Automaton and method for data parsing and matching based on packet classification rule definition

Abstract

The present application relates to the technical field of data parsing, and in particular to an automaton and method for data parsing and matching based on packet classification rule definitions. The automaton of the present application includes: a parsing pattern construction module, which constructs a parsing automaton according to the protocol field parsing requirements defined in the rules; a feature automaton construction module, which classifies the same fields according to the feature options of the rules and generates a feature automaton; an automaton nesting construction module, which embeds the generated feature automaton running state into the corresponding parsing automaton state to construct a complete nested structure; finally, the automaton running module drives the nested structure to complete the parsing decoding and feature matching of the input message at one time, and outputs the matching result. The nested automaton structure seamlessly integrates the parsing and matching processes, avoids redundant calculations and repeated data scanning, and eliminates the overhead of module switching, thereby significantly improving the overall processing efficiency and giving full play to the hardware performance.

Description

Technical Field

[0001] The present application relates to the technical field of data parsing, and in particular to an automaton and method for data parsing and matching based on packet classification rule definitions. Background Art

[0002] Packet classification technology, as a fundamental means of data preprocessing, is widely used in scenarios such as internet traffic statistics analysis and data restoration analysis. The packet classification system parses incoming network packet data, extracts packet information fields, and matches them with the features described by the user-entered packet classification rules. It then performs corresponding actions on matching packets, such as forwarding, discarding, or marking. With the increasing popularity of internet applications, packet classification technology faces significant challenges, including a rapid increase in protocol types, increasing parsing complexity, and the continued expansion of required network bandwidth, placing extremely high demands on its performance.

[0003] Existing software package classification systems typically adopt a modular design, implementing message parsing and rule-based feature matching logic as separate modules. Due to the numerous layers of network protocols, multiple parsing modules are required to perform different levels of analysis. Feature matching also requires multiple matching engines to process different types of features.

[0004] This decentralized modular architecture presents several issues. First, it leads to a significant amount of redundant parsing and computation during packet classification, with message data segments frequently scanned repeatedly by multiple modules. Second, frequent switching between modules introduces additional interface overhead. Overall, existing technologies lack a unified architecture, making it difficult to dynamically tailor and optimize core processes based on user rules. This often results in a significant amount of unnecessary computation. This, combined with the overhead of repeated scanning and module switching, leads to low overall processing efficiency and underutilization of hardware performance. This situation warrants further improvement. Summary of the Invention

[0005] In order to solve the problem of low processing efficiency in existing packet classification systems, this application provides an automatic machine and method for data parsing and matching based on packet classification rule definition, using the following technical solutions:

[0006] In a first aspect, the present application provides an automaton for data parsing and matching based on packet classification rule definitions, comprising:

[0007] Parsing pattern construction module, used to construct parsing automaton according to the protocol field parsing requirements defined in the packet classification rules;

[0008] A feature automaton construction module is used to classify multiple feature options of the same field according to the protocol field feature options defined in the packet classification rules and generate corresponding feature automata;

[0009] The automaton nesting construction module is used to embed the runtime state of the generated feature automaton into the state of the corresponding parsing automaton to construct a complete nested automaton structure;

[0010] The automaton operation module is used to drive the operation of the constructed nested automaton structure, perform parsing, decoding and feature matching operations on the input data message, and output the matching results.

[0011] By adopting the above technical solution, since the existing software package classification system adopts a decentralized modular design, there are a large number of redundant parsing calculations in the packet classification process, the message data segments are scanned repeatedly, and the interface overhead caused by frequent switching between modules, resulting in low overall processing efficiency. The present application proposes a data parsing and matching automaton based on the packet classification rule definition, including: a parsing pattern construction module, which constructs a parsing automaton according to the protocol field parsing requirements defined in the rule; a feature automaton construction module, which classifies the same fields according to the feature options of the rule and generates a feature automaton; an automaton nesting construction module, which embeds the generated feature automaton running state into the corresponding parsing automaton state to construct a complete nested structure; finally, the automaton running module drives the nested structure to complete the parsing decoding and feature matching of the input message at one time, and outputs the matching result, effectively solving the various inefficiencies brought about by the traditional decentralized modular architecture, and seamlessly integrating the parsing and matching processes through the nested automaton structure, avoiding redundant calculations and repeated data scanning, while eliminating the overhead of module switching, thereby significantly improving the overall processing efficiency and giving full play to the hardware performance.

[0012] Optionally, the parsing pattern construction module includes:

[0013] A mode selection unit is used to select a corresponding parsing mode from a preset protocol field parsing mode set according to the protocol field parsing requirements defined in the packet classification rules;

[0014] The parsing automaton construction unit is used to construct a parsing automaton by combining the selected parsing patterns or connecting them in series.

[0015] By adopting the above-mentioned technical solution, the pattern selection unit of the present application selects the corresponding parsing pattern from the system preset protocol field parsing pattern set according to the protocol field parsing requirements defined in the packet classification rules, and the parsing automaton construction unit merges the selected parsing patterns through pattern union or pattern concatenation to construct a parsing automaton for the rule requirements; through a step-by-step method of dynamic selection and merging, a streamlined parsing automaton is generated according to the specific requirements of different rules, avoiding the execution of redundant parsing operations, thereby further reducing unnecessary computing overhead and improving parsing efficiency.

[0016] Optionally, the state of the parsing automaton includes:

[0017] A feature automaton for storing the end identifier of a field;

[0018] Variable used to calculate the offset value of the end position of the current field;

[0019] Variable used to store the index of the embedded feature automaton state.

[0020] By adopting the above technical solution, each parsing automaton state of the present application contains a feature automaton for storing the field end identifier. When parsing to this state, it can be determined whether the field has been parsed based on the automaton. Secondly, the state also contains a variable for calculating the offset value of the current field end position relative to the message start position, providing position information for feature matching. Finally, the state also contains a variable for storing the state index of the feature automaton embedded in the state as the entry for starting feature matching; through this special state design, when the parsing automaton runs to a certain state, it can automatically determine the field starting boundary and obtain the field starting position based on the stored information, and immediately start the corresponding feature automaton to perform the matching operation, thereby realizing seamless integration of parsing and matching.

[0021] Optionally, the feature automation construction module includes:

[0022] The rule parsing unit is used to parse the feature options described in the rule set and classify the feature options of the same field according to the field type;

[0023] The automaton compilation unit is used to compile the classified feature options into corresponding feature automata.

[0024] By adopting the above technical solution, since the packet classification rules usually contain multiple different feature options for the same protocol field, in order to avoid constructing an automaton separately for each feature option, thereby wasting resources, the present application parses all feature options described in the rule set through a rule parsing unit, and classifies multiple feature options for the same field according to their corresponding field types. Then, the automaton compilation unit compiles the classified feature option set into a corresponding feature automaton; by having multiple feature options share the same automaton, the waste of resources caused by constructing an automaton separately for each option is avoided; at the same time, classification by field type ensures that similar options can be efficiently represented by one automaton.

[0025] Optionally, the automaton nested construction module includes:

[0026] A mapping table building unit, used to build a mapping table of the correspondence between parsing status and protocol field ID;

[0027] The nested association unit is used to embed the runtime state of the constructed feature automaton into the corresponding parsing automaton state according to the mapping table.

[0028] By adopting the above technical solution, since the parsing automaton and the feature automaton correspond to different levels of the protocol respectively, in order to accurately start the feature automaton related to the current parsing field when the parsing automaton is running, the present application defines the state mapping and nested association process in the automaton nested construction module. First, the mapping table construction unit establishes a mapping table of the correspondence between the parsing state and the protocol field ID, which corresponds to the specific protocol field parsed by each parsing state; secondly, the nested association unit embeds the runtime state of the constructed feature automaton into the corresponding parsing automaton state according to the above mapping table. When the parsing automaton runs to a certain state, it can accurately start the corresponding feature automaton according to the field ID mapped to the state; through the design of state mapping and nested association, a close binding relationship is established between the parsing automaton and the feature automaton, so that the parsing and matching processes can be seamlessly switched and run collaboratively and efficiently, reducing the complexity and implementation difficulty of the system.

[0029] Optionally, the automatic machine operation module includes:

[0030] Initialization unit, used to initialize message information and status information;

[0031] Parsing drive unit, used to drive the parsing automaton to scan and parse the input message data;

[0032] The feature driving unit is used to perform feature matching processing on the parsed protocol fields according to the embedded feature automaton.

[0033] By adopting the above technical solution, since the nested automaton structure seamlessly integrates the parsing and matching processes, in order to efficiently drive the unified structure to perform one-time processing on the message, first, the initialization unit will initialize the message information and status information to prepare for subsequent processing. Secondly, the parsing drive unit drives the parsing automaton to scan and parse the input message data. In this process, once the state embedded with the feature automaton is parsed, the parsing drive unit will automatically trigger the feature drive unit to execute the work; finally, the feature drive unit performs feature matching processing on the parsed protocol field according to the embedded feature automaton, and after completing the matching task of the field, it returns control to the parsing drive unit to continue parsing; through the method of parsing drive, feature drive, and alternating execution, efficient driving of the nested automaton structure is achieved, so that the parsing and matching processes can be closely coordinated, quickly and efficiently completed within a single module, avoiding the overhead of module switching and data conversion in traditional technologies.

[0034] Optionally, the automaton operation module further includes a PKT structure for storing data information during the automaton operation process. The PKT structure includes:

[0035] The message information field is used to store the address index and length information of the original message data;

[0036] The parsing status field is used to store the running status of the current parsing automaton;

[0037] The feature status field is used to store the current running status of the feature automaton;

[0038] The message position field is used to store the byte position of the message currently being processed;

[0039] The message end field is used to store the message end position;

[0040] The parsing result field is used to store the message parsing result information generated during the operation of the automaton;

[0041] The matching result field is used to store the feature matching result information generated during the operation of the automatic machine.

[0042] By adopting the above technical solution, since the automaton operation module needs to maintain a large amount of intermediate state and result information during the parsing and matching process, in order to ensure the efficiency and convenience of data access, the present application designs a unified data storage structure PKT. The PKT structure includes multiple fields for storing various data information during the automaton operation process: first, it contains a message information field for storing the address index and length information of the original message data, facilitating fast access to the message; second, it contains a parsing state field and a feature state field for storing the running state of the current parsing automaton and the feature automaton, respectively, supporting the resumption of execution of the automaton state after an interruption; third, it contains a message position field and a message end field for recording the byte position and message end position of the currently processed message, providing position information for the parsing and matching process; finally, it contains a parsing result field and a matching result field for storing the message parsing result and feature matching result information generated during the automaton operation; through this unified PKT structure design, the automaton operation module can efficiently access and update all necessary information in the same data space, greatly reducing the overhead of data exchange and state maintenance, and improving operation efficiency. At the same time, it also simplifies the automation control logic and improves reliability.

[0043] Optionally, the analysis driving unit includes:

[0044] The message reading subunit is used to read the message bytes in sequence according to the position indicated by the message position field of the PKT structure and input them into the parsing automaton to drive the migration of the parsing status field;

[0045] The byte jump subunit is used to call the byte jump function defined in the parsing automaton state, skip the message data segment that does not need to be parsed, and update the message position field of the PKT structure;

[0046] The byte preprocessing subunit is used to call the byte operation function defined in the parsing automaton state to perform preprocessing on the input bytes;

[0047] The feature-driven calling subunit is used to drive the operation of the embedded feature automaton according to the receiving state reached by the parsing automaton.

[0048] By adopting the above technical solution, since the parsing driving unit needs to efficiently drive the parsing automaton to scan and process the input message, in order to maximize the parsing efficiency, this application has made a refined division of labor in the design of the parsing driving unit; first, the message reading subunit reads the message bytes in sequence according to the position indicated by the message position field in the PKT structure and inputs the parsing automaton to drive the parsing state field to perform state migration; secondly, the byte jump subunit calls the byte jump function defined in the parsing automaton state, which can skip the data segments in the input message that do not need to be parsed, and update the message position field in the PKT structure, avoiding unnecessary processing of these data. Scan; again, the byte preprocessing subunit calls the byte operation function defined in the parsing automaton state, and performs necessary preprocessing on the input bytes, such as big-endian and small-endian conversion, mask operations, etc., to prepare data for the automaton state migration; finally, the feature-driven calling subunit drives the operation of the embedded feature automaton according to the special receiving state reached by the parsing automaton, and performs corresponding feature matching operations; through the division of labor and cooperation of the parsing drive units, the parallel computing capabilities of modern processors are fully utilized, a highly refined message processing flow is realized, and feature matching is automatically triggered when needed, so that the parsing and matching processes can be seamlessly connected and operate efficiently.

[0049] Optionally, the feature driving unit includes:

[0050] The feature reading subunit is used to read the message bytes in sequence according to the position indicated by the message position field of the PKT structure and input them into the feature automaton to drive the migration of the feature state field;

[0051] The result recording subunit is used to write the rule index information identified by the receiving state reached by the feature automaton into the matching result field of the PKT structure;

[0052] The matching feedback subunit is used to return the matching result and matching position of the feature automaton to the corresponding parsing automaton state. The parsing drive unit updates the message position field of the PKT structure according to the matching position to skip the matched message data segment.

[0053] By adopting the above-mentioned technical solution, this application realizes efficient interaction between the parsing driver unit and the feature driver unit under the support of the PKT structure. The parsing driver is responsible for message scanning and state switching. Once it switches to the state of the embedded feature automaton, it triggers the feature driver to perform the matching operation; after the matching is completed, the feature driver feeds back the result to the parsing driver to adjust the message scanning position, and the above process is repeated, thereby avoiding the overhead of module switching; at the same time, through the mediation of PKT, data copying is effectively reduced and the overall execution efficiency is improved.

[0054] In a second aspect, the present application provides a data parsing and matching method based on packet classification rule definition, comprising the following steps:

[0055] Construct a parsing automaton based on the protocol field parsing requirements defined in the packet classification rules;

[0056] According to the protocol field feature options defined in the packet classification rules, multiple feature options of the same field are classified and the corresponding feature automata are generated;

[0057] The runtime state of the generated feature automaton is embedded into the state of the corresponding parsing automaton to construct a complete nested automaton structure;

[0058] Drive the operation of the constructed nested automaton structure, perform parsing, decoding and feature matching operations on the input data message, and output the matching results.

[0059] In summary, this application includes at least one of the following beneficial technical effects:

[0060] 1. This application proposes a data parsing and matching automaton based on packet classification rule definition, comprising: a parsing pattern construction module, which constructs a parsing automaton according to the protocol field parsing requirements defined in the rule; a feature automaton construction module, which classifies the same fields according to the feature options of the rule and generates a feature automaton; an automaton nesting construction module, which embeds the generated feature automaton running state into the corresponding parsing automaton state to construct a complete nested structure; finally, the automaton running module drives the nested structure to complete parsing, decoding and feature matching of the input message in one go, and outputs the matching result, effectively solving the various inefficiencies brought about by the traditional decentralized modular architecture. The nested automaton structure seamlessly integrates the parsing and matching processes, avoids redundant calculations and repeated data scanning, and eliminates the overhead of module switching, thereby significantly improving overall processing efficiency and fully utilizing hardware performance.

[0061] 2. The pattern selection unit of the present application selects a corresponding parsing pattern from a set of pre-set protocol field parsing patterns based on the protocol field parsing requirements defined in the packet classification rules. The parsing automaton construction unit combines the selected parsing patterns through pattern union or pattern concatenation to construct a parsing automaton that meets the requirements of the rule. Through a step-by-step method of dynamic selection and merging, a streamlined parsing automaton is generated based on the specific requirements of different rules, avoiding the execution of redundant parsing operations, thereby further reducing unnecessary computational overhead and improving parsing efficiency.

[0062] 3. Each parsing automaton state of the present application contains a feature automaton for storing the field end identifier. When parsing to this state, the automaton can be used to determine whether the field has been parsed. Secondly, the state also contains a variable for calculating the offset value of the current field end position relative to the message start position, providing position information for feature matching. Finally, the state also contains a variable for storing the state index of the feature automaton embedded in the state as the entry for starting feature matching; through this special state design, when the parsing automaton runs to a certain state, it can automatically determine the field starting boundary and obtain the field starting position based on the stored information, and immediately start the corresponding feature automaton to perform the matching operation, thereby realizing seamless integration of parsing and matching. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 This is a schematic diagram of input and output boundary definitions for a packet classification automaton method in a data parsing and matching automaton based on packet classification rule definition according to an embodiment of the present application;

[0064] Figure 2 This is a module diagram of an automatic machine for data parsing and matching based on packet classification rule definition according to an embodiment of the present application;

[0065] Figure 3 This is a schematic diagram of generating a parsing automaton based on a parsing pattern preset in a data parsing and matching automaton defined based on packet classification rules according to an embodiment of the present application;

[0066] Figure 4 This is a schematic diagram of the overall structure construction process of an automaton for data parsing and matching based on packet classification rule definition in an embodiment of the present application;

[0067] Figure 5 This is a schematic diagram of the overall automaton nested structure in an automaton for data parsing and matching defined based on packet classification rules according to an embodiment of the present application;

[0068] Figure 6 This is a schematic diagram of a merging method of serial relationships in an automaton for data parsing and matching based on packet classification rule definition according to an embodiment of the present application;

[0069] Figure 7 This is a schematic diagram of a method for merging joint relationships in an automaton for data parsing and matching based on packet classification rule definition according to an embodiment of the present application;

[0070] Figure 8 This is a schematic diagram of the operation of input drive by an instance parsing mode in an automaton for data parsing and matching based on packet classification rule definition according to an embodiment of the present application;

[0071] Figure 9 This is a schematic diagram of the mapping relationship between a feature automaton and a parsing automaton in a data parsing and matching automaton defined based on packet classification rules in an embodiment of the present application;

[0072] Figure 10 This is a schematic diagram of the overall operating structure and examples of an automatic machine for data parsing and matching based on packet classification rule definition in an embodiment of the present application;

[0073] Figure 11 This is a flow chart of a data parsing and matching method based on packet classification rule definition according to an embodiment of the present application;

[0074] Figure 12 This is a diagram of the internal structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0075] The terms used in the following examples of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the specification and appended claims of this application, the singular expressions "a," "an," "said," "above," "the," and "this" are intended to include plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in this application refers to any or all possible combinations comprising one or more of the listed items.

[0076] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood to imply or suggest relative importance or implicitly indicate the number of the technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of this application, unless otherwise specified, "plurality" means two or more.

[0077] The packet classification system of this application refers to a packet classification function implemented using software based on a pure x86 platform. The packet classification service of this application includes the parsing and feature matching functions of data fields from the link layer, transport layer to the application layer, and supports the matching capabilities of features described by regular expressions. The rules of this application are a formatted combination of rules that include link layer feature options, transport layer feature options, and application layer data feature options. Within the same rule, each feature option has an "and" relationship with each other, and the rules have an "or" relationship with each other.

[0078] The DFA (Deterministic Finite Automaton) compilation and construction algorithms used in this application are based on well-known principles and are not detailed here. The process of constructing the DFA automaton from the features of the regular expression description and the precise string features in the rules of this invention is a publicly available algorithm and is not detailed here. The automaton optimization algorithm mentioned in this invention is a currently available, publicly available algorithm and is not detailed here.

[0079] The embodiments of the present application are described in further detail below with reference to the accompanying drawings.

[0080] like Figure 1 As shown, the packet classification automaton method defined in this application takes as input the following: the packet classification rules entered by the user and the original data packet to be matched. The output data is the packet classification rule matching result information for the data packet. After inputting the packet classification rules and the original data packet to be matched, this embodiment compiles and runs the DFA automaton method, outputting the packet matching result.

[0081] Reference Figure 2 The present application provides a data parsing and matching automaton defined based on packet classification rules, including a parsing pattern construction module, a feature automaton construction module, an automaton nesting construction module and an automaton operation module.

[0082] The parsing pattern construction module is used to construct a parsing automaton according to the protocol field parsing requirements defined in the packet classification rules.

[0083] Among them, the parsing pattern construction module includes a pattern selection unit and a parsing automaton construction unit. The pattern selection unit is used to select the corresponding parsing pattern from the preset protocol field parsing pattern set according to the protocol field parsing requirements defined in the packet classification rules; the parsing automaton construction unit is used to construct a parsing automaton by combining the selected parsing patterns or connecting them in series.

[0084] Specifically, such as Figure 3As shown, the system parses and counts the combined rules issued by the user. The feature option format defines a set of correspondences between the protocol fields described by the feature and the parsing requirements. This correspondence is preset within the system. For example, the feature field name IPv4 corresponds to the parsing requirements of the source and destination IP addresses of the IP header, and the field name HTTP-HOST corresponds to the parsing requirements of the Host field in the HTTP protocol header. Then, based on the parsing requirements of the user rules, the parsing patterns preset in the system are selected to form a parsing pattern set. All the patterns in the parsing pattern set are then merged. During the merging process, the patterns are "combined" or "connected in series" according to the order in which the protocol parsing starting position is located in the message to form a basic parsing automaton.

[0085] The feature automaton construction module is used to classify multiple feature options of the same field according to the protocol field feature options defined in the packet classification rules and generate corresponding feature automata.

[0086] Among them, the feature automaton construction module includes a rule parsing unit and an automaton compilation unit. The rule parsing unit is used to parse the feature options described in the rule set and classify the feature options of the same field according to the field type; the automaton compilation unit is used to compile the classified feature options into corresponding feature automata.

[0087] Specifically, in this embodiment, refer to Figure 4 By extracting (combining) the feature content of the feature options in the rules, multiple feature fields of multiple rules are classified, and the feature content describing the same field is merged into a DFA automaton. According to the correspondence between the feature automaton and the parsing automaton (i.e., the protocol ID and the field ID), the index address of the feature automaton during operation is recorded in the state corresponding to the parsing automaton. If there is an automaton with a "field end feature" in the state, then this automaton is connected in series with the feature automaton. For example, the feature state machine of HTTP-HOST is combined with the parsing process of the field: in the parsing automaton, if the character feature "HOST:" is described as the end of a certain state, then this state is indexed with the host feature automaton. If it contains a "field end feature automaton" that describes the feature "\r\n", then this automaton is connected in series with the feature automaton, with the "feature automaton" first and the "field end feature automaton" second.

[0088] The automaton nesting construction module is used to embed the runtime state of the generated feature automaton into the state of the corresponding parsing automaton to construct a complete nested automaton structure.

[0089] Among them, the automaton nested construction module includes a mapping table construction unit and a nested association unit. The mapping table construction unit is used to establish a mapping table of the correspondence between the parsing state and the protocol field ID; the nested association unit is used to embed the runtime state of the constructed feature automaton into the corresponding parsing automaton state according to the mapping table.

[0090] Specifically, refer to Figure 5 The DFA automaton runtime structure of this embodiment consists of two parts: an internal and an external part. The external part consists of a (rule-based) message parsing automaton (hereinafter referred to as the "parsing automaton"). Some states of this automaton contain the internal feature DFA automaton of this application. This DFA automaton is generated by compiling and classifying the feature options defined by the rules according to the parsing patterns they depend on (hereinafter referred to as the "feature automaton").

[0091] It is worth noting that the merging of automata in this application is divided into two modes: serial connection and combination.

[0092] like Figure 6 As shown, concatenation of DFAs is used to merge two feature automata that have a concatenation relationship. For example, in the example above, the HOST field content feature automata and the "field end feature automata." After merging two sequential DFAs, A and B, the logical implementation is that A is satisfied first and B is satisfied later, reaching the DFA's receiving state. This concatenation method is primarily used to merge sequential parsing patterns and to merge a "field end feature automata" with its corresponding feature automata. The serial merging method follows the following method: the receiving state of the first matching automaton is connected to the initial state of the second matching automaton using an ε (epsilon) edge, where ε is a cost-free transformation that is necessary in the construction process of the DFA automaton. It is common knowledge and will not be described in detail here; if the state after the ε edge migration of the former receiving state is not a receiving state, the former receiving state is changed to a normal state; a new DFA automaton is constructed by iteratively calculating the ε closure (Epsilon Closure) of the automaton (the process is a public algorithm and will not be described in detail in this article); the state machine optimization (minimization) process is executed to trim redundant states and their migration processes.

[0093] like Figure 7As shown, the union of DFAs is used to merge two automata that have an "intersection relationship." An intersection relationship refers to the situation where the same data segment needs to match multiple features, and these features are in an intersection relationship. After merging automata A and B, the logical execution of A or B is achieved when the DFA reaches the receiving state corresponding to A or B. The union method is primarily used when parsing patterns share some common message fields, or when combining features of the same field from multiple rules into a single DFA. The union method follows the following principles: a new initial state is created as the initial state of the new automaton, which is then connected to the initial state of the original DFA using an ε-edge. The new DFA is then obtained by iteratively calculating the ε closure of the new automaton. If any transition in the combined automaton has a final destination without a receiving state, the transition is deleted (pruned). Finally, a state machine optimization (minimization) process is performed to prune redundant states and their transitions.

[0094] Furthermore, the state of the parsing automaton includes a feature automaton for storing a field end identifier, a variable for calculating the offset value of the current field end position, and a variable for storing the embedded feature automaton state index. The parsing mode of the present application is to abstractly implement the parsing process of the code of a protocol field as a DFA automaton. The present invention defines the DFA as consisting of special states, namely the P state in this article. Not every field (supported by the packet classification system) needs to be independently implemented as a parsing mode. The selection of fields should be combined with the protocol parsing requirements of the fields covered by the descriptive capabilities of the packet classification combination rule feature options. Since the parsing capability of packet classification is certain, the set of parsing modes that can be abstracted is a finite set. The specific operation methods can be divided into:

[0095] 1. Take the first significant and unique feature of a protocol as the starting state, the feature that appears in a field as the receiving state, and generate the intermediate DFA state transition process.

[0096] 2. If the field's ending position is determined by a signature feature, compile the signature feature separately into a DFA, which will be subsequently concatenated with the feature automaton (which establishes an index relationship with the field's receiving state). If the field's starting position is calculated by value, pre-set the calculation function to the field's receiving state, and retrieve the field's starting position in real time during execution.

[0097] 3. According to the specific characteristics of the protocol parsing process, each state, including the receiving state, can skip a section of data in bytes through an "operation" on the "input drive" process of the automaton.

[0098] 4. According to the characteristics of the protocol field, each state, including the receiving state, can realize the characteristics of state migration after the data byte performs operation through an "operation" on the "input drive" process of the automaton.

[0099] 5. Other information generated by the parsing process is cached through the global PKT structure of the process and used in subsequent calculations.

[0100] 6. The DFA automaton in the parsing mode is suitable for the automaton optimization algorithm itself, but it is necessary to add the state characteristics of the parsing mode of this application as a filtering condition for the characteristics of state merging in the optimization algorithm: that is, if the characteristics of the P state connotations of the two states to be merged are different, they will not be merged.

[0101] like Figure 8 As shown, the set of parsing patterns is a fixed set of preset DFAs in the system of this application, which is used to meet the parsing requirements of the features described by the rules and generate a parsing process for all fields described in the combined rule set issued by the user. During the operation of this parsing process, it may operate on structures other than the automaton, such as the input drive process and the PKT structure. For example, the process of parsing the IPv4 address field from the message is an independent pattern, and similarly, the IPv6 address field is another independent pattern. These two parsing patterns will be "combined" into the same logically complete DFA automaton during the DFA compilation process (depending on the situation).

[0102] Figure 8 The examples shown below illustrate the operations of the IPv4 and IPv6 address parsing state machines on the DFA input driver. The DFA input driver features CAL (calculation) and JUMP (skip byte) functions. Each DFA state can provide its own custom operation function for the DFA input driver to call and execute. The IP_ver state performs a right shift of four bits on the current input byte (in this example, the first byte of the IP header at the lower address). If the result is 4, the character "4" is input; if it is 6, the character "6" is input. The receive state operation driver skips the length of any IP header options (or extensions). The IP header length is assigned to the PKT structure (see that section for details) in the IP_ver state operation function. During the skipping process, the fixed length from the IP header start to the IP address (the target of the parsing in this example) is subtracted, resulting in 11 and 7 bytes, respectively.

[0103] The P state in the parsing mode of this application has the following characteristics:

[0104] 1. A DFA automaton containing the field end position feature of the preset fixed regular semantic description. This feature automaton will be "connected in series" with the feature automaton to generate a new feature automaton, whose runtime index will be nested in this state.

[0105] 2. A variable containing the relative offset of the end position of the current input field, in bytes. This variable is set using the system's default method for calculating the length of a field, which is also located in the state.

[0106] 3. The P state stores the mapping of another DFA (feature automaton)'s running state. This allows nested execution of another automaton. Specifically, after the DFA input driver triggers the current state, a segment of data (the field contents) is fed into another internally mapped DFA, causing it to execute and cache the received state information in the PKT structure. If the current state records the starting position of the field, this is used as a parameter for the input driver of the internally mapped DFA and fed into the internal DFA's execution. Otherwise, the internally mapped DFA enters the receiving state, marking the end of the internal DFA's input, thus completing the field scan.

[0107] 4. The P state contains a jump length handler (in bytes) for the state transition process, which allows for quick skipping of data segments with a specific length that are not parsed. During operation, the DFA input driver calls the jump length handler for that state (if any) and skips bytes of that length before the next DFA input.

[0108] 5. The P state contains the CAL function, which processes the input data during state transitions. This handles situations where the state transition direction can only be determined after performing operations on the input automaton data. During operation, the DFA input driver calls the operation function for that state (if any) and uses the function's return information as the DFA data input.

[0109] There are two field parsing methods for this application:

[0110] 1. Use regular features to describe how fields start and end.

[0111] During the construction of the P state of the present invention, the end feature is compiled into a DFA automaton with a single pattern string, and it is connected in series (in the overall construction process) behind the feature DFA automaton that establishes a mapping relationship with the current state to form a new automaton and establish a mapping relationship with it.

[0112] 2. Calculate the starting position of the field.

[0113] During the construction of the P state of the present invention, if a field requires a calculation to determine its starting position, this calculation is implemented as a fixed function and pre-set within the state. For example, in the data segment of an A record in a DNS message, the first byte represents the length of the subsequent data. The parsing process requires obtaining this byte and converting it into the length of the subsequent data segment for parsing.

[0114] like Figure 9 As shown, each state in the parsing mode is composed of the P state defined in this application. After the parsing mode forms a parsing automaton, the P state stores the start feature, starting position (if any), or end feature DFA of each field. At the same time, the P state stores a protocol ID and field ID represented by the state. The field ID value is unique within a protocol. The mapping relationship between the parsing automaton and the feature automaton is established through the values ​​of the above-mentioned protocol ID and field ID. This index relationship is implemented as a reference from the state of the parsing automaton to the address of the running state of the feature automaton nested within it.

[0115] This application uses a mapping table of protocol ID, field ID and parsing state to establish a mapping relationship between the feature automaton and the state in the parsing automaton. In the process of constructing the overall structure of the present invention, first, according to the parsing requirements of the feature options in the rule set, the parsing mode is selected and they are merged into the parsing automaton. In this process, each state uses the protocol ID and field ID it represents as the key and the state address as the value to insert it into the mapping table. In the process of generating the feature automaton of the construction process, after the feature automaton is completed, according to its protocol ID and field ID, the mapping table is queried to obtain the address of the corresponding state of the parsing automaton, and the runtime structure address of the feature automaton is written into the state for storage, thereby forming a mapping relationship between the two when the overall structure is running.

[0116] The automaton operation module is used to drive the operation of the constructed nested automaton structure, perform parsing, decoding and feature matching operations on the input data message, and output the matching results.

[0117] Among them, the automaton operation module includes an initialization unit, a parsing drive unit and a feature drive unit. The initialization unit is used to initialize the message information and status information; the parsing drive unit is used to drive the parsing automaton to scan and parse the input message data; the feature drive unit is used to perform feature matching processing on the parsed protocol fields according to the embedded feature automaton.

[0118] Specifically, in this embodiment, a PKT structure that describes the state of the automaton and the message information is defined. This structure corresponds one-to-one to the data message being processed. It describes the structure, parsing state, current scanning position, current automaton state, and other necessary information of an original data message. In the core process of the packet classification system, the life cycle of the PKT structure is consistent with the message it describes. The PKT contains an index of the original data content of the message and can store the parsing result information of the message on demand. At the same time, it saves the necessary state variables during the operation of the overall system of the present invention. The types of data stored in the PKT structure include:

[0119] 1. Message index information: including the original data message address index, data message length, IP fragmentation and other necessary original data message description information. Since the core process of the present invention does not involve the generation of this part of data, it will not be described in detail in this article.

[0120] 2. Parsing result information: This includes parsing result information generated during the parsing automaton's operation, such as the length of a protocol layer and the number of protocol fields present. This parsing result information assists the parsing automaton in reading the various parsing states and results of the message between different parsing modes. This information is also used in the final match determination process.

[0121] 3. State machine operation information: Contains a set of variables used to record the state information of each DFA during its operation. This is to maintain the smooth operation of each state machine and ensure the logical integrity of the state machine.

[0122] 4. Feature Matching Result Information: The receiving state in the feature automaton records the index information of the rule to which the feature matched by the current receiving state belongs. This includes the rule ID, rule address index, and other necessary information to locate the packet classification rule issued by the specific user. After the automaton transitions to this receiving state, this rule information is added to the matching result information in the PKT structure.

[0123] The PKT structure stores the automaton operation variables defined in this application, which mainly include the following:

[0124] 1. Member CS: stores the current parsed DFA state number.

[0125] 2. Member CSS: stores the current feature DFA state number.

[0126] 3. Member PD: points to the data byte being read in the current message. The automaton drives the incremental transformation.

[0127] 4. Member EOF: points to the end position of the current message.

[0128] The parsing drive unit includes a message reading subunit, a byte jumping subunit, a byte preprocessing subunit and a feature driving calling subunit. The message reading subunit is used to read the message bytes in sequence according to the position indicated by the message position field of the PKT structure and input them into the parsing automaton to drive the migration of the parsing status field; the byte jumping subunit is used to call the byte jumping function defined in the parsing automaton state, skip the message data segment that does not need to be parsed, and update the message position field of the PKT structure; the byte preprocessing subunit is used to call the byte operation function defined in the parsing automaton state to perform preprocessing on the input bytes; the feature driving calling subunit is used to drive the operation of the embedded feature automaton according to the receiving state reached by the parsing automaton. The feature driving unit includes a feature reading subunit, a result recording subunit and a matching feedback subunit. The feature reading subunit is used to read the message bytes in sequence according to the position indicated by the message position field of the PKT structure and input them into the feature automaton to drive the migration of the feature state field; the result recording subunit is used to write the rule index information identified by the receiving state reached by the feature automaton into the matching result field of the PKT structure; the matching feedback subunit is used to return the matching result and matching position of the feature automaton to the parsing automaton state to which it belongs, and the parsing driving unit updates the message position field of the PKT structure according to the matching position to skip the matched message data segment.

[0129] Specifically, the automaton input driver defined in this application refers to a functional module that reads data in bytes of the original message (indexed by PKT), inputs it into the DFA automaton, updates the relevant automaton operation states and variables, and calls the mapped internal automaton or writes matching result information based on the received state to "drive" the operation of the automaton.

[0130] This application distinguishes automata into parsing automata and feature automata, and the automata input drivers for these two differ. In addition to the normal input reading and input process, the parsing automaton driver also has the ability to call special input calculation functions (CAL) or byte skip functions (JUMP) in the parsing state (P-state). Furthermore, if the parsing automaton's P-state contains a mapping for a feature automaton, the driver also has the function of starting the internally mapped automaton and its driver.

[0131] In the overall operation structure, such as Figure 10 As shown, the static data structure has

[0132] 1. Message information in the PKT structure and its index message original data.

[0133] 2. Parsing automata, usually implemented as static tables.

[0134] 3. Feature automata are implemented as static tables. Dynamic data is primarily stored in the PKT structure. The core process is primarily implemented in the two automata drivers mentioned above.

[0135] like Figure 10 The overall operational flow, shown in Figure 2, uses the example of a rule matching the character signature "G:N / n" in a packet to detail the operation of each component. In this example, a field in a certain protocol begins with the signature "G:" and ends with the signature "\n" (newline character). The packet classification rule matches the value of this field as the character "N." The specific operational steps are as follows.

[0136] 1. PKT Information Data Initialization: Establish an index relationship with the original data packet described by the PKT and store other packet information about the packet obtained from the packet classification system. Initialize (clear) parsing results, state machine operation information, signature matching results, etc. The PD member is initialized to the first byte of the original packet data, the EOF member is initialized to the last byte of the original packet data, the CS member is initialized to the initial state value of the parsing automaton, and the CSS member is initialized to 0.

[0137] 2. Start the parsing automaton driver: read the original data content of a byte of the message through the PKT structure. The data read comes from the current original message byte pointed to by the PKT structure member PD. When the byte content of the PD input is the character "G" in the above example, the parsing automaton state moves from E0 to E1, and records E1 to the PKT member CS for storage. When there is a CAL operation function in the P state, the parsing automaton needs to call the function and process the current byte to be input into the automaton. When there is a JUMP operation function in the P state, the parsing automaton needs to run the function and obtain the skipped byte data of the next input byte and save it.

[0138] 3. Parsing automaton driven operation: continue to read data through the PKT structure. If the JUMP operation result information is currently saved, the parsing automaton updates the PKT member PD to read the byte after the number of JUMP bytes skipped. Update PD to the new position and drive state migration. If the automaton terminates prematurely, the state transition fails, or all PD read-in data (PD equals EOF) fails to reach a certain receiving state, the operation driven by the parsing automaton is terminated, that is, the core process returns failure. In the above example, after the parsing automaton reads the character ":" pointed to by PD and inputs it into the parsing automaton, the P state migrates to the receiving state E3, that is, the automaton operation matches the starting position of a specific field of a protocol. Read the mapping of the feature automaton in the receiving state, obtain and enter the feature automaton operation context.

[0139] 4. The Feature Automaton Driver is activated: Based on the PKT structure, the original data pointed to by its PD member is read, the PD is updated to the next byte, and the Feature Automaton state information is recorded in the CSS. In the above example, the PD data read after the Feature Automaton Driver is activated is the character "N" (i.e., it matches the content feature describing the protocol field issued by the user rule). The Feature Automaton state transitions from the initial state T0 to T1, and T1 is recorded in the PKT member CSS.

[0140] 5. End of feature automaton operation: Continue to read the data pointed to by the PKT member PD and update the CSS. If the automaton terminates prematurely, the state transition fails, or all PD read data (i.e., PD equals EOF) fails to reach a certain receiving state, the feature automaton-driven operation is terminated, i.e., the feature matching returns failure, and the execution process (3) continues. In the above example, the current PD reads the character "\n" (from the state after the end feature DFA of the protocol field parsing feature is merged with the feature automaton) and reaches the receiving state T2, i.e., the feature matching is successful. Record the current PD information, read the rule information in the current state, and update it to the matching result member of the PKT.

[0141] 6. After a successful match, the feature automaton returns the location of the field match to the driver corresponding to the P state of the mapped parsing automaton. The parsing state driver executes the jump function of the changed state based on the location, skipping the byte content matched by the feature execution automaton. The subsequent process continues from 3 to 6 until all data has been read into the system. That is, when PD equals EOF, the entire process ends.

[0142] The subsequent packet classification process determines the matching result of the execution rule according to the result information cached in the PKT, and executes the action defined by the rule to complete the specific business of packet classification. Since the subsequent process does not belong to the core process of the present invention, it will not be described in detail here.

[0143] On the second aspect, the present application provides a data parsing and matching method based on packet classification rule definition. The data parsing and matching method based on packet classification rule definition of the present application is described below in combination with the above-mentioned data parsing and matching system based on packet classification rule definition.

[0144] Reference Figure 11 , a data parsing and matching method based on packet classification rule definition, comprising the following steps:

[0145] S10. Construct a parsing automaton according to the protocol field parsing requirements defined in the packet classification rules;

[0146] S20, classifying multiple feature options of the same field according to the protocol field feature options defined in the packet classification rule, and generating corresponding feature automata;

[0147] S30, embedding the runtime state of the generated feature automaton into the state of the corresponding parsing automaton to construct a complete nested automaton structure;

[0148] S40: Drive the operation of the constructed nested automaton structure, perform parsing, decoding and feature matching operations on the input data message, and output the matching result.

[0149] In one embodiment, step S10 includes the following steps:

[0150] S11. Select a corresponding parsing mode from a preset set of protocol field parsing modes according to the protocol field parsing requirements defined in the packet classification rules;

[0151] S12. Construct a parsing automaton by combining the selected parsing patterns or by connecting them in series.

[0152] In one embodiment, the states of the parsing automaton include:

[0153] A feature automaton for storing the end identifier of a field;

[0154] Variable used to calculate the offset value of the end position of the current field;

[0155] Variable used to store the index of the embedded feature automaton state.

[0156] In one embodiment, step S20 includes the following steps:

[0157] S21. Parse the feature options described in the rule set and classify the feature options of the same field according to the field type;

[0158] S22. Compile the classified feature options into corresponding feature automata.

[0159] In one embodiment, step S30 includes the following steps:

[0160] S31. Establish a mapping table of the correspondence between parsing status and protocol field ID;

[0161] S32. According to the mapping table, embed the runtime state of the constructed feature automaton into the corresponding parsing automaton state.

[0162] In one embodiment, step S40 includes the following steps:

[0163] S41, initializing message information and status information;

[0164] S42, driving the parsing automaton to scan and parse the input message data;

[0165] S43. Perform feature matching processing on the parsed protocol fields according to the embedded feature automaton.

[0166] In one embodiment, a PKT structure is further included for storing data information during the operation of the automaton. The PKT structure includes:

[0167] The message information field is used to store the address index and length information of the original message data;

[0168] The parsing status field is used to store the running status of the current parsing automaton;

[0169] The feature status field is used to store the current running status of the feature automaton;

[0170] The message position field is used to store the byte position of the message currently being processed;

[0171] The message end field is used to store the message end position;

[0172] The parsing result field is used to store the message parsing result information generated during the operation of the automaton;

[0173] The matching result field is used to store the feature matching result information generated during the operation of the automatic machine.

[0174] In one embodiment, step S42 includes the following steps:

[0175] S421. Read the message bytes sequentially according to the position indicated by the message position field of the PKT structure and input them into the parsing automaton to drive the migration of the parsing status field.

[0176] S422. Call the byte jump function defined in the parsing automaton state to skip the message data segments that do not need to be parsed, and update the message position field of the PKT structure;

[0177] S423, calling the byte operation function defined in the parsing automaton state to perform preprocessing on the input bytes;

[0178] S424: According to the receiving state reached by the parsing automaton, the embedded feature automaton is driven to run.

[0179] In one embodiment, step S43 includes the following steps:

[0180] S431, according to the position indicated by the message position field of the PKT structure, read the message bytes in sequence and input them into the feature automaton to drive the migration of the feature state field;

[0181] S432. Write the rule index information identified by the receiving state reached by the feature automaton into the matching result field of the PKT structure;

[0182] S433. Return the matching result and matching position of the feature automaton to the corresponding parsing automaton state, and the parsing driving unit updates the message position field of the PKT structure according to the matching position to skip the matched message data segment.

[0183] In one embodiment, the present application provides an electronic device, which may be a server, and its internal structure diagram may be as follows: Figure 12 As shown. The electronic device includes a processor, a memory and a network interface connected via a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the electronic device is used to store data. The network interface of the electronic device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a data parsing and matching method based on packet classification rule definition is implemented.

[0184] Those skilled in the art will understand that Figure 12 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the electronic device to which the solution of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0185] In one embodiment, an electronic device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0186] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The above-described computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the above-described method embodiments. Any reference to memory, storage, database, or other media used in the embodiments provided herein may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0187] The above are all preferred embodiments of the present application, and are not intended to limit the scope of protection of the present application. Therefore, any equivalent changes made based on the structure, shape, and principle of the present application should be included in the scope of protection of the present application.

Claims

1. A data parsing and matching automaton based on packet classification rule definition, characterized in that: include: Parsing pattern construction module, used to construct parsing automaton according to the protocol field parsing requirements defined in the packet classification rules; A feature automaton construction module is used to classify multiple feature options of the same field according to the protocol field feature options defined in the packet classification rules and generate corresponding feature automata; The automaton nesting construction module is used to embed the runtime state of the generated feature automaton into the state of the corresponding parsing automaton to construct a complete nested automaton structure; The automaton operation module is used to drive the operation of the constructed nested automaton structure, perform parsing, decoding and feature matching operations on the input data message, and output the matching results; Wherein, the automaton nested construction module includes: A mapping table building unit, used to build a mapping table of the correspondence between parsing status and protocol field ID; a nested association unit, for embedding the runtime state of the constructed feature automaton into the corresponding parsing automaton state according to the mapping table; The automatic machine operation module includes: Initialization unit, used to initialize message information and status information; Parsing drive unit, used to drive the parsing automaton to scan and parse the input message data; The feature driving unit is used to perform feature matching processing on the parsed protocol fields according to the embedded feature automaton.

2. The data parsing and matching automaton defined based on packet classification rules according to claim 1, characterized in that: The parsing mode construction module includes: A mode selection unit is used to select a corresponding parsing mode from a preset protocol field parsing mode set according to the protocol field parsing requirements defined in the packet classification rules; The parsing automaton construction unit is used to construct a parsing automaton by combining the selected parsing patterns or connecting them in series.

3. The data parsing and matching automaton defined based on packet classification rules according to claim 1, characterized in that: The states of the parsing automaton include: A feature automaton for storing the end identifier of a field; Variable used to calculate the offset value of the end position of the current field; Variable used to store the index of the embedded feature automaton state.

4. The data parsing and matching automaton defined based on packet classification rules according to claim 1, characterized in that: The feature automation construction module includes: The rule parsing unit is used to parse the feature options described in the rule set and classify the feature options of the same field according to the field type; The automaton compilation unit is used to compile the classified feature options into corresponding feature automata.

5. The data parsing and matching automaton defined based on packet classification rules according to claim 1, characterized in that: The automatic machine operation module further includes a PKT structure for storing data information during the automatic machine operation process. The PKT structure includes: The message information field is used to store the address index and length information of the original message data; The parsing status field is used to store the running status of the current parsing automaton; The feature status field is used to store the current running status of the feature automaton; The message position field is used to store the byte position of the message currently being processed; The message end field is used to store the message end position; The parsing result field is used to store the message parsing result information generated during the operation of the automaton; The matching result field is used to store the feature matching result information generated during the operation of the automatic machine.

6. The data parsing and matching automaton defined based on packet classification rules according to claim 5, characterized in that: The analytical driving unit includes: The message reading subunit is used to read the message bytes in sequence according to the position indicated by the message position field of the PKT structure and input them into the parsing automaton to drive the migration of the parsing status field; The byte jump subunit is used to call the byte jump function defined in the parsing automaton state, skip the message data segment that does not need to be parsed, and update the message position field of the PKT structure; The byte preprocessing subunit is used to call the byte operation function defined in the parsing automaton state to perform preprocessing on the input bytes; The feature-driven calling subunit is used to drive the operation of the embedded feature automaton according to the receiving state reached by the parsing automaton.

7. The data parsing and matching automaton defined based on packet classification rules according to claim 6, characterized in that: The feature driving unit includes: The feature reading subunit is used to read the message bytes in sequence according to the position indicated by the message position field of the PKT structure and input them into the feature automaton to drive the migration of the feature state field; The result recording subunit is used to write the rule index information identified by the receiving state reached by the feature automaton into the matching result field of the PKT structure; The matching feedback subunit is used to return the matching result and matching position of the feature automaton to the corresponding parsing automaton state. The parsing drive unit updates the message position field of the PKT structure according to the matching position to skip the matched message data segment.

8. A data parsing and matching method based on packet classification rule definition, characterized in that: The data parsing and matching automaton defined based on packet classification rules, as applied to any one of claims 1 to 7, comprises the following steps: Construct a parsing automaton based on the protocol field parsing requirements defined in the packet classification rules; According to the protocol field feature options defined in the packet classification rules, multiple feature options of the same field are classified and the corresponding feature automata are generated; The runtime state of the generated feature automaton is embedded into the state of the corresponding parsing automaton to construct a complete nested automaton structure; Drive the operation of the constructed nested automaton structure, perform parsing, decoding and feature matching operations on the input data message, and output the matching results.

Images