Method for translating multi-language front-end into Yak bytecode of network security compiler

Abstract

The present invention relates to the field of automatic programming technology, and specifically discloses a method for translating a multi-language front end into a yak bytecode of a network security dedicated compiler, the method comprising: obtaining a target code, the target code being the code of a network security script written in a specified type of language; performing syntax analysis on the target code to obtain an abstract syntax tree corresponding to the target code; converting the syntax structure corresponding to each node in the abstract syntax tree corresponding to the target code into a yak bytecode according to the type of the syntax structure corresponding to each node; and compiling the yak bytecode into an executable file to implement the network security function corresponding to the network security script. The above scheme improves the accuracy of converting the network security script into the yak bytecode, and the execution effect of executing the network security script after converting it into the yak bytecode.

Description

Technical Field

[0001] The invention relates to the technical field of automatic programming, and specifically discloses a method for translating a multi-language front end into a yak bytecode of a network security special compiler. Background Art

[0002] As network security becomes increasingly important, the development of network security domain specific languages ​​(DSL) has become a hot topic. Existing network security scripting languages, such as NASL (Nessus Attack Scripting Language) and Lua, have been widely used in the field of network security.

[0003] NASL is deficient in performance and flexibility. Since NASL is designed specifically for Nessus, it can only run on the Nessus platform, which limits its scope of application. In addition, NASL's performance and flexibility are lower than other programming languages, making it difficult to meet complex network security needs. Although Lua performs well in terms of performance and flexibility, it lacks specificity in the field of network security. Lua is a general-purpose scripting language. Although it can be applied in the field of network security, its features and libraries are not specifically designed for network security, so it may not be efficient enough when handling some complex network security tasks. The yak bytecode is designed specifically for network security, and its syntax and instruction set are specifically optimized for network security tasks. Moreover, the yak bytecode can be easily integrated into various network security tools and platforms, and has good adaptability.

[0004] However, many existing network security scripts do not use YAK bytecode. If they need to be converted into YAK bytecode, manual conversion is required, which is inefficient and has poor accuracy. Summary of the invention

[0005] In view of this, the present application provides a method for translating a multi-language front-end into the YAK bytecode of a network security-specific compiler, which improves the accuracy of converting network security scripts into YAK bytecode, as well as the execution effect of network security scripts after conversion into YAK bytecode. The technical solution is as follows.

[0006] In a first aspect, a method for translating a multi-language front end into a yak bytecode of a network security dedicated compiler is provided, the method comprising:

[0007] Obtaining a target code; the target code is a code of a network security script written in a specified type of language;

[0008] Performing syntax analysis on the target code to obtain an abstract syntax tree corresponding to the target code; each node on the abstract syntax tree is used to indicate each syntax structure in the target code;

[0009] According to the type of the syntax structure corresponding to each node in the abstract syntax tree corresponding to the target code, convert the syntax structure corresponding to each node into a yak bytecode;

[0010] The yak bytecode is compiled into an executable file to implement the network security function corresponding to the network security script.

[0011] In a possible implementation, the specified type of language is NASL or Lua language.

[0012] In a possible implementation, according to the type of the syntax structure corresponding to each node in the abstract syntax tree corresponding to the target code, converting the syntax structure corresponding to each node into a yak bytecode includes:

[0013] For a target node in the target code, determining a target type of a grammatical structure corresponding to the target node;

[0014] A target mapping relationship is determined according to the target type, and a grammatical structure of the target node is converted into a yak bytecode according to the target mapping relationship.

[0015] In a possible implementation, the type of the grammatical structure includes at least one of a for each loop, a for i loop, an if statement, a switch statement, a function call, and a global variable access.

[0016] In a possible implementation, the performing syntax analysis on the target code to obtain an abstract syntax tree corresponding to the target code includes:

[0017] The target code is subjected to lexical analysis to obtain a lexical unit stream corresponding to the target code;

[0018] Reading lexical units in the lexical unit stream, and parsing the lexical units according to target grammar rules to construct nodes of an abstract syntax tree; the nodes in the abstract syntax tree include at least one of expressions, statements, and function definitions;

[0019] The nodes of the abstract syntax tree are connected according to the syntax structure to obtain the abstract syntax tree.

[0020] In a possible implementation, performing lexical analysis on the target code to obtain a lexical unit stream corresponding to the target code includes:

[0021] Splitting the target code into individual character streams;

[0022] The character stream is traversed, lexical units are extracted according to the terminal symbol rule in the target grammar rule, and a lexical unit stream is generated according to the type and value of the lexical unit.

[0023] In a second aspect, a device for translating a multi-language front end into yak bytecode of a network security dedicated compiler is provided, the device comprising:

[0024] A code acquisition module, used to acquire a target code; the target code is a code of a network security script written in a specified type of language;

[0025] A syntax analysis module, used for performing syntax analysis on the target code to obtain an abstract syntax tree corresponding to the target code; each node on the abstract syntax tree is used to indicate each syntax structure in the target code;

[0026] A conversion module, used for converting the syntax structure corresponding to each node in the abstract syntax tree corresponding to the target code into a yak bytecode according to the type of the syntax structure corresponding to each node in the abstract syntax tree corresponding to the target code;

[0027] The compiling module is used to compile the yak bytecode into an executable file to implement the network security function corresponding to the network security script.

[0028] In a third aspect, a computer device is provided, comprising a processor and a memory, wherein the memory stores at least one instruction, and the at least one instruction is loaded and executed by the processor to implement the above-mentioned yak bytecode method of translating a multi-language front end into a network security-specific compiler.

[0029] In a fourth aspect, a computer-readable storage medium is provided, wherein at least one instruction is stored in the storage medium, and the at least one instruction is loaded and executed by a processor to implement the above-mentioned yak bytecode method of translating a multi-language front end into a network security-specific compiler.

[0030] In a fifth aspect, a computer program product or a computer program is provided, wherein the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes a yak bytecode method of translating a multi-language front end into a network security-specific compiler.

[0031] The technical solution provided by this application may have the following beneficial effects:

[0032] When the code of the network security script written in the specified type of language is obtained, the target code can be parsed to construct an abstract syntax tree corresponding to the target code to mark the syntax structure in the target code and the connection between them. The computer device then converts the syntax structure corresponding to each node into yak bytecode according to the type of the syntax structure of each node, so that the yak bytecode can be compiled into an executable file, thereby realizing the network security function corresponding to the network security script. In the above scheme, for the code of the network security script written in the specified type of language, the syntax structure can be obtained through syntax analysis, and then different conversion methods can be selected according to the type of the syntax structure to accurately convert the syntax structure into yak bytecode, thereby improving the accuracy of converting the network security script into yak bytecode, and the execution effect of executing the network security script after converting it into yak bytecode. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 The diagram is a schematic structural diagram of a format conversion system according to an exemplary embodiment.

[0035] Figure 2 The present invention is a flow chart showing a method for translating a multi-language front end into yak bytecode of a network security-specific compiler according to an exemplary embodiment.

[0036] Figure 3 The present invention is a flow chart showing a method for translating a multi-language front end into yak bytecode of a network security-specific compiler according to an exemplary embodiment.

[0037] Figure 4 It is a structural diagram of a device for translating a multi-language front end into yak bytecode of a network security-specific compiler provided in an embodiment of the present application.

[0038] Figure 5 It is a structural schematic diagram of a computer device provided by an optional embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0040] In the description of the embodiments of the present application, the term "corresponding" may indicate a direct or indirect correspondence between two items, or an association relationship between the two items, or a relationship between indication and being indicated, configuration and being configured, and the like.

[0041] Figure 1 FIG. 1 is a schematic diagram showing a structure of a format conversion system according to an exemplary embodiment. Figure 1 As shown, the format conversion system includes a terminal device 110 and a server 120 .

[0042] Optionally, the server 120 can be used to translate the multi-language front end into the yak bytecode of the network security dedicated compiler. At this time, the user can transmit the network security script to the server 120 through the terminal device 110 via a wired or wireless network, and the server 120 converts the network security script into yak bytecode.

[0043] Optionally, the terminal device 110 can be used to translate the multi-language front end into the yak bytecode of the network security dedicated compiler. At this time, the terminal device 110 can obtain the network security script from the server 120 through a wired or wireless network, and then convert the network security script into yak bytecode, and compile and execute it.

[0044] Optionally, the above-mentioned server can be a server cluster or a distributed system composed of multiple physical servers, or it can be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms and other technical computing services.

[0045] Optionally, the system may further include a management device, which is used to manage the system (such as managing the connection status between each module and the server, etc.), and the management device is connected to the server via a communication network. Optionally, the communication network is a wired network or a wireless network.

[0046] Optionally, the above-mentioned wireless network or wired network uses standard communication technology and / or protocol. The network is usually the Internet, but it can also be any other network, including but not limited to any combination of local area network, metropolitan area network, wide area network, mobile, limited or wireless network, private network or virtual private network. In some embodiments, the technology and / or format including hypertext markup language, extensible markup language, etc. are used to represent the data exchanged through the network. In addition, conventional encryption technologies such as secure socket layer, transport layer security, virtual private network, Internet protocol security, etc. can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technology can also be used to replace or supplement the above-mentioned data communication technology.

[0047] Figure 2 The present invention is a flowchart of a method for translating a multi-language front end into a YAK bytecode of a network security dedicated compiler according to an exemplary embodiment. The method is executed by a computer device, which may be a computer device such as Figure 1 The terminal device 110 or the server 120 in the format conversion system shown. Figure 2 As shown, the method for translating the multi-language front end into the yak bytecode of the network security dedicated compiler may include the following steps:

[0048] Step 201, obtaining the target code.

[0049] The object code is a network security script code written in a specified type of language.

[0050] In the embodiment of the present application, the computer device may receive a target code input by a user or read from a database, that is, a network security script written in a specific language (such as NASL or Lua).

[0051] Optionally, after obtaining the target code, preprocessing work can be performed according to the code type of the target code, such as removing comments, standardizing the format, etc., so as to make the subsequent analysis process more accurate.

[0052] Step 202: perform syntax analysis on the target code to obtain an abstract syntax tree corresponding to the target code; each node on the abstract syntax tree is used to indicate each syntax structure in the target code.

[0053] The Abstract Syntax Tree (AST) is the core module of a compiler or interpreter. It converts the token stream generated by lexical analysis into a hierarchical tree structure for subsequent syntax analysis, semantic analysis, and code generation.

[0054] Before syntax analysis, the system will first perform lexical analysis to break down the target code into basic lexical units (Tokens). These lexical units represent keywords, identifiers, operators, etc. in the code. The system will parse the lexical unit stream into an abstract syntax tree through methods such as recursive descent parsing.

[0055] Step 203: According to the type of the syntax structure corresponding to each node in the abstract syntax tree corresponding to the target code, the syntax structure corresponding to each node is converted into a yak bytecode.

[0056] The system will traverse each node in the AST and select the corresponding conversion rule based on the node type (such as expression, statement, function definition, etc.) and the specific grammatical structure.

[0057] Specifically, through the pre-defined mapping relationship between syntax structure and yak bytecode, the system converts the syntax structure in AST into the corresponding yak bytecode instructions one by one. The syntax structure conversion includes operator conversion, control structure processing (such as loops, conditional statements) and function call mapping. Different syntax structures require different conversion methods to ensure the accuracy and efficiency of the conversion process.

[0058] As the AST is traversed and transformed, the system generates corresponding yak bytecode instruction sequences, which constitute the final bytecode program.

[0059] Step 204, compile the yak bytecode into an executable file to implement the network security function corresponding to the network security script.

[0060] Optionally, before compiling the yak bytecode into an executable file, the system will optimize and pre-check the generated bytecode to determine whether the yak bytecode has redundancy or errors, so as to improve the final execution efficiency and accuracy.

[0061] The system compiles the optimized yak bytecode sequence into a binary file or script that can be executed on the target platform, that is, through operations such as bytecode to machine code conversion and library call, an executable file is finally generated. The resulting executable file can be run on a specified network security platform to perform corresponding security detection, attack simulation or protection measures.

[0062] Compilation is the process of converting yak bytecode into a binary file that can be executed by the target machine. The executable file retains the functions of the original script, but after optimization and conversion, it has higher execution efficiency and security. The compiled result can be directly used in tools or applications in the network security environment and can run on various platforms. The compiled result in the embodiment of the present application can directly execute the network security function corresponding to the network security script.

[0063] And because the yak bytecode is designed specifically for network security, it can efficiently perform network security-related operations. Compared with NASL and Lua, the execution efficiency is improved. The execution of the yak bytecode does not require a complex interpretation process, which reduces resource consumption and improves execution efficiency.

[0064] This solution supports translating NASL and Lua language front-ends into yak bytecode, which improves the compatibility and flexibility of the language. The modular design of yak bytecode allows network security functions to be easily combined and expanded, improving development efficiency. Yak bytecode is designed specifically for network security, and its syntax and instruction set are optimized specifically for network security tasks, improving its specificity. Yak bytecode can be easily integrated into various network security tools and platforms, improving its applicability in the field of network security. By converting NASL and Lua code into yak bytecode, the learning cost and development time of developers are reduced. The modular yak bytecode design makes the development and maintenance of network security functions more efficient. The compilation process of yak bytecode can protect the source code and reduce the risk of reverse engineering. Yak bytecode can realize more complex and advanced network security functions and improve network security protection capabilities. In practical applications, through comparative tests, it is found that the yak bytecode generated by this solution has significant advantages in execution efficiency and resource consumption. At the same time, yak bytecode shows higher flexibility and specificity when dealing with complex network security tasks, improving the development efficiency of network security functions.

[0065] In summary, when the code of a network security script written in a specified type of language is obtained, the target code can be parsed to construct an abstract syntax tree corresponding to the target code to mark the syntax structure in the target code and the connection between them. The computer device then converts the syntax structure corresponding to each node into yak bytecode according to the type of the syntax structure of each node, so that the yak bytecode can be compiled into an executable file, thereby realizing the network security function corresponding to the network security script. In the above scheme, for the code of the network security script written in a specified type of language, the syntax structure can be obtained through syntax analysis, and then different conversion methods can be selected according to the type of the syntax structure to accurately convert the syntax structure into yak bytecode, thereby improving the accuracy of converting the network security script into yak bytecode, and the execution effect of executing the network security script after converting it into yak bytecode.

[0066] Figure 3 The present invention is a flowchart of a method for translating a multi-language front end into a YAK bytecode of a network security dedicated compiler according to an exemplary embodiment. The method is executed by a computer device, which may be a computer device such as Figure 1The terminal device 110 or the server 120 in the format conversion system shown. Figure 2 As shown, the method for translating the multi-language front end into the yak bytecode of the network security dedicated compiler may include the following steps:

[0067] Step 301, obtaining a target code; the target code is a network security script code written in a specified type of language.

[0068] The various steps in the embodiments of the present application can be used to build a compiler, thereby realizing the process of converting a specified type of language into yak bytecode and compiling it.

[0069] Specifically, in the design process of the compiler, it is first necessary to define an extended Backus-Naur Form (eBNF) for the target programming language. eBNF is a metalanguage used to describe grammatical rules, which defines the lexical structure and grammatical structure of the language. eBNF rules include non-terminals (symbols representing grammatical structures), terminals (symbols representing specific vocabulary, such as keywords, operators, etc.), and their combinations.

[0070] Optionally, in an embodiment of the present application, the specified type of language is NASL or Lua language.

[0071] When converting the format of a network security script, the computer device first needs to obtain the target code, which is usually a network security script written in a specific language (such as NASL or Lua). The target code is the basis of the entire conversion process, and all subsequent operations are based on this code.

[0072] Step 302: perform lexical analysis on the target code to obtain a lexical unit stream corresponding to the target code.

[0073] In a possible implementation, the target code is divided into character streams; the character stream is traversed, lexical units are extracted according to the terminal symbol rules in the target grammar rules (that is, the above-mentioned eBNF rules), and a lexical unit stream is generated according to the type and value of the lexical unit.

[0074] Specifically, the computer device reads the target code from the file or memory and represents it as a character stream. Each character represents a basic unit in the source code. When generating the character stream, meaningless whitespace characters (such as spaces, tabs, and newlines) and comments are usually removed first. These characters will not be converted into lexical units, but they may still be important for understanding the code structure, so the associated position of the comment information needs to be retained during preprocessing.

[0075] Furthermore, the lexical analyzer needs to define a set of rules (i.e., terminal rules) according to the grammar of the target language to identify different lexical units in the character stream. The terminal rules are usually implemented based on regular expressions or finite state machines. In an embodiment of the present application, lexical unit types include keywords, identifiers, constants, operators, and separators.

[0076] Furthermore, the computer device may traverse each character one by one starting from the start position of the character stream, and match each character according to a preset matching priority to obtain each lexical unit.

[0077] The preset matching priority may be that when a character sequence can match multiple lexical unit rules, a longest match first strategy is adopted, that is, a rule that can match the longest character sequence is selected.

[0078] During the lexical analysis process, if an unmatched character sequence is encountered, the lexical analyzer needs to report an error. And in order to improve the analysis efficiency, even in the case of an error, the lexical analyzer may try to skip the error part and continue to recognize subsequent lexical units.

[0079] Step 303, read the lexical units in the lexical unit stream, and parse the lexical units according to the target grammar rules to construct each node of the abstract syntax tree; the nodes in the abstract syntax tree include at least one of expressions, statements and function definitions.

[0080] The Abstract Syntax Tree (AST) is a structured representation of the source code, which retains the grammatical structure of the code but omits unnecessary details (such as semicolons, brackets, etc.). Specifically, after obtaining the lexical unit stream, it can be used as input to build the AST. Each lexical unit represents a basic element in the source code (such as keywords, operators, identifiers, etc.). The parser identifies the relationship between lexical units and constructs the corresponding grammatical structure by applying the grammatical rules of the target language (that is, the grammatical rules defined by eBNF).

[0081] Each node in the AST represents a syntactic structure in the source code. Common node types include:

[0082] Expression Nodes: such as binary operations (a + b) and function calls (print(a)).

[0083] Statement Nodes: such as assignment statements, control flow statements (if, for).

[0084] Declaration Nodes: such as variable declaration and function declaration.

[0085] Each node usually contains attributes related to the grammatical structure, such as the type of operator node (addition, subtraction), the name of identifier node, the value of constant node, etc.

[0086] Step 304: Connect the nodes of the abstract syntax tree according to the syntax structure to obtain the abstract syntax tree.

[0087] Each node on the abstract syntax tree is used to indicate each syntax structure in the target code.

[0088] Specifically, the parser applies the grammatical rules of the language one by one, matches the fragments that meet the rules from the lexical unit stream, and converts them into AST nodes. When a grammatical structure contains other grammatical structures (for example, a function body contains multiple statements), the parser recursively generates subtrees and combines these subtrees into a complete AST.

[0089] Step 305: for a target node in the target code, determine a target type of a grammatical structure corresponding to the target node.

[0090] For example, in an embodiment of the present application, the target type is used to indicate the functional type and statement structure of the target code; the functional type is used to indicate what function the target code corresponding to the target node is used to perform, such as executing a loop or executing a condition; the statement structure represents what sentence pattern is used when executing a certain function, for example, the loop function includes a for loop and a while loop, wherein the for loop can also be specifically divided into a for each loop and a for i loop; the conditional statement can be an If-Else statement or a Switch statement.

[0091] For example, in an embodiment of the present application, the type of the grammatical structure may include at least one of a for each loop, a for i loop, an if statement, a switch statement, a function call, and a global variable access.

[0092] Step 306: determine a target mapping relationship according to the target type, and convert the grammatical structure of the target node into a yak bytecode according to the target mapping relationship.

[0093] Since each grammatical structure has different semantics and execution logic in the source language, and these semantics and logic need to be mapped to corresponding instructions in the YAK bytecode, different grammatical structure types are handled differently when converted to YAK bytecode.

[0094] Specifically, in an embodiment of the present application, for the target code corresponding to the target node, it is first determined whether the function type of the target node exists in the mapping table. If so, keyword recognition is performed on the target code, and the statement structure corresponding to the target node is determined based on the recognition result, so as to select the corresponding target mapping relationship according to the function type and statement structure of the target node, thereby converting the grammatical structure of the target node into yak bytecode.

[0095] For example, for a loop function, when it is determined that the loop function is a for loop, it is also necessary to determine whether it is a for i loop statement or a for each loop statement based on the keywords. Then the computer device also needs to identify each substructure in the loop statement and determine the initialization part, conditional part, and iteration part in the target code corresponding to the target node. For example:

[0096] Initialization part: For example, i = 1, which is usually converted into an assignment instruction in the yak bytecode.

[0097] Conditional part: For example, i<= 10 will be converted into a comparison instruction to determine whether to continue the loop.

[0098] Iteration part: For example, i = i + 1 will be converted into an increment instruction.

[0099] Loop body: The statements in the loop body (such as print(i)) will be converted into corresponding yak bytecode instructions one by one.

[0100] Jump instruction: After the loop body is executed, the yak bytecode will contain a jump instruction to jump back to the place where the condition is checked to decide whether to continue the loop.

[0101] Similarly, the while loop mainly consists of two parts: condition check and loop body. Yak bytecode needs to generate a precondition judgment instruction, then decide whether to enter the loop body based on the judgment result, and finally generate a jump instruction at the end of the loop body to return to the condition judgment position.

[0102] Similarly, for the conditional function, when it is determined that the conditional function is an If-Else statement, it is also necessary to identify the conditional substructure, jump substructure and end jump substructure in the code part of the If-Else statement, and convert them into conditional instructions, jump instructions and end jump instructions respectively.

[0103] In summary, when determining the target mapping relationship according to the target type, it is necessary to determine the statement structure corresponding to the target type, then split the statement structure into various substructures (to represent various parts in the code), and find the mapping relationship between each substructure and the yak bytecode instruction in the preset mapping table as the target mapping relationship.

[0104] When the mapping relationship between each part of the code and the yak bytecode instructions is found, the target code can be converted into yak bytecode according to the mapping relationship.

[0105] Optionally, in an embodiment of the present application, in the process of converting the target code of the network security script into YAK bytecode, there may be unconvertible parts (that is, statement structures that cannot be found in the preset mapping table, or statement structures of unrecognizable types). In this case, the computer device will mark the target code, skip this part of the code, and first convert the convertible part in the target code into YAK bytecode through the target mapping relationship.

[0106] Then the computer device can first try to compile according to the yak bytecode to generate an initial executable file. The computer device tries to execute the executable file to determine whether the executable file can work normally. If it can, it means that the unconvertible part does not need to be converted into yak bytecode, and the remaining part can already constitute a complete code logic; if it cannot, the computer device will issue an alarm to prompt manual confirmation and conversion of the unconvertible part of the code. If the manually updated yak bytecode is received, and the executable file compiled according to the updated yak bytecode can work normally, the computer will automatically store the mapping relationship between the unconvertible code and the yak bytecode and save it in a preset mapping table.

[0107] Optionally, in the embodiment of the present application, during the process of converting the target code into the yak bytecode, the target code will be detected for optimizability. If the optimizable code is detected, the code can be optimized according to the preset rules, and the optimized code can be converted into the yak bytecode. For example, the optimizable code includes loop code with a small number of iterations, in which case the loop code can be converted into multiple single execution steps; for example, the optimizable code also includes constant expressions, and the computer can calculate the constant expressions in advance and directly convert the calculation results into the yak bytecode, thereby reducing the conversion steps of the yak bytecode.

[0108] Furthermore, when implementing these transformations, the compiler generates bytecodes based on its internal design and optimization strategies. The compiler may try to reduce the number of loops, optimize the prediction of conditional branches, reduce memory accesses, and other methods to improve the execution efficiency of the program. Multiple factors are weighed when selecting a transformation algorithm. Optimized bytecodes may improve the execution efficiency of the program, but may increase the size of the bytecode and the compilation time. However, if too much emphasis is placed on code size or compilation speed, some execution efficiency may be sacrificed.

[0109] How the compiler handles specific syntax structures (such as loops, conditional statements, etc.) will directly affect the generated bytecode. For example, the for each loop may need to be implemented as an iterative access to a collection at the bytecode level, while the for i loop may need to be implemented as an index-based loop. These different implementations will affect the execution efficiency and memory usage of the program.

[0110] Specifically, in the process of converting the target code into yak bytecode, when the computer device detects that there is a loop body code in the target code, the loop body code can be copied multiple times to reduce the number of loop iterations. Optionally, if the computer device detects that there are conditions that can be merged between multiple loops in the target code, the multiple mergeable loops are merged into one loop. Optionally, the computer device can also analyze the use of variables in the loop body and optimize the induction variables (variables whose values ​​change with loop iterations) in the loop to reduce the amount of calculation. Optionally, the computer device can also eliminate unnecessary boundary check codes when it is determined that array access will not cross the boundary. Optionally, the computer device can also detect more complex loop codes to determine whether the loop code can be divided into multiple small small loops that can be processed in parallel to reduce the number of iterations of each loop and improve parallel processing capabilities.

[0111] Specifically, the computer can also predict the direction of branches at compile time based on the pattern of the code (such as conditional expressions that usually do not change in loops). For code that often takes the same branch, instructions are inserted or the code is reorganized to minimize the overhead of jumps or mispredictions. In addition, the branch prediction mechanism is indirectly affected by optimizing the code structure (such as loop unrolling, branch sorting, etc.).

[0112] Optionally, after the computer device converts the grammatical structure of the target node into a yak bytecode according to the target mapping relationship, it searches the historical yak bytecode of the target code to see whether there is a yak bytecode converted from a conditional statement with the same condition. If there is a yak bytecode converted from a conditional statement with the same condition, the yak bytecode is merged according to the same condition to obtain a new yak bytecode to reduce the number of jump instructions.

[0113] Optionally, when the computer device converts the grammatical structure of the target node into the yak bytecode according to the target mapping relationship, if it is determined that there is a conditional branch in the code corresponding to the target node that cannot be executed, the code portion corresponding to the conditional branch is deleted to avoid additional overhead at runtime. The conditional branch cannot be executed, for example, the value of the conditional expression is known at compile time, or the conditional expression is wrong and illogical.

[0114] Furthermore, in the process of converting the grammatical structure of the target node into the yak bytecode, the computer device will also count the usage frequency of each local variable and save the local variables with higher usage frequency in registers to reduce the access to the memory.

[0115] The computer device may also rearrange the layout of members in a structure or class to reduce padding and improve the efficiency of memory access; at the same time, use a more compact data structure or data structure collection to reduce memory usage and improve cache utilization.

[0116] If the number of cache misses in the computer device reaches a specified number, the computer device may rearrange the order of loop iterations or data structure accesses to reduce the number of cache misses.

[0117] Optionally, the computer device may also identify and eliminate access to unused data resulting from code optimization or dead code elimination.

[0118] Step 307: compile the yak bytecode into an executable file to implement the network security function corresponding to the network security script.

[0119] In summary, when the code of a network security script written in a specified type of language is obtained, the target code can be parsed to construct an abstract syntax tree corresponding to the target code to mark the syntax structure in the target code and the connection between them. The computer device then converts the syntax structure corresponding to each node into yak bytecode according to the type of the syntax structure of each node, so that the yak bytecode can be compiled into an executable file, thereby realizing the network security function corresponding to the network security script. In the above scheme, for the code of the network security script written in a specified type of language, the syntax structure can be obtained through syntax analysis, and then different conversion methods can be selected according to the type of the syntax structure to accurately convert the syntax structure into yak bytecode, thereby improving the accuracy of converting the network security script into yak bytecode, and the execution effect of executing the network security script after converting it into yak bytecode.

[0120] In the embodiments of the present application, a device for translating a multilingual front end into the yak bytecode of a network security dedicated compiler is also provided, and the device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0121] The embodiment of the present application provides a device for translating a multi-language front end into yak bytecode of a network security dedicated compiler, Figure 4: is a schematic diagram of the structure of a device for translating a multi-language front end into a yak bytecode of a network security dedicated compiler provided in an embodiment of the present application, the device comprising:

[0122] The code acquisition module 401 is used to acquire the target code; the target code is the code of the network security script written in a specified type of language;

[0123] A syntax analysis module 402 is used to perform syntax analysis on the target code to obtain an abstract syntax tree corresponding to the target code; each node on the abstract syntax tree is used to indicate each syntax structure in the target code;

[0124] A conversion module 403, configured to convert the syntax structure corresponding to each node in the abstract syntax tree corresponding to the target code into a yak bytecode according to the type of the syntax structure corresponding to each node in the abstract syntax tree corresponding to the target code;

[0125] The compiling module 404 is used to compile the yak bytecode into an executable file to implement the network security function corresponding to the network security script.

[0126] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0127] In this embodiment, the device for translating the multi-language front end into the YAK bytecode of the network security dedicated compiler is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0128] The embodiment of the present invention also provides a computer device having the above Figure 4 The multi-language front end shown is a device for translating into the YAK bytecode of a network security-specific compiler.

[0129] See also Figure 5 , Figure 5 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 5As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the computer device, including instructions stored in or on the memory to display graphic information in a graphical user interface on an external input / output device (such as a display device coupled to an interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0130] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0131] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0132] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0133] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0134] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0135] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0136] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0137] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention. Such modifications and variations are all within the scope defined by the present invention.

Claims

1. A method for translating a multi-language front end into yak bytecode of a network security compiler, characterized in that: The method comprises: Obtaining a target code; the target code is a code of a network security script written in a specified type of language; Performing syntax analysis on the target code to obtain an abstract syntax tree corresponding to the target code; each node on the abstract syntax tree is used to indicate each syntax structure in the target code; According to the type of the syntax structure corresponding to each node in the abstract syntax tree corresponding to the target code, convert the syntax structure corresponding to each node into a yak bytecode; Compiling the yak bytecode into an executable file to implement the network security function corresponding to the network security script; The converting the syntax structure corresponding to each node in the abstract syntax tree corresponding to the target code into a yak bytecode according to the type of the syntax structure corresponding to each node in the abstract syntax tree corresponding to the target code includes: For a target node in the target code, determining a target type of a grammatical structure corresponding to the target node; Determine a target mapping relationship according to the target type, and convert the grammatical structure of the target node into a yak bytecode according to the target mapping relationship; the target type is used to indicate the function type and sentence structure of the target code; the function type is used to indicate the function that the target code corresponding to the target node is used to execute; the sentence structure is used to indicate the sentence pattern used when executing the function; The determining of the target mapping relationship according to the target type includes: When determining the target mapping relationship according to the target type, a statement structure corresponding to the target type is determined, the statement structure is split into various substructures, and a mapping relationship between each substructure and a yak bytecode instruction is searched in a preset mapping table as a target mapping relationship; When it is determined that the function type is a loop function and the statement structure is a for i loop statement or a for each loop statement, the substructures include an initialization part, a conditional part and an iteration part; when it is determined that the function type is a conditional function and the statement structure is an If-Else statement, the substructures include a conditional substructure, a jump substructure and an end jump substructure.

2. The method according to claim 1, characterized in that The specified type of language is NASL or Lua language.

3. The method according to claim 2, characterized in that The type of the grammatical structure includes at least one of a for each loop, a for i loop, an if statement, a switch statement, a function call, and a global variable access.

4. The method according to any one of claims 1 to 3, characterized in that: The step of performing syntax analysis on the target code to obtain an abstract syntax tree corresponding to the target code includes: Performing lexical analysis on the target code to obtain a lexical unit stream corresponding to the target code; Reading lexical units in the lexical unit stream, and parsing the lexical units according to target grammar rules to construct nodes of an abstract syntax tree; the nodes in the abstract syntax tree include at least one of expressions, statements, and function definitions; The nodes of the abstract syntax tree are connected according to the syntax structure to obtain the abstract syntax tree.

5. The method according to claim 4, characterized in that The step of performing lexical analysis on the target code to obtain a lexical unit stream corresponding to the target code includes: Splitting the target code into individual character streams; The character stream is traversed, lexical units are extracted according to the terminal symbol rule in the target grammar rule, and a lexical unit stream is generated according to the type and value of the lexical unit.

6. A device for translating a multi-language front end into yak bytecode of a network security compiler, characterized in that: The device comprises: A code acquisition module, used to acquire a target code; the target code is a code of a network security script written in a specified type of language; A syntax analysis module, used for performing syntax analysis on the target code to obtain an abstract syntax tree corresponding to the target code; each node on the abstract syntax tree is used to indicate each syntax structure in the target code; A conversion module, used for converting the syntax structure corresponding to each node in the abstract syntax tree corresponding to the target code into a yak bytecode according to the type of the syntax structure corresponding to each node in the abstract syntax tree corresponding to the target code; A compiling module, used for compiling the yak bytecode into an executable file to implement the network security function corresponding to the network security script; The conversion module is further used to determine, for a target node in the target code, a target type of a grammatical structure corresponding to the target node; Determine a target mapping relationship according to the target type, and convert the grammatical structure of the target node into a yak bytecode according to the target mapping relationship; the target type is used to indicate the function type and sentence structure of the target code; the function type is used to indicate the function that the target code corresponding to the target node is used to execute; the sentence structure is used to indicate the sentence pattern used when executing the function; The conversion module is further used for: When determining the target mapping relationship according to the target type, a statement structure corresponding to the target type is determined, the statement structure is split into various substructures, and a mapping relationship between each substructure and a yak bytecode instruction is searched in a preset mapping table as a target mapping relationship; When it is determined that the function type is a loop function and the statement structure is a for i loop statement or a for each loop statement, the substructures include an initialization part, a conditional part and an iteration part; when it is determined that the function type is a conditional function and the statement structure is an If-Else statement, the substructures include a conditional substructure, a jump substructure and an end jump substructure.

7. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method of translating a multi-language front end into the yak bytecode of a network security dedicated compiler according to any one of claims 1 to 5 by executing the computer instructions.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions for causing a computer to execute the method of translating a multi-language front end into yak bytecode of a network security-specific compiler according to any one of claims 1 to 5.

9. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the method of translating a multi-language front end into yak bytecode of a network security-specific compiler as described in any one of claims 1 to 5.

Images