section), and execute step (6) after completion. (6) Call the join table rows procedure joinTableRows(joinTableSlot, joinRowSlot, tableIndex) (see the join table data section), and perform table data join calculation. (7) Return the join result to the caller. <data>Register and delete listeners.

[0114] like Figure 14 The flowchart shown is for inserting an equality table. Inserting an equality table (insertEqualTable) specifically includes: (1) calling insertEqualTable(equalTable, data), inputting parameters.<equalTable,data> (2) Use the index value generator equalTable.keyBuilder to calculate the index value keyValue corresponding to data. (3) Traverse the table link list equalTable.tableLinkList. (4) Determine if there is a tableLink in the table link list equalTable.tableLinkList that has not been processed. If there is, execute step (5); otherwise, execute step (8). (5) Use the flow table number tableLink.linkTableID to get the corresponding flow table tableSlot[tableLink.linkTableID] from the table slot, define the parameter toTable = tableSlot[tableLink.linkTableID], and determine if the flow table toTable type is an equivalence table EqualTable. If it is, execute step (6); otherwise, execute step (7). (6) Call the process to process the link equivalence table processEqualTableLink(equalTable.tableID, toTable, keyValue) (see the part on processing link equivalence tables). After completion, execute step (4). (7) Call the process to process the dynamic equivalence table (equalTable.tableID, toTable, keyValue) (see the section on processing dynamic equivalence tables). After completion, execute step (4). (8) Save keyValue to data, add data to the joinTableSlot[equalTable.tableID], and save data to the indexed data storage table equalTable.keyedDataTable using keyValue as the index. After completion, end the process.

[0115] like Figure 15 As shown, the insert dynamic equal table flow chart includes the following steps: (1) call insertDynamicEqualTable(dynamicEqualTable, data), input parameters <dynamicEqualTable, data>; (2) traverse the table link list dynamicEqualTable.tableLinkList; (3) determine whether the table link list dynamicEqualTable.tableLinkList has a tableLink to be processed; if yes, execute step (4); if no, execute step (7); (4) use the index value generator tableLink.keyBuilder to calculate the index value keyValue corresponding to data, save the value <[tableLink.linkTableID, keyValue]> to data, use the table slot number tableLink.linkTableID to obtain the corresponding flow table tableSlot[tableLink.linkTableID] from the table slot, define the parameter toTable = tableSlot[tableLink.linkTableID], determine whether the type of the flow table toTable is an equal table EqualTable; if yes, execute step (5); if no, execute step (6); (5) call the process link equal table flow process processEqualTableLink(dynamicEqualTable.tableID, toTable, keyValue) (see the processing link equal table section), and execute step (3) after completion; (6) call the process link dynamic equal table flow process processDynamicEqualTableLink(dynamicEqualTable.tableID, toTable, keyValue) (see the processing link dynamic equal table section), and execute step (3) after completion; (7) add data to the join calculation table joinTableSlot[dynamicEqualTable.tableID], save data to the data storage table dynamicEqualTable.dataTable, and end the flow.

[0116] As shown, Figure 16 As shown, it is a process equal table link flow chart. The process equal table link processEqualTableLink specifically includes: (1) calling processEqualTableLink (fromTableID, equalTable, keyValue), input parameters <fromTableID, equalTable, keyValue>. (2) In an embodiment of the present application, the corresponding data set is queried in the indexed data storage table equalTable.keyedDataTable with keyValue as the index value, the queried data set is set as keyedRows, and keyedRows is added to the associated calculation table joinTableSlot[equalTable.tableID]. (3) The table link list equalTable.tableLinkList is traversed. (4) Specifically, it is judged whether the table link list equalTable.tableLinkList has a tableLink to be processed, if yes, step (5) is executed, and if no, the flow is ended. (5) Further, the flow table number tableLink.linkTableID is used to obtain the corresponding flow table tableSlot[tableLink.linkTableID] from the corresponding table slot, specifically, the parameter toTable is defined as

[0117] tableSlot[tableLink.linkTableID]. (6) It is judged whether the flow table toTable type is an equal table EqualTable, if yes, step (7) is executed, and if no, step (8) is executed. (7) Calling the process equal table link processEqualTableLink

[0118] (equalTable.tableID, toTable, keyValue) is executed, and after completion, step (4) is executed. (8) Calling the process dynamic equal table link processDynamicEqualTableLink (equalTable.tableID, toTable, keyValue) (see the process dynamic equal table link part), and after completion, step (4) is executed.

[0119] As Figure 17 The diagram shows the flowchart for processing the linked dynamic equitable table. The process of processing the linked dynamic equitable table, processDynamicEqualTableLink, specifically includes: (1) calling processDynamicEqualTableLink(fromTableID, dynamicEqualTable, keyValue), with input parameters...<fromTableID,dynamicEqualTable,keyValue> (2) Query the table links from the list of table links, dynamicEqualTable.tableLinkList, where linkTableID == fromTableID, and set keyBuilder =

[0120] tableLink.keyBuilder. (3) Traverse the data storage table.

[0121] (4) Determine if there is any unprocessed data in the traversed data storage table dynamicEqualTable.dataTable. If there is, proceed to step (5); otherwise, end the process. (5) Determine if the data is in the joinTableSlot[dynamicEqualTable.tableID]. If it is, proceed to step (4); otherwise, proceed to step (6). (6) If the data contains the index value fromKeyValue corresponding to fromTableID, use it directly. If not, use the index value generator keyBuilder to calculate the index value fromKeyValue corresponding to the data and set the value...

[0122] <fromTableID, fromKeyValue> is saved to data, it is judged whether the key value is equal to fromKeyValue, if not equal, step (4) is executed, if equal, step (7) is executed. (7) data is added to the associated calculation table joinTableSlot[dynamicEqualTable.tableID], and the table link list dynamicEqualTable.tableLinkList is traversed. (8) it is judged whether dynamicEqualTable.tableLinkList has not been processed tableLink and tableLink.linkTalbeID is not equal to fromTableID, if yes, step 9 is executed, if not, step (4) is executed. (9) the flow table corresponding to the table slot is obtained from the table slot using the flow table number tableLink.linkTableID, tableSlot[tableLink.linkTableID] is defined, and the parameter toTable=tableSlot[tableLink.linkTableID] is defined. (10) it is judged whether the flow table toTable type is an equal value table EqualTable, if yes, step (11) is executed, if not, step (12) is executed. (11) the processEqualTableLink(equalTable.tableID, toTable, keyValue) process of linking an equal value table is called (see the process of linking an equal value table), and step (4) is executed after completion. (12) the processDynamicEqualTableLink(equalTable.tableID, toTable, keyValue) process of linking a dynamic equal value table is called, and step (4) is executed after completion. It should be noted that the dynamic equal value table link DynamicEqualTableLink, the parameter linkTableID is defined as the flow table number of the link; the parameter keyBuilder is defined as the index value generator corresponding to the linked flow table. The dynamic equal value table DynamicEqualTable, the parameter tableID is defined as the flow table number (flow table identifier); the parameter tableLinkList is a table link list, which saves all other flow tables linked from the current flow table, and the data structure type of each linked flow table is DynamicEqualTableLink; the parameter dataTable is defined as a data storage table, which is used to store the input flow table data.

[0123] As Figure 18 The joinTableRows function is shown in association table data flow diagram. The joinTableRows function, in particular, includes: (1) a call to joinTableRows(joinTableSlot, joinRowSlot, tableIndex), input parameters <joinTableSlot, joinRowSlot, tableIndex>.

[0124] tableIndex), input parameters <joinTableSlot, joinRowSlot, tableIndex>. (2)

[0125] defines the current table currentTable and sets currentTable = joinTableSlot[tableIndex]. (3) a loop through the rows of the current table <currenttable>For each row of data <row>The calculations were performed. (4) <currenttable>Is there data in the table? <row>If so, step (5) is performed, otherwise step (9) is performed. (5) Set joinRowSlot[tableIndex] = rowSlot[tableIndex] + 1 <row>and judges whether tableIndex + 1 is equal to N, and if equal to N, step (6) is executed, and if not equal to N, step (8) is executed. (6) The associated calculation data slot <joinrowslot> <joinfilter>correlation calculation is performed if <joinfilter>If the result of the calculation is true, step (7) is performed, and if false, step (4) is performed. (7) & insert <joinRowSlot[0], joinRowSlot[l],..., joinRowSlot[N-l]> into hit table <matchedtable>After completion, execute step (4). (8) Recursively call joinTableRows(joinTableSlot, joinRowSlot, tableIndex+1), and execute step (4) after the call is completed. (9) This function call returns.

[0126] like Figure 19 As shown, this is a data flow diagram for deleting a data stream. The data flow for deleting a data stream includes two key processes: (1) deleting the equality table, which is called by deleteEqualTable(equalTable, data), where table is the equality table of data type EqualTable and data is the input data to be deleted; (2) deleting the dynamic equality table, which is called by deleteDynamicEqualTable(dynamicEqualTable, data), where dynamicEqualTable is the dynamic equality table of data type DynamicEqualTable and data is the input data to be deleted. Specifically, it includes: (1) calling deleteStreamData(data) and inputting the data stream data to be deleted. <data>(2) cancel the sending of <data>A registered deletion listener. (3) From <matchedtable>Query if there are associated hit rows, and if so, delete the corresponding hit data. (4) Data flow classifier <streamclassifier>Computing <data>corresponding table number index. (5) using a data flow classifier <streamclassifier>Computing <data>Corresponding table number index, using index value from table slot to get the corresponding flow table tableSlot[index], define the parameter toTable = tableSlot[index]. (6) Determine whether the flow table toTable type is an equal table EqualTable, if so, execute step (7), if not, execute step (8). (7) Get the stored keyValue value from data, use keyValue as an index value, delete the corresponding storage data of data from the indexed data storage table toTable.keyedDataTable, and execute step (9) after completion. (8) Delete the corresponding storage data of data from the data storage table toTable.dataTable, and execute step (9) after completion. (9) If the table slot <tableslot>If all the data storage tables of all tables <tableSlot[0], tableSlot[1], …, tableSlot[N-1]> are empty, then delete the current computing unit, and end the process.

[0127] As shown in Figure 20 Fig. 6 is a flow chart of updating data stream data. The update data stream data updateStreamData(oldData, newData) specifically includes: (1) calling updateStreamData(oldData, newData), inputting the data stream data to be updated <oldData, newData>; (2) calling the delete data stream data flow deleteStreamData(oldData) to delete the data stream data oldData; (3) calling the add data stream data flow addStreamData(newData) to add the data stream data newData; and (4) returning the updated data stream data. <olddata>(3) Call the insertStreamData procedure insertStreamData(NewData) to insert <newdata>.

[0128] As Figure 21 shown, it is a notification data stream data deletion flow chart. The notification data stream data timeout onStreamDataExpire(data) includes (1) calling onStreamExpire(data), inputting the expired data stream data <data>(2) from <matchedtable>Query if there are associated hit rows, and if so, delete the corresponding hit data. (3) Data flow classifier <streamclassifier>Computing <data>Corresponding table number index. (4) Using data flow classifier <streamclassifier>Computing <data>Corresponding table number index, using index value from table slot to get the corresponding flow table tableSlot[index], define the parameter toTable = tableSlot[index]. (5) Determine whether the flow table toTable type is an equal table EqualTable, if so, execute step 6, if not, execute step (7). (6) Get the stored keyValue value from data, use keyValue as index value, delete the corresponding storage data of data from the indexed data storage table toTable.keyedDataTable, and execute step (8) after completion. (7) Delete the corresponding storage data of data from the data storage table toTable.dataTable, and execute step (8) after completion. If the table slot <tableslot>If all the data storage tables of all tables <tableSlot[0], tableSlot[1], …, tableSlot[N-1]> are empty, then delete the current computing unit, and end the process.

[0129] In the embodiment of the present application, the global parameter N in the dynamic index analysis process of the multi-data stream association analysis expression is defined as the number of stream tables, N >= 3. The index analysis includes four key processes: (1) search key equal index expression chain (searchEqualIndexExpression), the calling mode of the process content is searchEqualIndexExpression (expression), wherein expression is the association analysis expression to be analyzed. The return value of the process is all the key equal index expression chains searched equalIndexExpressionList, which is a chain table storing all the expressions meeting the conditions of [key Boolean expression] and [indexable expression]. (2) build index expression graph (buildIndexExpressionGraph), the calling mode of the process content is buildIndexExpressionGraph (equalIndexExpressionList), wherein equalIndexExpressionList is the key equal index expression chain searched in the process searchEqualIndexExpression. The return value of the process is the index expression graph indexExpressionGraph. (3) build graph node neighbor node table (buildGraphNodeNeighbours), the calling mode of the process content is buildGraphNodeNeighbours (indexExpressionGraph), wherein indexExpressionGraph is the index expression graph built in the process buildIndexExpressionGraph. The process builds the neighbor node table of all the nodes of the graph, and the neighbor nodes of a graph node are other graph nodes belonging to the same stream table as the node. (4) analyze dynamic index expression graph (analyseDynamicIndexExpressionGraph), the calling mode of the process content is analyseDynamicIndexExpressionGraph

[0130] (indexExpressionGraph), where indexExpressionGraph is the indexable expression graph built in the flow buildIndexExpressionGraph. If an index is found, the flow returns the value of the final index, if not, it returns no index.

[0131] As shown in Figure 4 Fig. 6, which is a flow chart of the dynamic index analysis of join analysis expressions. Specifically, it includes: (1) input join analysis expression join [stream table definition] if [join analysis expression definition]. (2) call the search key equal index expression chain flow to search for all expressions in the expression that meet the [key boolean expression] and [indexable expression] conditions, set equalIndexExpressionList = searchEqualIndexExpression (join analysis expression). (3) call the build indexable expression graph flow to build the indexable expression graph, set indexExpressionGraph = buildIndexExpressionGraph

[0132] (equalIndexExpressionList). (4) call the build graph node neighbour node table flow buildGraphNodeNeighbours (indexExpressionGraph). (5) call the analyse dynamic index expression graph flow analyseDynamicIndexExpressionGraph (indexExpressionGraph) to complete and return the result.

[0133] Figure 5 The searchEqualIndexExpression flow chart is used to search the key equal index expression. In the implementation of the present application, the parameter equalIndexExpressionList in the flow chart is defined as a table, which stores all expressions meeting the conditions of [key Boolean expression] and [indexable expression]. Specifically, it includes: (1) input the join analysis expression join [stream definition] if [join expression definition]. (2) parse the join analysis expression into a join analysis expression logical tree, and locate the root node of the logical tree where the [join expression] is located. (3) traverse all nodes of the logical tree from the root node of the [join expression] logical tree. (4) whether there are still nodes of the logical tree not traversed, if yes, execute step (5), if no, execute step (8). (5) judge whether the current node of the logical tree is an and node, if yes, execute step (6), if no, execute step (7). (6) call the [indexable expression] analyzer (see the [indexable expression] analyzer part below) to analyze the left node and the right node (i.e. the left child node and the right child node of the first child node) of the and logical tree, and execute step (4) after completion. (7) skip the analysis of the current node of the logical tree, and execute step (4). (8) end the flow chart, end the flow chart and return equalIndexExpressionList.

[0134] As shown in Figure 6 , it is a flow chart of the [indexable expression] analyzer. Specifically, it includes: (1) input the node of the logical tree to be analyzed. (2) judge whether the current node of the logical tree is a == expression node, if yes, execute step (3), if no, end the analysis flow chart. (3) call the [single table field expression] analyzer (see the [single table field expression] analyzer part) A to analyze the left node (i.e. the left child node of the first child node) of the node, call the [single table field expression] analyzer (see the [single table field expression] analyzer part) B to analyze the right node (the right child node of the first child node) of the node, judge whether the variable value of the analyzer A meets the variable value of the analyzer B, if yes, execute step (4), if no, execute step (2). (4) call the [single table field expression] analyzer (see the [single table field expression] analyzer part) C to analyze the node, and execute step (2) after completion. <tableid>greater than or equal to 0 and the variable value of analyzer B <tableid>greater than or equal to 0 and variable values of two analyzers A and B <tableid>The values are not equal, if it is consistent, then step (4) is executed, if it is not consistent, then the analysis process is ended. (4) The current expression corresponding value <(left node expression, left node corresponding table ID), (right node expression, right node corresponding table ID)> is added to the linked list <equalindexexpressionlist>and end the process.

[0135] In the [Single Table Field Expression] analyzer, the meaning of the [Single Table Field Expression] analyzer parameter tableFieldCount[N] is the table field reference count record table, which records the number of times the corresponding table field is referenced in the current expression. tableFieldCount[0] records the number of times the flow table field numbered 0 is referenced, and so on. tableFieldCount[n] records the number of times the flow table field numbered n is referenced, where 0 <= n < N. The meaning of tableID is that the default value is -1. If there is exactly one tableFieldCount[n] > 0 for all tableFieldCount[n] in tableFieldCount[N] where 0 <= n < N, then set tableID = n; otherwise, set tableID = -1.

[0136] such as Figure 7 As shown, it is the flowchart of the [Single Table Field Expression] analyzer. Specifically, it includes: (1) Input the nodes of the logic tree to be analyzed (dynamic index expression graph). (2) Start traversing all the nodes of the logic tree from the nodes of the logic tree to be analyzed. (3) Whether there are still nodes of the logic tree that have not been traversed. If so, execute step (4); if not, execute step (7). (4) Whether the current node of the logic tree is a [Single Table Field Expression] node. If so, execute step (5); if not, execute step (6). (5) Obtain the flow table number index corresponding to the current field table, set tableFieldCount[index] += 1, and after completion, execute step (3). (6) Continue to analyze the left and right child nodes of the current tree node (i.e., the left and right child nodes of the first child node), and after completion, execute step (3). (7) In the embodiment of the present invention, if there is exactly one tableFieldCount[n] > 0 for all tableFieldCount[n] in tableFieldCount[N] where 0 <= n < N, then set tableID = n; otherwise, set tableID = -1, and end the process after completion.

[0137] such as Figure 8 As shown, a flow chart for constructing an indexable expression graph is shown. In the buildIndexExpressionGraph, the key data structure GraphNode is defined, the variable tableID is defined as the flow table number (i.e. flow table identifier) corresponding to the current graph node; the variable expression is defined as the graph node expression, storing the index expression corresponding to the graph node, such as table1.sip; the variable linkNodes is defined as the linked nodes, storing other GraphNode nodes linked by the current node; the variable neighbourNodes is defined as the neighbor nodes, storing other GraphNode nodes belonging to the same flow table as the current node.

[0138] Specifically, it includes: (1) input parameter key equivalent indexable expression linked list

[0139] <equalindexexpressionlist>(2) define an index expression graph tree indexExpressionGraph[N], where each indexExpressionGraph[n], 0 <= n < N, is a table indexed by expressions with values of data structure LinkNode. (3) traverse the key equivalent index expression linked list <equalindexexpressionlist>(4) Key-Value Indexed Expression List <equalindexexpressionlist>Is there any untraversed data? If so, proceed to step (5). If not, end the process and return the indexable expression path tree indexExpressionGraph. (5) For the currently traversed data <(left node expression, left node corresponds to tableID), (right node expression, right node corresponds to tableID)>, use <left node expression> as the table index value, and retrieve the left node GraphNode (tableID = left node corresponding to tableID, expression = left node expression) from indexExpressionGraph[<left node corresponds to tableID>]. If it does not exist, create it in the table and set it as leftLinkNode; use <right node expression> as the table index value, and retrieve the left node GraphNode (tableID = left node corresponding to tableID, expression = left node expression) from indexExpressionGraph[<left node corresponds to tableID>].

[0140] Get the right node GraphNode (tableID = tableID corresponding to the right node, expression = expression of the right node) from indexExpressionGraph[<tableID corresponding to the right node>]. If it does not exist, create it in the table and set it as rightLinkNode. (6) Insert rightLinkNode into the leftLinkNode.linkNodes list and leftLinkNode into the rightLinkNode.linkNodes list. After completion, execute step (4).

[0141] like Figure 9 As shown, it is a flowchart for constructing the graph node neighbor table. The graph node neighbor table buildGraphNodeNeighbours specifically includes: (1) an indexable expression graph of input parameters.<indexExpressionGraph[N]> 1. Start from 0 and traverse all indexExpressionGraph[n] in indexExpressionGraph[N], where 0 <= n <= N. (2) Determine if there are any untraversed indexExpressionGraph[n] in indexExpressionGraph[N]. If there are, proceed to step (4); otherwise, end the process. (3) Traverse each GraphNode in indexExpressionGraph[n]. (4) Determine if there are any untraversed GraphNodes in indexExpressionGraph[n]. If there are, proceed to step (6); otherwise, proceed to step (3).

[0142] (5) add all nodes in indexExpressionGraph[n] except the current traversed node GraphNode to the neighbour table neighbourNodes of the current traversed node GraphNode, and execute step (5) after completion.

[0143] analyseDynamicIndexExpressionGraph. The flow key data structure PathNode is defined as follows: variable node is defined as storing GraphNode and initially set as empty; variable neighbourNode is defined as storing GraphNode and is the neighbour node of variable node, and initially set as empty.

[0144] Parameter currentIndexExpressionGraphPath[N] is defined as an array, marking the current dynamic expression path, and for all currentIndexExpressionGraphPath[n], the initial value is set as data structure PathNode, 0<=n<=N; parameter pathNodeCount is defined as the number of dynamic expression path nodes, used to record

[0145] There are already several nodes in currentIndexExpressionGraphPath, and when pathNodeCount==N, it indicates that a dynamic expression path is found; parameter pathGraphEdgeStack is defined as a path corresponding graph edge record stack, recording the set of edges of the graph passed through by the current dynamic expression path; parameter

[0146] dynamicIndexExpressionGraphPaths is defined as a dynamic expression path set, saving all current dynamic expression paths meeting the requirements.

[0147] The process consists of two key steps: analyzing a GraphNode (analyseGraphNode), which is called using the method analyzeGraphNode(node, precursorNode), where node is the GraphNode to be analyzed and precursorNode is the node preceding the current graph node; and analyzing a GraphNode's neighbor nodes (analyseNeighbourGraphNode), which is called using the method analyzeNeighbourGraphNode(node, precursorNode), where node is the GraphNode to be analyzed and precursorNode is the node preceding the current graph node.

[0148] like Figure 10 As shown, it is a flowchart for analyzing dynamic indexable expression graphs. (1) Input parameter indexable expression path tree<indexExpressionGraph[N]> (2) Traverse each GraphNode in the indexable expression graph, i.e., all GraphNode nodes in indexExpressionGraph[n], 0<=n<=N. (3) Are there any untraversed GraphNode nodes in indexExpressionGraph[N]? If so, proceed to step (4); otherwise, proceed to step (5). (4) Set the current GraphNode node to node, call the subprocess analyzeGraphNode(node, null) (see analyzeGraphNode), and after completion, proceed to step (3). (5) If dynamicIndexExpressionGraphPaths is null, return no index; if dynamicIndexExpressionGraphPaths is not null, sort all indices in dynamicIndexExpressionGraphPaths in ascending order according to the index path length, and return the first dynamic expression path in the list as the index.

[0149] like Figure 11 The flowchart for analyzing GraphNode nodes is as follows. In the analysis of GraphNode nodes, (1) Input parameters <nodeprecursornode>(2) Determine if the variable currentIndexExpressionGraphPath[node.tableID].node is null? If null, then perform step (3), if not null, then exit the flow. (3) Set currentIndexExpressionGraphPath[node.tableID].node = node, set pathNodeCount = pathNodeCount + 1, add the edge <precursornodenode>push to pathGraphEdgeStack. (4) Is pathNodeCount equal to N? If yes, go to step (5), if not, go to step (6). (5) Save <currentIndexExpressionGraphPath[0], currentIndexExpressionGraphPath[1],..., currentIndexExpressionGraphPath[n]>(0<=n<=N) in indexExpressionGraphPaths as an equivalent expression path, then go to step (7). (6) Traverse node.linkNodes, for each linkNode in linkNodes, call analyseGraphNode(linkNode recursively. If precursorNode is not null, traverse node.neighbourNodes, for each neighbourNode in neighbourNodes, call analyseNeighbourGraphNode(neighbourNode, node). Then go to step (7). (7) Set currentIndexExpressionGraphPath[node.tableID].node to null, set pathNodeCount = pathNodeCount - 1, pop the top edge from pathGraphEdgeStack. Then exit.

[0150] As shown in Fig. 6, it is a flow chart of analyseGraphNode. analyseGraphNode (1) Input parameters Figure 12

[0151] <nodeprecursornode>(2) Set

[0152] currentIndexExpressionGraphPath[node.tableID].neighbourNode = node, setting the edge <precursornodenode>push into the path record stack pathGraphEdgeStack.(3) traverse the node table node.linkNodes linked to the node, and recursively call analyseGraphNode(linkNode node) for each GraphNode node linkNode in linkNodes (see analyseGraphNode), set currentIndexExpressionGraphPath[node.tableID].neighbourNode to empty, pop the top edge from the path record stack pathGraphEdgeStack, and exit the flow after completion.

[0153] The multi-data-flow security analysis method with dynamic indexing provided by the embodiment of the application obtains a corresponding dynamic indexable expression chain through multi-data-flow correlation analysis expressions, obtains a dynamic index expression graph based on the dynamic indexable expression chain, and further determines a dynamic expression path in the dynamic index expression graph based on graph nodes in the dynamic index expression graph and edges between the graph nodes, determines an index corresponding to a flow table based on the dynamic expression path, and performs network security analysis and processing on the multi-data-flow based on the index of the flow table. The method can perform dynamic index analysis on multi-data-flow correlation analysis expressions, improves real-time multi-data-flow correlation analysis performance, and improves multi-data-flow security analysis and detection efficiency and accuracy.

[0154] Corresponding to the multi-data-flow security analysis method with dynamic indexing provided above, the application further provides a multi-data-flow security analysis device with dynamic indexing. Since the embodiments of the device are similar to the above-mentioned method embodiments, they are described relatively simply, and the relevant parts can be seen from the above-mentioned method embodiment part. The embodiments of the multi-data-flow security analysis device with dynamic indexing described below are only illustrative. Please refer to Figure 22 As shown in the figure, it is a structure schematic diagram of a multi-data-flow security analysis device with dynamic indexing provided by the embodiment of the application.

[0155] The multi-data-flow security analysis device with dynamic indexing provided by the application specifically includes the following parts:

[0156] The dynamic indexable expression chain obtaining unit 2201 is configured to obtain a corresponding dynamic indexable expression chain based on correlation analysis expressions of the multi-data-flow to be analyzed; wherein the dynamic indexable expression chain includes at least two dynamic indexable expressions, and the dynamic indexable expressions are correlated by the same identifier of the flow table; the flow table stores data flows and correlation relationships between the data flows; and data of each data flow in the multi-data-flow is network security behavior data.

[0157] The dynamic index expression graph obtaining unit 2202 is configured to obtain a dynamic index expression graph based on the dynamic indexable expression chain; the dynamic index expression graph comprises a plurality of graph nodes and edges between the graph nodes; the graph nodes comprise dynamic indexable expressions corresponding to flow tables, and the edges comprise an association relationship of dynamic indexable expressions corresponding to two connected graph nodes.

[0158] The data analysis processing unit 2203 is configured to determine a dynamic expression path in the dynamic index expression graph based on the graph nodes and the edges between the graph nodes in the dynamic index expression graph, determine an index corresponding to a flow table based on the dynamic expression path, and perform network security analysis on the plurality of data streams based on the index of the flow table; the dynamic expression path comprises graph nodes with the same identifier of the flow table.

[0159] Further, the data analysis processing unit is specifically configured to:

[0160] obtain at least two dynamic expression paths in the dynamic expression path;

[0161] determine a shortest dynamic expression path in the at least two dynamic expression paths, and take the shortest dynamic expression path as an index corresponding to a flow table.

[0162] Further, the dynamic index expression graph obtaining unit is specifically configured to:

[0163] traverse the dynamic indexable expression chain to obtain the dynamic indexable expression;

[0164] determine a first expression of a first type of the dynamic indexable expression and a graph node of a first type corresponding to the first expression as a first element in the dynamic index expression graph; the first element is used to indicate a storage location of information of a flow table corresponding to the first expression;

[0165] determine a second expression of a second type of the dynamic indexable expression and a graph node of a second type corresponding to the second expression as a second element in the dynamic index expression graph; the second element is used to indicate a storage location of information of a flow table corresponding to the second expression;

[0166] obtain the dynamic index expression graph based on the first element and the second element.

[0167] Further, the data analysis processing unit is specifically configured to:

[0168] traversing all graph nodes and edges in the dynamic index expression graph, in a case that a value of a current graph node field of a current dynamic expression path is empty, taking the value of the current graph node as the value of the current graph node field, adding one to a number of path nodes in the current dynamic expression path, and adding the current graph node, an edge connecting the current graph node and a previous graph node of the current graph node, and the previous graph node in a path record stack; the current dynamic expression path is a path corresponding to a current flow table indicated by the current graph node;

[0169] in a case that the number of current path nodes is equal to the number of flow tables, combining each of the current dynamic expression paths to obtain the dynamic expression path corresponding to the current graph node.

[0170] Further, the apparatus further comprises:

[0171] a path record stack determination unit, configured to, in a case that the number of current path nodes is less than the number of flow tables and the value of the previous graph node field is not empty, traverse a neighbor node table corresponding to the current graph node, and take a value of each neighbor graph node in the neighbor node table as a value of a neighbor graph node field of the current dynamic expression path; wherein the neighbor graph node comprises the previous graph node; and add an edge connecting the current graph node and the neighbor graph node in the path record stack.

[0172] Further, the apparatus further comprises: a node addition unit, configured to traverse elements in the dynamic index expression graph, and add each graph node other than the current graph node in each element to a neighbor node table corresponding to the current graph node.

[0173] Further, the data analysis processing unit is specifically configured to:

[0174] obtain flow table identifiers of the multiple data streams, and obtain flow tables of the multiple data streams corresponding to the flow table identifiers;

[0175] determine whether the flow tables of the multiple data streams are equivalent tables; the equivalent tables are tables satisfying an equivalent expression chain; the equivalent expression chain comprises equivalent relationships between key names of at least three flow tables;

[0176] if the flow tables of the multiple data streams are equivalent tables, perform association calculation based on the flow tables of the multiple data streams and a first table link list corresponding to the flow tables of the multiple data streams to obtain an association result; the first table link list comprises at least one flow table having an equivalent relationship with the flow tables of the multiple data streams in the equivalent expression chain;

[0177] perform processing on the multiple data streams based on a preset network security analysis processing flow and the association result.

[0178] Further, the multiple data streams are processed based on the preset network security analysis processing flow and the association result, specifically including:

[0179] Based on a preset deletion processing flow, a to-be-deleted data stream corresponding to the association result is deleted, the to-be-deleted data stream including a timeout data stream; and / or, based on a preset insertion processing flow, a to-be-inserted data stream corresponding to the association result is added to a preset hit table; and / or, based on a preset update processing flow, a to-be-updated data stream corresponding to the association result is updated.

[0180] The multiple data stream security analysis device with dynamic indexing provided by the embodiment of the application obtains a corresponding dynamic indexable expression chain through the association analysis expression of the multiple data streams, obtains a dynamic index expression graph based on the dynamic indexable expression chain, and further determines a dynamic expression path in the dynamic index expression graph based on the graph nodes in the dynamic index expression graph and the edges between the graph nodes, determines the index corresponding to the flow table based on the dynamic expression path, and performs network security analysis processing on the multiple data streams based on the index of the flow table. The method can perform dynamic index analysis on the association analysis expression of the multiple data streams, improves the real-time multiple data stream association analysis performance, and improves the security analysis and detection efficiency and accuracy of the multiple data streams.

[0181] Corresponding to the multiple data stream security analysis method with dynamic indexing provided above, the application further provides an electronic device. Since the embodiment of the electronic device is similar to the method embodiment described above, it is described more simply, and the relevant parts are described in the method embodiment part above. The electronic device described below is only illustrative. For example, Figure 23 As shown, it is a physical structure schematic diagram of an electronic device disclosed by the embodiment of the application. The electronic device can include a processor 2301, a memory 2302 and a communication bus 2303, wherein the processor 2301, the memory 2302 complete mutual communication through the communication bus 2303, and communicate with the outside through a communication interface 2304. The processor 2301 can call the logical instructions in the memory 2302 to execute the multi-data stream security analysis method with dynamic index, which includes: obtaining the corresponding dynamic indexable expression chain based on the correlation analysis expression of the multi-data stream to be analyzed; wherein the dynamic indexable expression chain includes at least two dynamic indexable expressions, and the dynamic indexable expressions are correlated through the same flow table identifier; the flow table stores the data stream and the correlation between the data streams; the data of each data stream in the multi-data stream is network security behavior data; obtaining a dynamic index expression graph based on the dynamic index expression chain; wherein the dynamic index expression graph includes multiple graph nodes and edges between the graph nodes; the graph node includes the dynamic indexable expression corresponding to the flow table, and the edge includes the correlation of the dynamic indexable expressions corresponding to the two connected graph nodes; determining the dynamic expression path in the dynamic index expression graph based on the graph node in the dynamic index expression graph; determining the index of the flow table based on the dynamic expression path, and performing network security analysis on the multi-data stream based on the index of the flow table; the dynamic expression path contains the graph node with the same flow table identifier.

[0182] In addition, the logical instructions in the memory 2302 described above can be implemented in the form of a software function unit and sold or used as an independent product, which can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a storage chip, a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0183] In another aspect, the embodiments of the present application also provide a computer program product, which comprises a computer program stored on a processor readable storage medium, and the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer can execute the method for multi-data stream security analysis with dynamic index provided by the above-mentioned embodiments. The method comprises the following steps: obtaining a corresponding dynamic indexable expression chain based on an associated analysis expression of a multi-data stream to be analyzed; wherein the dynamic indexable expression chain comprises at least two dynamic indexable expressions, and the dynamic indexable expressions are associated by the same identifier of a flow table; the flow table stores data streams and an associated relationship between the data streams; data of each data stream in the multi-data stream is network security behavior data; obtaining a dynamic index expression graph based on the dynamic indexable expression chain; wherein the dynamic index expression graph comprises a plurality of graph nodes and edges between the graph nodes; the graph nodes comprise dynamic indexable expressions corresponding to the flow table, and the edges comprise an associated relationship of the dynamic indexable expressions corresponding to two connected graph nodes; determining a dynamic expression path in the dynamic index expression graph based on the graph nodes in the dynamic index expression graph; determining an index corresponding to the flow table based on the dynamic expression path, and performing network security analysis on the multi-data stream based on the index of the flow table; and the dynamic expression path comprises graph nodes with the same identifier of the flow table.

[0184] In another aspect, the embodiments of the present application also provide a processor readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method for multi-data stream security analysis with dynamic index provided by the above-mentioned embodiments. The method comprises the following steps: obtaining a corresponding dynamic indexable expression chain based on an associated analysis expression of a multi-data stream to be analyzed; wherein the dynamic indexable expression chain comprises at least two dynamic indexable expressions, and the dynamic indexable expressions are associated by the same identifier of a flow table; the flow table stores data streams and an associated relationship between the data streams; data of each data stream in the multi-data stream is network security behavior data; obtaining a dynamic index expression graph based on the dynamic indexable expression chain; wherein the dynamic index expression graph comprises a plurality of graph nodes and edges between the graph nodes; the graph nodes comprise dynamic indexable expressions corresponding to the flow table, and the edges comprise an associated relationship of the dynamic indexable expressions corresponding to two connected graph nodes; determining a dynamic expression path in the dynamic index expression graph based on the graph nodes in the dynamic index expression graph; determining an index corresponding to the flow table based on the dynamic expression path, and performing network security analysis on the multi-data stream based on the index of the flow table; and the dynamic expression path comprises graph nodes with the same identifier of the flow table.

[0185] The processor-readable storage medium can be any available medium or data storage device that a processor can access, including but not limited to a magnetic storage (e.g., floppy disk, hard disk, tape, MO, etc.), an optical storage (e.g., CD, DVD, BD, HVD, etc.), and a semiconductor storage (e.g., ROM, EPROM, EEPROM, NAND FLASH, SSD, etc.), etc.

[0186] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., can be located in one place or distributed to multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0187] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be realized by means of software and necessary general hardware platform, and of course can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of software product, which can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including a plurality of instructions to make a computer device (which can be a personal computer, server, or network device, etc.) execute the method described in each embodiment or some part of the embodiment.

[0188] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.< / precursornodenode> < / nodeprecursornode> ​< / precursornodenode> < / nodeprecursornode> < / equalindexexpressionlist> < / equalindexexpressionlist> < / equalindexexpressionlist> < / equalindexexpressionlist> < / tableid> < / tableid> < / tableid> < / tableslot> < / data> < / streamclassifier> < / data> < / streamclassifier> < / matchedtable> < / data> < / newdata> < / olddata> < / tableslot> < / data> < / streamclassifier> < / data> < / streamclassifier> < / matchedtable> < / data> < / data> < / matchedtable> < / joinfilter> < / joinfilter> ​< / joinrowslot> < / row> < / row> < / currenttable> < / row> < / currenttable> < / data> < / data> < / streamclassifier> < / data> < / data> < / data> < / newdata> < / olddata> < / data> < / data> Step 102: obtaining a dynamic index expression graph based on the dynamic indexable expression chain; wherein the dynamic index expression graph comprises a plurality of graph nodes and edges between the graph nodes; the graph nodes comprise dynamic indexable expressions corresponding to flow tables, and the edges comprise the association relationship of the dynamic indexable expressions corresponding to the two connected graph nodes. Specifically, as shown, the dynamic indexable expression chain is traversed to obtain the dynamic indexable expression; a first expression of a first type of the dynamic indexable expression is determined as a first element in the dynamic index expression graph, and a graph node of a first type corresponding to the first expression is determined as the first element; the first element is used to indicate the storage location of the information of the flow table corresponding to the first expression; a second expression of a second type of the dynamic indexable expression is determined as a second element in the dynamic index expression graph, and a graph node of a second type corresponding to the second expression is determined as the second element; the second element is used to indicate the storage location of the information of the flow table corresponding to the second expression; and the dynamic index expression graph is obtained based on the first element and the second element. Wherein the dynamic indexable expression chain is, for example, table1.sip==table2.sip and table2.dip==table3.dip, and table1.sip==table2.sip and table2.dip==table3.dip are the dynamic indexable expressions in the chain. The first expression of the first type represents a left node expression, such as table1.sip in table1.sip in table1.sip==table2.sip. The graph node of the first type corresponding to the first expression corresponds to the tableID in the left node expression. The dynamic index expression graph is an array, and the first element is an element in the array. The second expression of the second type represents a right node expression, such as table2.sip in table1.sip in table1.sip==table2.sip. The graph node of the second type corresponding to the second expression corresponds to the tableID in the right node expression. Further, as shown in the last block in the corresponding, the application can also associate the left and right graph nodes, that is, insert the graph node of the first type into the list of graph nodes of the second type, and insert the graph node of the second type into the list of graph nodes of the first type.Further, the specific implementation process of determining the dynamic expression path in the dynamic index expression graph based on the graph nodes and edges between the graph nodes in the dynamic index expression graph includes: traversing all graph nodes and edges in the dynamic index expression graph, in the case of determining that the value of the current graph node field of the current dynamic expression path is empty, taking the value of the current graph node as the value of the current graph node field, adding one to the number of path nodes in the current dynamic expression path, and adding the edge connecting the current graph node and the previous graph node of the current graph node in the path record stack; the current dynamic expression path is the path corresponding to the current flow table indicated by the current graph node; in the case of determining that the current path node number is equal to the flow table number, combining each current dynamic expression path to obtain the dynamic expression path corresponding to the current graph node. The value of the current graph node can be the value of the current GraphNode node. In addition, in the case of determining that the current path node number is less than the flow table number and the value of the previous graph node is not empty, traversing the neighbor node table corresponding to the current graph node, for each neighbor graph node in the neighbor node table, taking the value of the neighbor graph node as the value of the neighbor graph node field of the current dynamic expression path; adding the edge connecting the current graph node and the neighbor graph node in the path record stack. Further, traverse the elements in the dynamic index expression graph, and add other graph nodes in each element to the neighbor node table corresponding to the current graph node. The elements include first elements and second elements. Step 103: determining the dynamic expression path in the dynamic index expression graph based on the graph nodes in the dynamic index expression graph; determining the index corresponding to the flow table based on the dynamic expression path, and performing network security analysis on the multiple data streams based on the index of the flow table; the dynamic expression path contains graph nodes with the same identifier of the flow table. In the process of determining the index corresponding to the flow table based on the dynamic expression path, the graph nodes in the dynamic index expression graph can be traversed to obtain at least two dynamic expression paths in the dynamic expression path; determine the shortest dynamic expression path in the at least two dynamic expression paths; take the shortest dynamic expression path as the index corresponding to the flow table (i.e. index table), that is, determine the index table of the corresponding flow table based on each dynamic indexable expression in the shortest dynamic expression path in the at least two dynamic expression paths.In the network security analysis and processing of the multiple data streams based on the index of the flow table, the flow table identifier of the multiple data streams can be acquired, and the flow table corresponding to the flow table identifier of the multiple data streams can be acquired; it is determined whether the flow table of the multiple data streams is an equal table; the equal table is a table satisfying an equal expression chain; the equal expression chain includes an equal relationship between the key names of at least three data stream tables; if the flow table of the multiple data streams is an equal table, an association calculation is performed based on the flow table of the multiple data streams and a first table link list corresponding to the flow table of the multiple data streams to obtain an association result; the first table link list includes at least one flow table having an equal relationship with the flow table of the multiple data streams in the equal expression chain; and the multiple data streams are processed based on a preset network security analysis and processing procedure and the association result. The processing of the multiple data streams based on the preset network security analysis and processing procedure and the association result can include: deleting a to-be-deleted data stream corresponding to the association result based on a preset deletion processing procedure, the to-be-deleted data stream including a timeout data stream; and / or adding a to-be-inserted data stream corresponding to the association result to a preset hit table based on a preset insertion processing procedure; and / or updating a to-be-updated data stream corresponding to the association result based on a preset update processing procedure. The present application uses a dynamic indexable expression as an index to determine the index table of the corresponding flow table, and only needs to find the data stream corresponding to the index in the flow table, without traversing all data, so that the data searching efficiency is high, and the efficiency of security analysis is further improved. It should be noted that in the real-time multiple data stream association analysis parameter definition with a dynamic index of the present application, parameter N is defined as the number of flow tables, N>=3; parameter streamClassifier can be defined as a data stream classifier to mark the input flow data as a corresponding table number; parameter tableSlot[N] can be defined as a table slot, tableSlot[n] corresponds to each table respectively, the data type is EqualTable or DynamicEqualTable, 0<=n<N, if the expression of the current flow table and other flow tables is an equal index, the data type is EqualTable, and if it is a dynamic equal index, the data type is DynamicEqualTable; accordingly, parameter matchedTable can be defined as a hit table to save the table data of successful association, one row in the table corresponds to one pair of successfully associated data; and parameter joinFilter can be defined as an association filter to calculate a group of data (the number of data is N) that needs to be associated, if the value is true, it indicates that the association is successful, and if the value is false, it indicates that the association fails.In the embodiment of the present application, the real-time multi-data stream correlation analysis process with dynamic index comprises four processes, and the processes include: (1) an insert data stream data insertStreamData(data) process, that is, an insertion processing process, and the process content is inserting corresponding data stream data.

Claims

1. A multi-data stream security analysis method with dynamic indexing, characterized in that, include: Based on the correlation analysis expressions of the multiple data streams to be analyzed, a corresponding dynamic indexable expression chain is obtained; wherein, the dynamic indexable expression chain includes at least two dynamic indexable expressions, which are associated with each other through the same flow table identifier; the flow table stores data streams and the correlation relationships between the data streams; the data of each data stream in the multiple data streams is network security behavior data; Based on the dynamically indexable expression chain, a dynamic indexable expression graph is obtained; wherein, the dynamic indexable expression graph includes multiple graph nodes and edges between graph nodes; the graph node includes a dynamically indexable expression corresponding to a flow table, and the edge includes the association relationship between the dynamically indexable expressions corresponding to two connected graph nodes; Based on the graph nodes in the dynamic index expression graph, a dynamic expression path is determined in the dynamic index expression graph; based on the dynamic expression path, the index corresponding to the flow table is determined; and based on the index of the flow table, network security analysis is performed on the multiple data streams; the dynamic expression path contains graph nodes with the same flow table identifier. Determining the dynamic expression path in the dynamic index expression graph based on the graph nodes and edges between the graph nodes includes: Traverse all graph nodes and edges in the dynamic index expression graph. If the value of the current graph node field of the current dynamic expression path is empty, use the value of the current graph node as the value of the current graph node field, increment the number of path nodes in the current dynamic expression path, and add the current graph node, the edge connected to the previous graph node of the current graph node, and the previous graph node to the path record stack. The current dynamic expression path is the path corresponding to the current flow table indicated by the current graph node. If the number of current path nodes is equal to the number of flow tables, each current dynamic expression path is combined to obtain the dynamic expression path corresponding to the current graph node.

2. The multi-data stream security analysis method with dynamic indexing according to claim 1, characterized in that, The step of determining the index corresponding to the flow table based on the dynamic expression path specifically includes: Obtain at least two dynamic expression paths from the dynamic expression paths; Determine the shortest dynamic expression path among the at least two dynamic expression paths, and use the shortest dynamic expression path as the index corresponding to the flow table.

3. The multi-data stream security analysis method with dynamic indexing according to claim 1, characterized in that, The method further includes: If it is determined that the number of nodes in the current path is less than the number of flow tables, and the value of the previous graph node field is not empty, the neighbor node table corresponding to the current graph node is traversed. For each neighbor graph node in the neighbor node table, the value of the neighbor graph node is used as the value of the neighbor graph node field of the current dynamic expression path; wherein, the neighbor graph node includes the previous graph node. Add the edge connecting the current graph node and the neighboring graph node to the path record stack.

4. The multi-data stream security analysis method with dynamic indexing according to claim 3, characterized in that, The method further includes: traversing the elements in the dynamic index expression graph and adding the other graph nodes in each element, except for the current graph node, to the neighbor node table corresponding to the current graph node.

5. The multi-data stream security analysis method with dynamic indexing according to claim 1, characterized in that, The network security analysis and processing of the multiple data streams based on the index of the flow table specifically includes: Obtain the flow table identifier of the multiple data streams, and obtain the flow table of the multiple data streams corresponding to the flow table identifier; Determine whether the flow table of the multiple data streams is an equi-table; the equi-table is a table that satisfies a chain of equi-expressions; the chain of equi-expressions includes: equi-relationships between the key names of at least three flow tables; If the flow table of the multiple data streams is an equivalence table, then an association calculation is performed based on the flow table of the multiple data streams and the first table link list corresponding to the flow table of the multiple data streams to obtain an association result; the first table link list includes at least one flow table in the equivalence expression chain that has an equivalence relationship with the flow table of the multiple data streams. The multiple data streams are processed based on a preset network security analysis and processing procedure and related results.

6. The multi-data stream security analysis method with dynamic indexing according to claim 5, characterized in that, The processing of the multiple data streams based on the preset network security analysis and processing flow and correlation results specifically includes: Based on a preset deletion process, delete the data stream to be deleted corresponding to the association result, the data stream to be deleted including the timed-out data stream; and / or, based on a preset insertion process, add the data stream to be inserted corresponding to the association result to a preset hit table; and / or, based on a preset update process, update the data stream to be updated corresponding to the association result.

7. A multi-data stream security analysis device with dynamic indexing, characterized in that, include: A dynamic indexable expression chain acquisition unit is used to obtain a corresponding dynamic indexable expression chain based on the association analysis expression of multiple data streams; wherein, the dynamic indexable expression chain includes at least two dynamic indexable expressions, and the dynamic indexable expressions are associated with each other through the same flow table identifier; A dynamic indexed expression graph acquisition unit is used to obtain a dynamic indexed expression graph based on the dynamic indexable expression chain; wherein, the dynamic indexed expression graph includes multiple graph nodes and edges between graph nodes; The data analysis and processing unit is used to determine the dynamic expression path in the dynamic index expression graph based on the graph nodes and the edges between the graph nodes; determine the index corresponding to the flow table based on the dynamic expression path; and perform network security analysis and processing on the multiple data streams based on the index of the flow table. The data analysis and processing unit is specifically used for: Traverse all graph nodes and edges in the dynamic index expression graph. If the value of the current graph node field of the current dynamic expression path is empty, use the value of the current graph node as the value of the current graph node field, increment the number of path nodes in the current dynamic expression path, and add the current graph node, the edge connected to the previous graph node of the current graph node, and the previous graph node to the path record stack. The current dynamic expression path is the path corresponding to the current flow table indicated by the current graph node. If the number of current path nodes is equal to the number of flow tables, each current dynamic expression path is combined to obtain the dynamic expression path corresponding to the current graph node.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the multi-data stream security analysis method with dynamic index as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the multi-data stream security analysis method with dynamic index as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the multi-data stream security analysis method with dynamic index as described in any one of claims 1 to 6.

Images