A traffic splitting method based on IP bitmask rules

Abstract

The application provides a traffic shunting method based on IP bit mask rules, which significantly reduces memory occupation through bit mask processing and single-byte matching table compression, and compresses memory by nearly 80% compared with traditional schemes, so that a larger scale rule set can be efficiently processed in a limited memory environment; the application adopts bit mask and early interception range technologies, can quickly filter out rules that do not meet the conditions during matching, and calls SIMD instructions to perform byte processing in parallel, so that the performance is improved by nearly 3-4 times compared with traditional schemes; the application enables a rule to represent multiple possible IP segments, which provides more flexible rule matching and is suitable for network traffic management requirements in different situations; the application optimizes rule preprocessing and matching processes, so that it is more suitable for large-scale rule set conditions; and the application uses dichotomy to perform fine matching of rules, so that the matched rules can be accurately found. This provides higher matching accuracy and helps to more accurately manage network traffic.

Description

Technical Field

[0001] This invention relates to the field of electronic digital data processing technology, and specifically to a traffic splitting method based on IP bitmask rules. Background Technology

[0002] With the rapid development of optical communication technology, network transmission speed and quality are no longer limited by existing physical media. However, compared to other fields, the progress of packet forwarding technology has lagged behind. The rapid increase in network traffic caused by large-scale data transmission not only requires routers to forward data packets quickly but also to manage storage resources efficiently. In this context, the performance of packet demultiplexing technology becomes crucial, directly determining the quality of network service.

[0003] The core idea of ​​packet splitting technology lies in extracting the header information of network data packets, then inputting these headers into the splitting device. The splitting algorithm matches these headers against a pre-defined set of rules to ultimately determine how to route the network traffic. The rule set contains different matching conditions, typically assigning each rule a rule number (usually arranged in ascending order), and defining the corresponding operation to be performed on a data packet that matches a certain rule. When the relevant fields in the packet header satisfy a certain rule, the data packet matches that rule.

[0004] Current traffic splitting algorithms can be broadly categorized as follows:

[0005] 1. Exhaustive search: This method compares data packets with all rules in the rule set to find the best matching rule. Examples include linear search and tri-state content-addressable memory (TCAM).

[0006] 2. Decision Tree: This method constructs a decision tree based on the rules in the classifier, and then traverses each decision tree sequentially to obtain the matching results. Common algorithms include Grid-of-Tries, EGT, HiCuts, ModularPacket Classification, and FIS.

[0007] 3. Decomposition: This method decomposes the data dimensionally, searches each dimension sequentially, and then combines the results to obtain the final outcome. Major algorithms include BV, ABV, P2C, and DCFL.

[0008] 4. Tuple Space: This categorizes rules based on the number of bits specified in the rules, using a hash function to achieve categorized lookup. Common algorithms include TSS, Tuple Pruning, and Conflict-free RectangleSearch. This high-level categorization method is generally more practical because it reflects the algorithm's thought process.

[0009] Most existing packet splitting algorithms are based on range and prefix type rules, as these are relatively advantageous for their lookup. However, these algorithms cannot fully meet the demands of more refined and personalized services in converged networks. Efficient packet splitting technology is crucial for meeting the ever-diversifying needs of network services; therefore, we need to evaluate packet classification technology from multiple perspectives. The following are commonly used reference indicators:

[0010] 1. Classification speed: This is the most important performance indicator. With the rapid development of optical communication technology, line transmission rate is no longer the bottleneck of network traffic; the forwarding performance of routers has become the core element in ensuring service quality. Routers with low forwarding rates may cause network traffic congestion, making it difficult to provide service guarantees.

[0011] 2. Storage Consumption: This is also an important evaluation metric. Due to the continuous expansion of network traffic, it's difficult to determine how much traffic will flow through the router in the future. An efficient storage structure and low storage consumption are the best ways to cope with explosive network traffic.

[0012] 3. Update Performance: Update performance measures the cost required to update a rule set. It includes global updates (updating the entire rule base) and incremental updates (adding or deleting only some rules). Efficient update performance is a crucial indicator for handling complex networks, especially in the face of new services and anomalies that may cause rule set changes.

[0013] 4. Scalability: Scalability has three aspects: expansion of rule set size, which has little impact on classification performance; expansion of rule dimension, supporting more fields; and expansion of classification hierarchy, where efficient classification technology should support multi-level field matching.

[0014] 5. Preprocessing time: This refers to the cost of constructing the required rule set and related data structures. Preprocessing performance can affect classification performance to some extent.

[0015] Given the interrelationships among the aforementioned indicators, an efficient traffic diversion technology should select an appropriate compromise solution based on the specific application scenario.

[0016] Computer network and communication technologies are rapidly evolving, requiring network administrators to employ various technologies and methods to effectively manage and optimize network traffic. Traditional methods primarily rely on rule sets, routers, firewalls, and other devices to manage and distribute network traffic. These devices use information such as IP addresses and port numbers to identify and process traffic. However, these methods have limitations, including rigid rule sets, complexity, insufficient resource utilization, and scalability issues.

[0017] Bitmask rules are rules of any type where each bit can represent three states (0, 1, or * for indeterminate), thus representing multiple different ranges and improving rule reusability. Bitmask rules are more adaptable than most other rule types. As mentioned earlier, many algorithms use range or prefix-type rule sets because this is more advantageous for their lookup operations.

[0018] Furthermore, traffic splitters such as Snort intrusion detection systems and open-source firewall IP tables employ more expressive and precise rule languages ​​than bitmask-based methods, making them highly suitable for describing complex firewall rules. However, these methods typically rely on linear search to classify packets, resulting in low throughput with large rule sets, thus limiting their use in applications requiring high throughput and large rule sets. In summary, bitmask rules have a wider range of applications compared to other rule types, and bitmask-based packet classification algorithms exhibit better scalability and are suitable for classification across more dimensions.

[0019] Therefore, more flexible, intelligent, and adaptable traffic management methods are needed to meet the ever-increasing network traffic and diverse network demands. Summary of the Invention

[0020] This invention aims to solve the problems of network traffic management and traffic splitting by providing a traffic splitting method based on IP bitmask rules. This method can more effectively cope with the ever-increasing network traffic and diverse network demands, improve the efficiency and performance of network traffic management, and overcome the problems existing in traditional methods.

[0021] This invention provides a traffic splitting method based on IP bitmask rules, comprising the following steps:

[0022] S1. The traffic splitting device preprocesses the IP bitmask rule set. First, it sorts and preprocesses the rules by byte size. Then, when creating the bitmap, it uses high compression to compress K rules into 1 bit to obtain a single-byte compressed matching table. Then, it obtains the hit range array of each table entry through the single-byte compressed matching table to perform pre-filtering when performing matching search.

[0023] S2. After the live network traffic is input, the IP address in the traffic is extracted and matched with the IP mask rule set. If a match is found, the traffic is split according to the rules.

[0024] S3. Output the split traffic to the corresponding routing device, thus completing a traffic splitting method based on IP bitmask rules.

[0025] The traffic splitting method based on IP bitmask rules described in this invention, as a preferred embodiment, includes the following steps in step S1:

[0026] S11. Rule Sorting and Bitmask Processing: Sort each rule in the IP bitmask rule set by bytes. Each rule in the rule set includes a rule number, IP value, and bitmask. Convert the IP value and bitmask in the rule into a bitmap through a bitwise AND operation.

[0027] S12, Single-byte matching table: The rule set is divided according to each byte of the IP address to generate a single-byte matching table;

[0028] S13. Single-byte matching table compression: The single-byte matching table is compressed into a group of K rules to obtain a rule group and form a single-byte compressed matching table. The compressed bitmap of each rule group represents the rules that may be matched on the byte.

[0029] S14. Single-byte matching table truncation range: For a single-byte compressed matching table, record the range of the first and last occurrences of 1 for each table entry to obtain a hit range array, which is then used for pre-filtering.

[0030] In the preferred embodiment of the traffic splitting method based on IP bitmask rules described in this invention, in step S11, each rule in the IP bitmask rule set is converted to binary, and the IP value and bitmask of each rule are performed by bitwise AND operation and then sorted in ascending order to obtain a rule set table after AND operation sorting.

[0031] In the bitmask binary table, the uncertain bit "0" is represented by "*", and each rule can represent multiple possible IP segments.

[0032] In the preferred embodiment of the traffic splitting method based on IP bitmask rules described in this invention, in step S12, all rules are split into bytes and a single-byte matching table is constructed, where each entry represents a range, and an entry set to 1 represents a rule match.

[0033] The IP address is split into 4 bytes to build a single-byte matching table. When searching for a match, the IP address to be matched is also split into bytes and matched one by one. Only when all four bytes are matched is the rule considered to be matched and traffic splitting is performed.

[0034] In the traffic splitting method based on IP bitmask rules described in this invention, as a preferred embodiment, K is 512 in step S13.

[0035] In the preferred embodiment of the traffic splitting method based on IP bitmask rules described in this invention, in step S14, a range array is extracted according to a single-byte compression matching table; a matching table is constructed for the four bytes of the IP address, and a range array is extracted sequentially.

[0036] Determine if the number of bytes is less than 5. If yes, return to step S11; otherwise, preprocessing ends.

[0037] The traffic splitting method based on IP bitmask rules described in this invention, as a preferred embodiment, includes the following steps in step S2:

[0038] S21. Split and search the truncated array: After inputting the live network traffic, extract the IPs from the traffic to obtain the IPs to be matched. Split the IPs to be matched into bytes, and obtain the range of each byte according to the truncated array. Take the intersection of the ranges of the four bytes. If there is no intersection, the IP to be matched will not match any rules.

[0039] S22. Split the single-byte matching compressed table: Based on the intersection of the extracted arrays, search the single-byte matching compressed table for each byte of the IP to be matched to determine the possible rule groups that may be matched;

[0040] S23. Binary Search Refined Matching: Perform binary search matching on rules in the rule group that may match; accurately find the matching rule by comparing the bitmask of the IP to be matched with the IP value of the rule, and after a match, distribute the traffic according to the rule.

[0041] In the preferred embodiment of the traffic splitting method based on IP bitmask rules described in this invention, if the ranges of the four bytes do not overlap in step S21, then proceed to step S3, and the traffic splitting ends.

[0042] If the ranges of the four bytes overlap, proceed to step S22.

[0043] In the preferred embodiment of the traffic splitting method based on IP bitmask rules described in this invention, in step S22, all four bytes of the IP to be matched are searched against the single-byte matching compression table to obtain 4 sets of bitmap values, and the rule group id range is obtained by performing a bitwise AND operation on these four bitmaps.

[0044] Determine if there are any bits set to 1 in the bitmap value segment. If so, proceed to step S23; otherwise, proceed to step S3, and the traffic splitting ends.

[0045] In the preferred embodiment of the traffic splitting method based on IP bitmask rules described in this invention, in step S23, the IP to be matched is directly ANDed with the rule bitmask of rule id 255, and then the result of the AND operation is compared with the rule IP value. If it is less than the rule IP value, a binary search is performed in rule id 0 to 255; if it is greater than the rule IP value, a judgment is made in rule id 256 to 511.

[0046] This invention primarily addresses network traffic management and traffic splitting methods. This technical field focuses on data transmission, routing, splitting, and management in networks to ensure the effective use of network resources and the rational distribution of traffic. This invention provides a novel method for achieving traffic splitting through IP bitmasking rules, thereby improving network performance, security, and manageability.

[0047] For bitmask splitting techniques, Grouper, as a representative algorithm in this field, has significant theoretical research and practical application value.

[0048] Grouper Algorithm: The Grouper algorithm is a classic packet classification algorithm, particularly suitable for handling rules based on bitmasks. First proposed by Jay Ligatti et al., it exhibits excellent performance when dealing with large rule sets. The core idea is to divide the rule set into N groups, each with B / K bits, where K is a user-defined parameter, typically a small integer. Each rule group corresponds to a lookup table, and each entry in the lookup table corresponds to an N-bit bitmap. For an input packet, the algorithm divides it into K bit groups and then uses these bit groups to index the corresponding lookup tables. Next, it performs a bitwise logical AND operation on the bitmaps corresponding to all bit groups to obtain the final bitmap. In the final bitmap, each 1 corresponds to a matching rule, and the first matching rule is usually selected as the best match.

[0049] The L-Grouper algorithm is an improved version of the Grouper algorithm. It introduces a linked list structure to replace the original bitmap for storing rules. Each linked list node is a structure containing the rule number matching the rule at a certain position, the number of rules, and a pointer to the next structure node. In the preprocessing stage, L-Grouper creates independent structure arrays for different rule fields (usually bits) to store the rules matching that field. During the search, the algorithm splits the packet according to its dimensions, retrieves the linked lists matching each dimension, compares them, and finally obtains the matching result.

[0050] The main difference between the two algorithms lies in their data structures: Grouper uses a bitmap, while L-Grouper uses a linked list. This improvement allows L-Grouper to process matches more efficiently with large-scale rule sets and promises to improve performance. The innovation of this technology lies in its data structure and matching strategy, making it suitable for different rule sets and matching requirements.

[0051] Traditional Grouper and L-Grouper algorithms suffer from excessive memory consumption and relatively low matching performance when handling large rule sets. This limits their application in practical network traffic management.

[0052] This invention proposes a novel bitmask matching and splitting scheme based on the Grouper algorithm:

[0053] Rule set preprocessing: For IP bitmask rules, the rules are first preprocessed by sorting them by byte size; during bitmap creation, a high-compression method is used to compress 512 rules into 1 bit. This preprocessing significantly reduces memory consumption and improves search efficiency; by compressing the matching table to obtain the hit range array for each entry, pre-filtering is performed during matching searches.

[0054] Efficient matching: During the matching process, a 64-byte bitwise AND operation is performed using the computer's instruction set. First, the target data is split into bytes to find the intersection of the matching range array for pre-matching, reducing the number of bits required for the bitwise AND operation. After the pre-match, a binary search is used for fine-grained matching within the rule group. This method reduces the need for meticulous matching byte by byte, significantly improving performance.

[0055] In summary, the innovative solution proposed in this invention application helps to process large rule sets more effectively, reduce memory consumption, and improve matching performance, thereby improving the efficiency and performance of network traffic management and overcoming the memory and performance problems existing in traditional algorithms. These advantages give this technology a significant competitive edge in the field of network traffic management.

[0056] This technical solution addresses the packet splitting problem caused by IP bitmasking rules. Through preprocessing and efficient matching methods, it improves performance and reduces memory consumption. This solution has broad application potential and can be used to improve network traffic management and routing.

[0057] The present invention has the following advantages:

[0058] (1) This invention reduces memory usage, improves performance, provides greater rule flexibility, is applicable to large-scale rule sets, and provides higher matching accuracy, giving it a significant competitive advantage in the field of network traffic management and rule matching.

[0059] (2) The present invention reduces memory consumption. Traditional rule set processing methods usually require a large amount of memory to store rules and matching data structures. The present invention significantly reduces memory usage through bitmasking, single-byte matching table compression, and other methods, compressing memory by nearly 80% compared to traditional solutions, enabling larger rule sets to be processed efficiently in a limited memory environment.

[0060] (3) This invention significantly improves performance. In traditional methods, matching rules requires matching each rule bit by bit, which is relatively inefficient. This invention uses techniques such as bitmasking and pre-selection of ranges, which can quickly filter out rules that do not meet the conditions during matching, and call SIMD instructions to perform byte processing in parallel, improving performance by nearly 3 to 4 times compared to traditional solutions.

[0061] (4) This invention provides more flexible rule matching. Due to bitmasks and multiple rule representation methods, this invention allows a single rule to represent multiple possible IP segments. This provides more flexible rule matching, suitable for network traffic management needs under different circumstances.

[0062] (5) This invention is applicable to large-scale rule sets. Traditional methods suffer from significant performance degradation when processing large-scale rule sets, while this invention optimizes the rule preprocessing and matching processes, making it more suitable for large-scale rule sets.

[0063] (6) This invention enables high-precision matching. It uses a binary search method for fine-grained rule matching, thereby accurately identifying matching rules. This provides higher matching accuracy and helps in more precise management of network traffic. Attached Figure Description

[0064] Figure 1 This is a flowchart of a traffic splitting method based on IP bitmask rules;

[0065] Figure 2 This is a flowchart of the rule set preprocessing process for a traffic splitting method based on IP bitmask rules;

[0066] Figure 3 A flowchart for finding a match in a traffic splitting method based on IP bitmask rules;

[0067] Figure 4 This is a schematic diagram illustrating the matching process in Example 1 of a traffic splitting method based on IP bitmask rules. Detailed Implementation

[0068] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0069] Example 1

[0070] A traffic splitting method based on IP bitmask rules. Figure 1 The diagram shows the model of the traffic splitting scheme proposed in this invention. The traffic splitting device preprocesses the rule set in advance. After the live network traffic is input, it extracts the IP address from the traffic and matches it with the rule database. If a match is found, the traffic is split according to the rules and output to the corresponding routing device.

[0071] The specific traffic splitting and matching method consists of two parts: the preprocessing of the rule set and the process of finding and matching the IPs to be matched.

[0072] like Figure 2 As shown, the preprocessing of the rule set includes:

[0073] 1. Rule Sorting and Bitmask Processing: First, the rules in the rule set are sorted byte-wise. Each rule contains a rule number, an IP value, and a bitmask. A bitwise AND operation is used to convert the IP value and bitmask in the rule into a bitmap, where indeterminate bits in the bitmask are represented by "*". This allows each rule to represent multiple possible IP ranges.

[0074] 2. Single-byte matching table: The rule set is divided into single-byte matching tables based on each byte of the IP address. Each entry represents a range, where an entry set to 1 indicates that a rule on that byte has been matched.

[0075] 3. Single-byte match table compression: To reduce memory usage, the single-byte match table is compressed into groups of 512 rules, forming rule groups. The compressed bitmap for each rule group indicates which rules might match on that byte.

[0076] 4. Single-byte matching table truncation range: For the single-byte matching table, record the range of the first and last occurrences of 1 for each table entry, which is used for pre-filtering.

[0077] like Figure 3 As shown, the search matching part includes:

[0078] 1. Split and search the truncation array: The IP address to be matched is split into bytes, and each byte is used to obtain its range from the truncation array. The intersection of the four byte ranges is taken. If there is no intersection, the IP address to be matched does not match any rules.

[0079] 2. Split the single-byte matching compressed table: For each byte of the IP to be matched, search the single-byte matching compressed table based on the intersection of the extracted arrays to determine which rule groups are likely to match.

[0080] 3. Refined Binary Matching: If potentially matching rule groups are identified, a binary matching method is used to match the rules within these groups. By comparing the bitmask of the IP address to be matched with the IP value of the rule, the matching rule can be found precisely.

[0081] In this embodiment, the preprocessing part of the rule set:

[0082] ① Rules are sorted by bytes. A rule set may contain multiple rules, each consisting of three parts: rule ID (rule number), ip_value (IP value), and ip_mask (bitmask). As shown in Table 1, the example rule set provides 4096 IPv4 rules. IPv4 consists of four bytes, with each byte being 8 bits. If the rule set in Table 1 is converted to binary, Table 2 is obtained.

[0083] Table 1 Original Rule Set Table

[0084]

[0085] Table 2 Original Rule Set Binary Table

[0086]

[0087] In Table 2, "0"s in the bitmask of a rule are replaced with "*" to indicate uncertainty, while "1"s represent certainty. Taking Byte_1 of rule id 1 in Table 2 as an example, its ip_value is 10101000, and its bitmask is 1*1*1***. "*" indicates that the value of the bit in ip_value corresponding to that bit is uncertain. Therefore, performing a bitwise AND operation between ip_value and ip_mask yields 1*1*1***, meaning the value of bit 0 is 1, the value of bit 1 is uncertain (it can be 0 or 1), and so on. Because of the existence of bitmasks, a rule can have multiple possible values.

[0088] Table 3 is obtained by performing a bitwise AND operation on the ip_value and ip_mask of each rule. The rules are then sorted in ascending order based on the first byte. If the first bytes are the same, the second bytes are compared, and so on, resulting in Table 4. The IDs of the original rule set are then rearranged. Table 5 is the binary representation of Table 4. It can be seen that the bits in each rule may be uncertain; therefore, one rule can represent multiple IP ranges.

[0089] Table 3 and the rule set table after operation

[0090]

[0091] Table 4 and the rule set table for sorting after operation

[0092]

[0093] ② Rule sets are categorized by byte. After the above processing, as shown in Table 5, an IP address consists of four bytes. All rules are split by bytes, and an original matching table is constructed, as shown in Table 6. This is the original matching graph composed of the first byte of all rules. The IP address is split into 4 bytes to construct the matching table. When searching for a match, the IP address to be matched is also split by bytes and matched one by one. Only when all four bytes are matched is the rule considered matched and traffic splitting is performed.

[0094] Table 5 shows the binary table of the rule set for sorting after the operation.

[0095]

[0096]

[0097] Table 6. Single-byte raw matching table of the rule set

[0098]

[0099] The rule set will be split into four original matching tables byte by byte. Table 6 represents the first byte of all rules. A byte has 8 bits, so its range is 0-2. 8 -1 (0-255), meaning a single byte may contain values ​​from 0 to 255. We use 0-255 as the table entry (row) for Table 6, and the first byte of each rule as the table column. For example, in Table 5, the first byte of rule id 0 is ********, indicating that all 8 bits of this byte are uncertain and can be either 0 or 1. Therefore, the range of this byte is 0-255, and we set the r_0 column in Table 6 to 1. Similarly, we set the first byte of each rule in Table 6. The highlighted 1 in Table 6 has an entry of 3 and a rule id of 0, meaning that the first byte of the rule with rule id 0 can have a value of 3.

[0100] As shown in Table 6, the larger the number of rules, the larger the single-byte matching table becomes, and the more storage space is required. To reduce storage space, Table 6 is compressed, with every 512 rules compressed into a rule group and renumbered, as shown in Table 7. In the example, the 4096 rules are compressed into 8 rule groups and renumbered. If any of the 512 rules in each group have a bit set to 1 in Table 6, the compressed rule group will have a value of 1; otherwise, it will have a value of 0.

[0101] As shown in Table 7, the highlighted 1 has an entry of 2 and a rule group ID of 0. This means that among the 512 rules with rule group ID 0, there is a rule that can be 2 in the first byte.

[0102] Table 7. Single-byte compression matching table for rule sets

[0103]

[0104] ③ Single-byte compressed matching table truncation range array. In Table 7, the range of the first and last occurrences of 1 in each entry is recorded. If no entry contains an 1, it is recorded as [-1, -1], as shown in the gray area of ​​the table. Table 8 is the truncation range array of the single-byte compressed matching table. Because the matching is performed byte by byte, i.e., bitwise AND operation, in order to reduce the number of bits in the AND operation and improve performance, the range array of each entry is pre-filtered.

[0105] Table 8 shows the truncated array of the single-byte compressed matching table for the rule set.

[0106] 0 [0,4] 1 [0,6] 2 [0,0] 3 [0,5] ... 255 [0,1]

[0107] The above processing only applies to the first byte of the rule set. After the IP address is split into 4 bytes, the above processing needs to be performed four times, generating four single-byte compressed matching tables and single-byte compressed matching table truncation arrays.

[0108] In this embodiment, the matching part is searched:

[0109] After the rule set preprocessing is complete, the matching process begins. Taking the IP address 1.168.1.135 as an example, the matching is performed. Figure 3 , 4 As shown:

[0110] ① Byte-based splitting and array extraction. 1.168.1.135 is split into four bytes: 1, 168, 1, and 135. The first byte is 1, and the interval for the entry 1 in the first byte's array table 8 is [0, 6]. The second byte is 168, and the interval for the entry 168 in the second byte's array is [0, 1]. This process continues, yielding four intervals. The intersection of these four intervals is then taken. If there is no intersection, the IP address to be matched cannot be matched by the rule. If an intersection is found, such as [0, 1], it means that a rule in rule groups id0-1 matches the IP address to be matched.

[0111] ② Search the single-byte matching compressed table based on the intersection of the truncated arrays. In the above operation, the intersection of the truncated arrays has been obtained as [0,1], but it cannot be determined which rule group has a matching rule. The IP to be matched consists of four bytes: 1, 168, 1, and 135. The first byte is 1, which is the entry in the first single-byte matching compressed table 7. The rule group ID range is [0,1], and its value is 1 and 0. The second byte is 168, which is the entry in the second single-byte matching compressed table. The rule group ID range is [0,1], and its value is 1 and 1. This process continues to obtain 4 sets of bitmap values. These four bitmaps are then bitwise ANDed to obtain the rule group ID range of [0,1], and its bitmap value is 1 and 0.

[0112] This result indicates that a rule in rule group id 0 was matched, while no rule in rule group id 1 was matched. The compression of the matching table and the extraction of the intersection in this invention are intended to minimize the number of bits during the AND operation, thereby improving performance.

[0113] ③ Refined Binary Search Matching. In the above operations, we have obtained 512 rules in rule group id 0, some of which match, but we don't know which rule did. We perform a binary search match on these 512 rules. During preprocessing, the rule set has been reordered. We can directly compare the value obtained by ANDing the bitmask of the rule with the IP address to be matched (1.168.1.135) with the IP address of the rule with rule id 255, and then compare it with the IP address of that rule. If the value is less than the rule's IP address, we perform a binary search within rule ids 0-255; if it is greater, we perform a search within rule ids 256-511, and so on, until a matching rule is found.

[0114] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A traffic splitting method based on IP bitmask rules, characterized in that: Includes the following steps: S1. The traffic splitting device preprocesses the IP bitmask rule set. First, it sorts and preprocesses the rules by byte size. Then, when creating the bitmap, it uses high compression to compress K rules into 1 bit to obtain a single-byte compressed matching table. Then, it obtains the hit range array of each table entry through the single-byte compressed matching table to perform pre-filtering when performing matching search. The truncation range for single-byte compressed matching is: for the single-byte compressed matching table, the range of the first occurrence of 1 and the last occurrence of 1 in each table entry is recorded to obtain the hit range array; S2. After the live network traffic is input, the IP address in the traffic is extracted and matched with the IP mask rule set. If a match is found, the traffic is split according to the rules. S3. Output the offloaded traffic to the corresponding routing device. A traffic offloading method based on IP bitmask rules is completed.

2. The traffic splitting method based on IP bitmask rules according to claim 1, characterized in that: Step S1 includes the following steps: S11. Rule sorting and bitmask processing: Sort each rule in the IP bitmask rule set by bytes. Each rule in the rule set includes a rule number, an IP value, and a bitmask. Convert the IP value and bitmask in the rule into a bitmap by performing a bitwise AND operation. S12, Single-byte matching table: The rule set is divided according to each byte of the IP address to generate a single-byte matching table; S13. Single-byte matching table compression: The single-byte matching table is compressed into a group of K rules to obtain a rule group and form the single-byte compressed matching table. The compressed bitmap of each rule group represents the rule that may be matched on the byte. S14. Single-byte matching table truncation range: For the single-byte compressed matching table, record the range of the first occurrence of 1 and the last occurrence of 1 for each table entry to obtain the hit range array and use it for pre-filtering.

3. The traffic splitting method based on IP bitmask rules according to claim 2, characterized in that: In step S11, each rule in the IP bitmask rule set is converted to binary. The IP value and bitmask of each rule are then subjected to a bitwise AND operation and sorted in ascending order to obtain a rule set table sorted by the AND operation. In the bitmask binary table, the uncertain bit "0" is represented by "*", and each rule can represent multiple possible IP segments.

4. The traffic splitting method based on IP bitmask rules according to claim 2, characterized in that: In step S12, all rules are split into bytes and a single-byte matching table is constructed. Each entry represents a range, and an entry set to 1 indicates that the rule is matched. The IP address is split into 4 bytes to build a single-byte matching table. When searching for a match, the IP address to be matched is also split into bytes and matched one by one. Only when all four bytes are matched is the rule considered to be matched and traffic splitting is performed.

5. A traffic splitting method based on IP bitmask rules according to claim 2, characterized in that: In step S13, K is 512.

6. The traffic splitting method based on IP bitmask rules according to claim 5, characterized in that: In step S14, a range array is extracted based on the single-byte compressed matching table; a matching table is constructed for the 4 bytes of the IP address, and the range array is extracted sequentially. Determine if the number of bytes is less than 5. If yes, return to step S11; otherwise, preprocessing ends.

7. The traffic splitting method based on IP bitmask rules according to claim 1, characterized in that: Step S2 includes the following steps: S21. Split and search the truncated array: After inputting the live network traffic, extract the IPs from the traffic to obtain the IPs to be matched. Split the IPs to be matched into bytes, and obtain the range of each byte according to the truncated array. Take the intersection of the ranges of the four bytes. If there is no intersection, the IP to be matched does not match any rules. S22. Split the single-byte matching compressed table: Based on the intersection of the extracted arrays, search the single-byte matching compressed table for each byte of the IP to be matched to determine the possible matching rule groups; S23. Binary Refined Matching: Perform binary matching on the rules in the possible matching rule group; accurately find the matching rule by comparing the bitmask of the IP to be matched and the IP value of the rule, and after a match, split the traffic according to the rule.

8. A traffic splitting method based on IP bitmask rules according to claim 7, characterized in that: In step S21, if the ranges of the four bytes do not overlap, proceed to step S3, and the traffic splitting ends. If the ranges of the four bytes overlap, proceed to step S22.

9. A traffic splitting method based on IP bitmask rules according to claim 7, characterized in that: In step S22, all four bytes of the IP to be matched are searched against the single-byte matching compression table to obtain 4 sets of bitmap values. The rule group id range is obtained by performing a bitwise AND operation on these four bitmaps. Determine if there are any bits set to 1 in the bitmap value segment. If so, proceed to step S23; otherwise, proceed to step S3, and the traffic splitting ends.

10. A traffic splitting method based on IP bitmask rules according to claim 7, characterized in that: In step S23, the bitmask of the rule ID 255 is directly ANDed with the IP to be matched. The result of the AND operation is then compared with the rule IP value. If the result is less than the rule IP value, a binary search is performed in the rule IDs 0 to 255. If the result is greater than the rule IP value, a judgment is made in the rule IDs 256 to 511.

Images