Network protocol information retrieval method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a network protocol information retrieval method and device, computer equipment, a computer readable storage medium and a computer program product. The network protocol information retrieval efficiency can be improved. The method comprises the steps of obtaining a retrieval keyword in response to a network protocol information retrieval request; acquiring a node index and a node relation index corresponding to the information knowledge graph; the information knowledge graph comprises a first node corresponding to the network protocol information and an association relationship between the nodes, the node index records the first node associated with the keyword, and the node relationship index records an association relationship between the first node and other associated first nodes; matching the retrieval keyword with the node index, determining a second node associated with the retrieval keyword, and determining a third node and a node association relationship between the second node and the third node according to the node relationship index; and generating a node connected graph according to the second node, the third node and the node association relationship to obtain a retrieval result.

Description

Technical Field

[0001] The present application relates to the technical field of network information management, and in particular to a network protocol information retrieval method, device, computer equipment, computer-readable storage medium and computer program product. Background Art

[0002] As the scale of networks continues to expand and the number of network devices increases, network management systems need to process a large amount of network information, such as SNMP (Simple Network Management Protocol) messages, which contain the status and performance data of network devices. Effectively storing, indexing, and querying this data is critical for network health monitoring, fault diagnosis, and performance optimization. However, due to the huge amount of data and complex query requirements, traditional network protocol information data retrieval methods face the problem of low retrieval efficiency. Summary of the invention

[0003] Based on this, it is necessary to provide a network protocol information retrieval method, device, computer equipment, computer-readable storage medium and computer program product that can improve the efficiency of network protocol information retrieval in response to the above technical problems.

[0004] In a first aspect, the present application provides a network protocol information retrieval method, comprising:

[0005] In response to a network protocol information retrieval request, obtaining a retrieval keyword;

[0006] Obtaining a node index and a node relationship index corresponding to an information knowledge graph; the information knowledge graph includes first nodes corresponding to each of a plurality of network protocol information, and association relationships between the plurality of first nodes, the node index records the first nodes associated with each keyword, and the node relationship index records the association relationship between each of the first nodes and other associated first nodes;

[0007] Matching the search keyword with the node index, determining a second node associated with the search keyword based on the matching result, and determining a third node associated with the second node and a node association relationship between the second node and the third node according to the node relationship index;

[0008] A node connectivity graph is generated according to the second node, the third node and the node association relationship, and a search result is obtained based on the node connectivity graph.

[0009] In one embodiment, before obtaining the search keyword in response to the network protocol information search request, the method further includes:

[0010] Extracting the keywords corresponding to each of the association relationships in the information knowledge graph;

[0011] For each of the keywords, determine each of the first nodes associated with the keyword, and merge each of the first nodes associated with the keyword to obtain a node list;

[0012] The node index is generated according to the node lists corresponding to each of the multiple keywords.

[0013] In one embodiment, before obtaining the search keyword in response to the network protocol information search request, the method further includes:

[0014] Determine a plurality of the first nodes in the information knowledge graph, and obtain relationship description information corresponding to each of the first nodes in the information knowledge graph; the relationship description information records the node relationship between each of the first nodes and other first nodes;

[0015] For each of the first nodes, determine, according to the relationship description information, edges connecting the first node and the other first nodes and types of the edges, and associate the edges of each type with the first node as first node relationship information corresponding to the first node;

[0016] The node relationship index is obtained based on the first node relationship information corresponding to each of the plurality of first nodes.

[0017] In one embodiment, in response to the network protocol information search request, obtaining the search keyword includes:

[0018] In response to the received network protocol information retrieval request, obtaining a query pattern graph corresponding to the network protocol information request, and extracting one or more retrieval keywords from the query pattern graph;

[0019] and / or,

[0020] If the network protocol information retrieval request carries a keyword, the keyword carried in the network protocol information retrieval request is used as the retrieval keyword.

[0021] In one embodiment, matching the search keyword with the node index and determining the second node associated with the search keyword based on the matching result includes:

[0022] Determine the first node matching the search keyword according to the node index;

[0023] Arrange the plurality of search keywords in ascending order according to the number of the first nodes matched by the keywords to obtain the order of each search keyword, and determine the target first nodes corresponding to the search keywords whose order meets the order condition;

[0024] In the case where the search keyword is determined based on the query pattern graph, a first adjacency relationship corresponding to the target first node is determined from a preset adjacency relationship index file, and the target first node that matches the first adjacency relationship with the second adjacency relationship of the target first node in the query pattern graph is retained;

[0025] Based on the retained target first node, a second node associated with the search keyword is obtained.

[0026] In one embodiment, the association relationship between the plurality of first nodes includes edges between the plurality of first nodes; and the adjacency relationship index file is constructed by the following steps:

[0027] Determine the upper limit of the number of edges processed at a single time;

[0028] Dividing the plurality of edges in the information knowledge graph into at least one edge tuple list according to the upper limit of the number of edges; the number of edges contained in each edge tuple list is less than or equal to the upper limit of the number of edges;

[0029] Processing the at least one edge tuple list in sequence to obtain an ordered edge tuple list corresponding to each edge tuple list; wherein each processing is used to sequentially sort the edges in the edge tuple list according to the first node;

[0030] Each of the ordered edge tuple lists is merged to obtain the adjacency relationship index file.

[0031] In one embodiment, determining the third node associated with the second node and the node association relationship between the second node and the third node according to the node relationship index includes:

[0032] Obtain the weight of the second node, and adjust the parameter according to the preset number of nodes, and select the target second node that meets the weight condition from multiple book search second nodes;

[0033] The second node relationship information corresponding to each of the target second nodes is obtained from the node relationship index, and the third node associated with the target second node and the node association relationship between the target second node and the third node are determined according to the second node relationship information.

[0034] In one embodiment, step A includes: generating a node connectivity graph according to the second node, the third node and the node association relationship, including:

[0035] If the retrieval task execution space is smaller than the space threshold for batch processing, storing the second node, the third node and the node association relationship in other storage spaces outside the retrieval task execution space;

[0036] The second node, the third node and the node association relationship are read in batches from the other storage space to the retrieval task execution space for processing to generate the node connectivity graph.

[0037] In a second aspect, the present application also provides a network protocol information retrieval device, comprising:

[0038] A search request acquisition module, used to obtain search keywords in response to a network protocol information search request;

[0039] An index building module, used to obtain a node index and a node relationship index corresponding to an information knowledge graph; the information knowledge graph includes a plurality of first nodes corresponding to each of the network protocol information and an association relationship between the plurality of the first nodes, the node index records the first nodes associated with each keyword, and the node relationship index records the association relationship between each of the first nodes and other associated first nodes;

[0040] A search execution module, used to match the search keyword with the node index, determine a second node associated with the search keyword based on the matching result, and determine a third node associated with the second node and a node association relationship between the second node and the third node according to the node relationship index;

[0041] The retrieval result generating module is used to generate a node connectivity graph according to the second node, the third node and the node association relationship, and obtain the retrieval result based on the node connectivity graph.

[0042] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0043] In response to a network protocol information retrieval request, obtaining a retrieval keyword;

[0044] Obtaining a node index and a node relationship index corresponding to an information knowledge graph; the information knowledge graph includes first nodes corresponding to each of a plurality of network protocol information, and association relationships between the plurality of first nodes, the node index records the first nodes associated with each keyword, and the node relationship index records the association relationship between each of the first nodes and other associated first nodes;

[0045] Matching the search keyword with the node index, determining a second node associated with the search keyword based on the matching result, and determining a third node associated with the second node and a node association relationship between the second node and the third node according to the node relationship index;

[0046] A node connectivity graph is generated according to the second node, the third node and the node association relationship, and a search result is obtained based on the node connectivity graph.

[0047] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0048] In response to a network protocol information retrieval request, obtaining a retrieval keyword;

[0049] Obtaining a node index and a node relationship index corresponding to an information knowledge graph; the information knowledge graph includes first nodes corresponding to each of a plurality of network protocol information, and association relationships between the plurality of first nodes, the node index records the first nodes associated with each keyword, and the node relationship index records the association relationship between each of the first nodes and other associated first nodes;

[0050] Matching the search keyword with the node index, determining a second node associated with the search keyword based on the matching result, and determining a third node associated with the second node and a node association relationship between the second node and the third node according to the node relationship index;

[0051] A node connectivity graph is generated according to the second node, the third node and the node association relationship, and a search result is obtained based on the node connectivity graph.

[0052] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0053] In response to a network protocol information retrieval request, obtaining a retrieval keyword;

[0054] Obtaining a node index and a node relationship index corresponding to an information knowledge graph; the information knowledge graph includes first nodes corresponding to each of a plurality of network protocol information, and association relationships between the plurality of first nodes, the node index records the first nodes associated with each keyword, and the node relationship index records the association relationship between each of the first nodes and other associated first nodes;

[0055] Matching the search keyword with the node index, determining a second node associated with the search keyword based on the matching result, and determining a third node associated with the second node and a node association relationship between the second node and the third node according to the node relationship index;

[0056] A node connectivity graph is generated according to the second node, the third node and the node association relationship, and a search result is obtained based on the node connectivity graph.

[0057] In the above-mentioned network protocol information retrieval method, by responding to a network protocol information retrieval request, a retrieval keyword is obtained; a node index and a node relationship index corresponding to an information knowledge graph are obtained; the information knowledge graph includes first nodes corresponding to multiple network protocol information respectively, and the association relationship between multiple first nodes, the node index records the first nodes associated with each keyword, and the node relationship index records the association relationship between each first node and other associated first nodes; the retrieval keyword and the node index are matched, and the second node associated with the retrieval keyword is determined based on the matching result, and the third node associated with the second node and the node association relationship between the second node and the third node are determined according to the node relationship index; a node connectivity graph is generated according to the second node, the third node and the node association relationship, and the retrieval result is obtained based on the node connectivity graph. By matching the search keywords with the node index and further using the node relationship index to determine the relationship between nodes, efficient network protocol information retrieval can be achieved. This not only speeds up the retrieval, but also can handle complex associations, ensuring the integrity of the retrieved network protocol information data and the accuracy of the query. At the same time, by using a node connectivity graph to display the relationship between nodes, the deep-level relationship of the network protocol information is intuitively displayed, thereby providing a more flexible and efficient data retrieval solution and significantly improving the efficiency of network protocol information retrieval. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0059] FIG1 is a diagram showing an application environment of a network protocol information retrieval method according to an embodiment;

[0060] FIG2 is a schematic diagram of a flow chart of a network protocol information retrieval method in one embodiment;

[0061] FIG3 is a schematic diagram of a process of generating a node index in one embodiment;

[0062] FIG4 is a schematic diagram of the structure of an information knowledge graph in one embodiment;

[0063] FIG5 is a schematic diagram of a process for generating a node relationship index in one embodiment;

[0064] FIG6 is a schematic diagram of a construction process of an adjacency relationship index file in one embodiment;

[0065] FIG7 is a flow chart of a network protocol information retrieval method in another embodiment;

[0066] FIG8 is a block diagram of a network protocol information retrieval device in one embodiment;

[0067] FIG. 9 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0069] The network protocol information retrieval method provided in the embodiment of the present application can be applied to the application environment shown in Figure 1 in one embodiment. Figure 1 exemplarily shows a network deployment diagram in a cluster environment. The cluster environment generally includes the deployment of various devices / clients, a network management system (NMS, Network Management System) and a backup disaster recovery system. The cluster network environment of the enterprise includes one or more network devices 102a, 102b connected to one or more servers 104a-104c. Servers 104a-104c include various cloud services such as the enterprise's computing services, virtualization services, storage services, etc. These business servers build the productivity environment of the enterprise, and are connected through the 102a-102b network devices to achieve management, monitoring, data backup and disaster recovery.

[0070] The system may include multiple logically grouped servers 106. In some scenarios, the logical group of servers may be referred to as a customer's cluster environment. The environment includes multiple server clusters 104a-104c, each of which represents a cloud service for one or more enterprises.

[0071] For example, server 104a may be referred to as a file server, an application server, a web server, a proxy server, or a gateway server. In some cases, server 104a can act as an application server or a primary application server. In one possible configuration, server 104a may include an active directory. In some embodiments, server 104a is capable of serving as a client node for accessing server applications and providing other clients (104a-104n) with access to hosted applications. In some embodiments, server 104b provides cloud services for enterprise virtualization, including applications such as computing, containers, and desktops. In another configuration, an enterprise uses storage center 104c to store and manage important business data, and these storage centers use protocols such as SAN (Storage Area Network), DAS (Direct-Attached Storage), or NFS (Network File System) for data communication. In some embodiments, storage center 104c provides storage services including structured data, semi-structured data (JSON / XML), and unstructured (such as txt, doc, SNMP) objects.

[0072] In one embodiment, the backup disaster recovery servers 101a-104c are in the same physical host or network environment, thereby providing data monitoring and protection services. In some embodiments, the data monitoring and protection services are supported by providing HTTP (HyperText TransferProtocol) protocol interfaces through the interfaces of relevant applications on the enterprise cloud services 104a-104c, such as RESTFul and WebHook, in an agentless manner.

[0073] The topology of the network devices 102a and / or 102b may be a bus, star or ring network topology, and are connected via a network 103. In some possible implementations, the network 103 includes any of the following: a point-to-point network, a broadcast network, a wide area network, a local area network, a telecommunications network, a data communication network, a computer network, an ATM (asynchronous transfer mode) network, a SONET (synchronous optical network) network, an SDH (synchronous digital hierarchy) network, a wireless network, and a wired network. In different application scenarios, the network 103 may also include a wireless link, such as an infrared channel or a satellite band.

[0074] FIG1 shows that the network management system (NMS) system 100, the backup and disaster recovery system 101a-101c and the enterprise's servers 104a-104c are respectively located in different networks 102a and 102b, but in actual deployment, they can also be local area networks, metropolitan area networks or wide area networks. In actual deployment, network 102a can be a private network and network 102b can be a public network; conversely, network 102b can be a private network and network 102a can be a public network; or, both networks 102a and 102b can be private networks, such as the enterprise's internal private network. In actual deployment, the NMS and the backup service center can be located in a certain management center of the enterprise, and communicate with the company's data center or a third-party cloud server 104 through a WAN (Wide Area Network), such as network 103, through network 102b.

[0075] In an exemplary embodiment, as shown in FIG2 , a network protocol information retrieval method is provided, which is described by taking the method applied to the network management system (NMS) system 100 in FIG1 as an example, and includes the following steps S202 to S208 . Among them:

[0076] Step S202, in response to the network protocol information search request, obtaining search keywords.

[0077] The network protocol information retrieval request is a request sent by a user or application to the system to obtain the required network protocol information; the retrieval keyword is a keyword or phrase used to search and match the network protocol information, which may include the protocol name, device identifier, message type, etc.;

[0078] Optionally, a network management system (NMS) receives a network protocol information retrieval request sent by a user or an application, starts parsing the request content, and extracts retrieval keywords from the parsed content.

[0079] Step S204, obtain the node index and node relationship index corresponding to the information knowledge graph; the information knowledge graph includes the first nodes corresponding to multiple network protocol information, and the association relationship between the multiple first nodes, the node index records the first nodes associated with each keyword, and the node relationship index records the association relationship between each first node and other associated first nodes.

[0080] Among them, the information knowledge graph can provide in-depth data insights and complex query capabilities by organizing data into a graph structure, namely nodes (entities) and edges (relationships between entities). Nodes (Entities) represent specific information items. An SNMP message can be used as a node. Node attributes can include various metadata of the message, such as timestamp, device ID, message type, etc.

[0081] Edges represent relationships between nodes. In the context of SNMP messages, edges can represent multiple types of relationships, such as message flow, where one message is a response to another message, and an edge can be created to represent this request-response relationship; device relationships, where two messages come from the same device or related devices (such as a router and a connected terminal), and an edge can be created to represent this relationship between devices; similarity, where two messages have similar content or attributes (such as the same type of warning), and an edge can be created to represent this similarity.

[0082] In order to distinguish it from other nodes in the following text, the node in the information knowledge graph is called the first node. The first node is the basic unit in the information knowledge graph, representing network protocol information, which can be an SNMP message of a network device.

[0083] The node index records the mapping relationship between keywords and first nodes, so that the system can quickly locate the first nodes related to keywords. The node relationship index records the association relationship between each first node and other related first nodes, supporting the query and analysis of complex relationships.

[0084] Optionally, the network management system first initializes and maintains an information knowledge graph, which contains multiple first nodes. Keywords are associated with these first nodes to build a node index. The association relationship between each first node and other first nodes is recorded to build a node relationship index. When retrieval is required, the constructed node index and node relationship index are obtained. The node index is used to quickly locate the first node related to the keyword, and the node relationship index is used to determine the association relationship between these nodes to support complex queries.

[0085] Step S206, matching the search keyword with the node index, determining a second node associated with the search keyword based on the matching result, and determining a third node associated with the second node and a node association relationship between the second node and the third node based on the node relationship index;

[0086] Among them, in order to distinguish other nodes of this application, the node determined from the node index by keyword matching is used as the second node, as the intermediate result of the retrieval, and is further used to determine the association relationship to connect the retrieval keyword with a deeper analysis of the network protocol information. The node associated with the second node determined according to the node relationship index is used as the third node, which is part of the retrieval result, further reveals the association of the network protocol information, expands the retrieval scope, and provides more comprehensive network protocol information. The node association relationship is the relationship between nodes, which can include one or more of direct associations, dependencies, etc., and can be used to construct a node connectivity graph, as an edge in the node connectivity graph, connecting related nodes.

[0087] Optionally, when the network management system (NMS) receives a network protocol information retrieval request and extracts a keyword, the keyword is matched in the node index. The matched second node may correspond to multiple related network protocol information items. Subsequently, the node relationship index is used to further search for the node association relationship between these second nodes and the third node, and a more complete retrieval keyword association information network is constructed.

[0088] Step S208, generating a node connectivity graph according to the second node, the third node and the node association relationship, and obtaining a search result based on the node connectivity graph.

[0089] Among them, the node connectivity graph is a graph composed of nodes and edges between nodes, representing the nodes and their relationships, and is used to provide an overall view, enabling comprehensive network protocol information analysis.

[0090] Optionally, when the network management system (NMS) receives the search request and determines the relevant second node and third node, these nodes and their associations are constructed into a node connectivity graph. The connectivity graph shows the nodes related to the search request and the associations between them. Based on the connectivity graph, analysis is performed to finally generate a comprehensive search result.

[0091] In this embodiment, by responding to a network protocol information retrieval request, a retrieval keyword is obtained; a node index and a node relationship index corresponding to the information knowledge graph are obtained; the information knowledge graph includes first nodes corresponding to multiple network protocol information respectively, and the association relationship between multiple first nodes, the node index records the first nodes associated with each keyword, and the node relationship index records the association relationship between each first node and other associated first nodes; the retrieval keyword and the node index are matched, and the second node associated with the retrieval keyword is determined based on the matching result, and the third node associated with the second node and the node association relationship between the second node and the third node are determined according to the node relationship index; a node connectivity graph is generated according to the second node, the third node and the node association relationship, and the retrieval result is obtained based on the node connectivity graph, so that the matching of the retrieval keyword and the node index is realized, and the relationship between the nodes is further determined by using the node relationship index, so that efficient network protocol information retrieval can be realized, which not only speeds up the retrieval speed, but also can handle complex association relationships, ensure the integrity of the retrieved network protocol information data and the accuracy of the query, and at the same time, by using the node connectivity graph to display the relationship between nodes, the deep relationship of the network protocol information is intuitively displayed, thereby providing a more flexible and efficient data retrieval solution, and significantly improving the efficiency of network protocol information retrieval.

[0092] In a possible implementation, before responding to a network protocol information retrieval request and obtaining the retrieval keyword, it also includes: extracting keywords corresponding to each association relationship in the information knowledge graph; for each keyword, determining each first node associated with the keyword, and merging each first node associated with the keyword to obtain a node list; generating a node index based on the node lists corresponding to multiple keywords.

[0093] Specifically, the node index I-index is generated as shown in FIG3 , and the network management system performs a sequential scan on the knowledge information graph G.

[0094] In one embodiment, the SNMP message is represented as a knowledge information graph as shown in FIG4. The MIB (Management Information Base) in the message represents the MIB file, which is an information database associated with each element in the network and is used to describe the relevant parameters of the device. The MIB file is written in the standard format of Abstract Syntax Notation One. HOST-RESOURCES-MIB (Network Resource Management Information Base) is also a standard MIB used in the context of SNMP. Scutech-MIB provides a custom MIB management information base for backup all-in-one devices, defining specific message types.

[0095] Object Identifier (OID) is an identity type used to uniquely identify SNMP messages in a network. For example, "1.3.6.1.2.1.25.2.3.1.6" is a specific OID defined in the HOST-RESOURCES-MIB, representing the used space of a storage device. The OID is a partial path. The complete OID will include the base path of the OID plus one or more additional digits. The additional digits are used to describe some special storage device instances. "1.3.6.1.4.1.58021.1.1" is defined in the Scutech-MIB and indicates that the device performs traffic balancing operations.

[0096] The node SNMP1 represents message 1, and its attributes include timestamp, device ID is A, message type is CPU warning, content, MIB, OID, and value. The node NMP2 represents message 2, and its attributes include timestamp, device ID is B, message type is traffic balancing operation, content, MIB, OID, and value. The node SNMP3 represents message 3, and its attributes include timestamp, device ID is A, message type is memory warning, content, MIB, OID, and value.

[0097] In the information knowledge graph, edge 1 (vertical forward edge) connects node 1 and node 2, indicating the message flow, that is, the CPU warning of node 1 leads to the traffic balancing operation of node 2. Vertical forward edges are edges that connect nodes of different levels or types, indicating a relationship from a lower-level node to a higher-level node. Edge 3 (horizontal edge) connects node 1 and node 3, indicating the similarity between the two, because they both come from device A and are warnings about resource usage. Horizontal edges connect nodes of the same level or type, and in a peer graph, they indicate a peer or sibling relationship between nodes. The direction of this connection is defined based on the chronological order of occurrence. Edge 2 (vertical forward edge) connects node 2 and node 3, indicating that if the traffic balancing operation of device B is in response to multiple warnings from device A, then this edge represents the relationship between devices, which needs to be determined through additional logic. Edge 4 (vertical backward edge) is used for post-mortem analysis. For example, when the backup task speed drops and you need to understand the operation that caused the failure, the vertical backward edge is designed for preset analysis purposes rather than for representing the actual event flow or logic flow.

[0098] It should be pointed out that in actual model construction, the graph should be further improved according to the relationship between devices, the direction of message flow and context. In most practical applications, the relationship between events and messages is usually constructed in a chronological order and causal logic. After scanning the graph G, for each edge , represents the edge, and Represents the two nodes connecting the edge, Extract a series of keywords related to the edge for the edge label. These keywords can be extracted from the edge label, the attributes of the nodes connected by the edge, or other edge-related information. In the context of SNMP messages, keywords can be determined by methods such as IRI (Information Retrieval Interface), predicates, and SPARQL (SPARQL Protocol and RDF Query Language) strings. Keywords can be message types, operation codes, or specific field values ​​contained in the message.

[0099] For the extracted keywords , generating two key-value pairs and , and add these key-value pairs to the collection In this way, each keyword is associated with its corresponding node, making it easy to quickly find related nodes through keywords.

[0100] Starting from set M1, construct set M2. In set M2, each key is a keyword, and each value is a list of UNI identifiers of all nodes containing the keyword. In this way, each keyword is associated with a UNI list that contains all nodes containing the keyword.

[0101] Sort each value (UNI list) in set M2 and remove duplicate elements. By sorting and removing duplicates from the UNI list, not only the storage space is optimized, but also the query efficiency is improved.

[0102] In this embodiment, by effectively extracting keywords corresponding to the association relationship from the information knowledge graph and generating a complete node index, not only the efficiency and accuracy of the system in processing network protocol information are improved, but also the comprehensiveness and relevance of the retrieval results are ensured.

[0103] In one embodiment, before responding to a network protocol information retrieval request and obtaining the retrieval keyword, it also includes: determining multiple first nodes in the information knowledge graph, and obtaining relationship description information corresponding to each first node in the information knowledge graph; the relationship description information records the node relationship between each first node and other first nodes; for each first node, based on the relationship description information, determining the edges connecting the first node and other first nodes and the types of each edge, and associating each type of edge with the first node as the first node relationship information corresponding to the first node; based on the first node relationship information corresponding to each of the multiple first nodes, obtaining a node relationship index.

[0104] Specifically, the steps of generating the node relationship index M-index are as shown in FIG5 . The network management system initializes the set M to include an initial node UNI value and three empty sets. Each node can be regarded as isolated without any associated edges, which can be expressed as: Scan RFDS (Resource Framework Data Set) triples , split the result into a node UNI set U without vertical backward edges and a RDFS triple set . Nodes without vertical backward edges are those nodes that have no edges pointing to more general concepts or parent nodes in the graph. These nodes can be regarded as "leaf nodes" in the graph. In the context of knowledge graphs, this means that the concepts represented by these nodes have no further generalization or parent classification, and they are the very end of the information hierarchy in the graph. The purpose of this step is to read in the contents of the RFDS dataset and prepare it for further processing. Loop through each element in until Specifically, for each triple, determine the relationship between its related nodes and edges, and get the edge set from graph G and ,in, Contains all UNI corresponding nodes in U The vertical forward edges in , are the edges that connect nodes of different levels or types; Contains all UNI corresponding nodes in U Horizontal edges in , edges that connect nodes of the same level or type. and The edge data in is removed from graph G and added to the corresponding node quadruple in M, and the processing result is updated. After each loop processing, update and U. Updated to the processed triple set, the updated Contains the RDFS triples of all nodes whose UNI values ​​have never been placed in the set U. The set U is updated to contain the new node relations, which can be a set containing The UNI of the target node is . The updated set U and the set Reiterate to satisfy the set U and the set When all sets are empty, the loop is exited. This step ensures that all node and edge relationships are fully processed and recorded. Finally, the updated set M is hashed to generate the final node relationship index M-Index.

[0105] In this embodiment, the node relationships in the information knowledge graph are fully captured and recorded, and an efficient node relationship index is generated, which not only improves the query and analysis efficiency of the system, but also ensures the accuracy and comprehensiveness of information processing, providing a solid foundation for subsequent retrieval and analysis.

[0106] In one embodiment, in response to a network protocol information retrieval request, obtaining retrieval keywords includes: in response to a received network protocol information retrieval request, obtaining a query pattern graph corresponding to the network protocol information request, and extracting one or more retrieval keywords from the query pattern graph; and / or, if the network protocol information retrieval request carries keywords, using the keywords carried by the network protocol information retrieval request as retrieval keywords.

[0107] Among them, the query pattern graph is a structured graph that represents the user's query intent and can include several nodes and edges, so that the system can more accurately parse the user's retrieval needs. The retrieval keyword is a keyword or phrase used to search and match network protocol information. It is extracted from the query pattern graph or directly obtained from the retrieval request to guide the system to perform information retrieval.

[0108] Optionally, a network protocol information retrieval request is received, a query pattern graph is constructed according to the retrieval request, nodes and edges in the query pattern graph are parsed, and one or more retrieval keywords are extracted.

[0109] Optionally, a network protocol information retrieval request is received, and the request carries retrieval keywords, which may be keywords such as "memory warning" and "traffic balancing operation", and these keywords are directly used as retrieval keywords.

[0110] In this embodiment, by extracting from the query pattern diagram or directly using the keywords carried in the network protocol information request, it is possible to flexibly respond to different types of search requests, provide comprehensive and accurate search results, and ensure the accuracy and efficiency of the search.

[0111] In some embodiments, a search keyword and a node index are matched, and a second node associated with the search keyword is determined based on the matching result, including: determining a first node that matches the search keyword based on the node index; arranging multiple search keywords in ascending order according to the number of first nodes that match the keyword to obtain the order of each search keyword, and determining a target first node corresponding to the search keyword whose order satisfies the order condition; when the search keyword is determined based on a query pattern graph, determining a first adjacency relationship corresponding to the target first node from a preset adjacency relationship index file, and retaining a target first node that matches the first adjacency relationship with the second adjacency relationship of the target first node in the query pattern graph; and obtaining a second node associated with the search keyword based on the retained target first node.

[0112] Optionally, a network protocol information retrieval request is received, a retrieval keyword is extracted, and the keyword is matched according to the node index, and at least one first node of the keyword can be returned. According to the number of first nodes matched by each retrieval keyword, multiple retrieval keywords are arranged in ascending order to obtain the order of each keyword. According to the order condition, the target first node corresponding to each retrieval keyword is determined, and the keywords with a smaller number of matching first nodes are given priority. Matching and retaining the target first node. In the case where the retrieval keyword is determined based on the query pattern graph, the first adjacency relationship corresponding to the target first node is determined from a preset adjacency relationship index file, and these adjacency relationships are matched with the second adjacency relationship of the target first node in the query pattern graph, and the target first node that meets the conditions is retained. Based on the retained target first node, the second node associated with the retrieval keyword is determined.

[0113] Exemplarily, if F first nodes are matched for keyword X and E first nodes are matched for keyword Y, when F is greater than E, the first node corresponding to the search keyword Y is determined as the target first node. If the target first node matched by the search keyword Y has a matching adjacency relationship with other nodes in the query pattern graph through the adjacency relationship index file, the target first node matched by the search keyword Y is retained. Based on the retained target first node matched by the search keyword Y, the second node related to the keyword Y can be determined.

[0114] In this embodiment, by matching the search keyword with the node index, the first node associated with the keyword can be quickly determined, thereby improving the search efficiency. The multiple search keywords are sorted and screened to ensure the accuracy and relevance of the search results. By using the adjacency relationship index file, a deep node relationship matching can be performed to further determine the second node associated with the search keyword, thereby improving the depth and breadth of information retrieval.

[0115] In one of the embodiments, the association relationship between multiple first nodes includes edges between multiple first nodes; the adjacency relationship index file is constructed by the following steps: determining the upper limit of the number of edges processed at a single time; dividing multiple edges in the information knowledge graph into at least one edge tuple list according to the upper limit of the number of edges; the number of edges contained in each edge tuple list is less than or equal to the upper limit of the number of edges; processing at least one edge tuple list in turn to obtain an ordered edge tuple list corresponding to each edge tuple list; wherein each processing is used to sequentially sort the edges in the edge tuple list according to the first node; merging the ordered edge tuple lists to obtain the adjacency relationship index file.

[0116] Among them, the edge tuple list is a data structure used to store edges in the information knowledge graph. Multiple edges are divided into multiple edge tuple lists according to a predetermined upper limit on the number of edges, which facilitates batch processing and sorting of a large number of edges and improves processing efficiency.

[0117] Ordered edge tuple list A sorted edge tuple list sorts the edges in each edge tuple list sequentially to ensure that the edges are arranged in a specific order, which helps with subsequent merging and index construction.

[0118] The adjacency relationship index file records the index file of the edges between multiple first nodes, merges the ordered edge tuple lists, and generates the final adjacency relationship index file.

[0119] Optionally, first, collect and convert SNMP messages in the network into a knowledge information graph. The SNMP message in the knowledge information graph is taken as a node, and the relationship between nodes is represented by edges, where each edge represents the sending and receiving relationship of an SNMP message. According to the number of edges, the edge data in the knowledge information graph is divided to generate multiple edge tuple lists, and the number of edges in each edge tuple list does not exceed the preset upper limit of the number of edges. Sort the edges in each edge tuple list, and the sorting basis can be the UNI value (unique identifier) ​​of the starting node or the ending node of the edge, so as to generate an ordered edge tuple list. The sorted ordered edge tuple list is stored in an external memory to provide data support for subsequent merging processing. The ordered edge tuple list stored in the external memory is merged into a complete ordered edge list to obtain an adjacency relationship index file.

[0120] Exemplarily, an adjacency index file is generated, as shown in FIG3 , by collecting and converting SNMP messages in the network into a knowledge information graph G, which contains The edge , while system memory can maintain at most edges, divide the edge data of G into In the list of edge tuples, For each edge tuple list , sorting them into .exist In the graph, the edge data storage locations starting from the same node are connected front and back to form an adjacency list. For each node in the graph G, the edges it sends will be arranged in order in the list for subsequent processing. Get an ordered list of edge tuples After that, it is stored on disk, ensuring that a large amount of edge data can be effectively managed and accessed under memory constraints. Merge into the same file (adjacency index file). It is a disk adjacency list that contains the edge information in the graph G, and this edge information is ordered for fast access and processing. Finally, each node in the graph G will be assigned a UNI value. The read file pointer value is used as the UNI value of the node V. This value is different for each node and the UNI value length of each node is the same, occupying the same storage space. This means that each SNMP message (node) will obtain a unique identifier, and the node UNI can directly jump to the node's outbound edge data, thereby improving the efficiency of graph data processing.

[0121] In this embodiment, by effectively managing and processing a large amount of edge data and constructing an efficient adjacency relationship index file, the association relationship between nodes can be quickly queried, which not only improves the retrieval processing efficiency but also ensures the accuracy and completeness of the query.

[0122] In one embodiment, a third node associated with a second node and a node association relationship between the second node and the third node are determined based on a node relationship index, including: obtaining a weight of the second node, adjusting parameters based on a preset number of nodes, and screening out a target second node that meets the weight condition from a plurality of second nodes; obtaining second node relationship information corresponding to each target second node from the node relationship index, and determining a third node associated with the target second node and a node association relationship between the target second node and the third node based on the second node relationship information.

[0123] Optionally, when determining the third node associated with the second node and its relationship, the weight of each second node is first calculated. The weight value of each second node is calculated based on a preset indicator, which may be the node's connectivity, information importance, etc. At the same time, in order to control the number of nodes to be screened, the system applies a preset node number adjustment parameter to screen out the target second nodes whose weights meet the conditions.

[0124] After the target second node is screened out, the relationship information of each target second node is obtained from the node relationship index, and the relationship information extracted from the node relationship index may include the connection information of the target second node and other nodes and their relationship types. According to the extracted relationship information, the third node associated with each target second node and its relationship may be determined.

[0125] In this embodiment, by calculating the weight of the second node and screening out the target second nodes that meet the conditions, the relevance and importance of the selected nodes can be ensured, and the accuracy of the retrieval results can be improved. At the same time, by utilizing the node relationship index, the third node associated with the target second node and the relationship between them can be efficiently determined, thereby improving the depth and breadth of information retrieval and analysis.

[0126] In one embodiment, a node connectivity graph is generated based on the second node, the third node and the node association relationship, including: if the retrieval task execution space is smaller than the space threshold for batch processing, the second node, the third node and the node association relationship are stored in other storage spaces outside the retrieval task execution space; the second node, the third node and the node association relationship are read in batches from other storage spaces to the retrieval task execution space for processing to generate a node connectivity graph.

[0127] Optionally, when generating the node connectivity graph, determine whether the current retrieval task execution space is sufficient to process all second nodes, third nodes and their associations. If it is found that the retrieval task execution space is less than the space threshold for batch processing, store these nodes and their associations in other storage spaces outside the retrieval task execution space, wherein the other storage space can be an external storage device such as a hard disk or a distributed storage system.

[0128] By reading the data stored in the external storage space in batches, the second node, the third node and their associations are gradually loaded into the retrieval task execution space for processing. After processing the nodes and associations of the current batch, the node connectivity graph is gradually constructed. After each batch processing is completed, the corresponding memory space is released to prepare for reading and processing the next batch of data.

[0129] In this embodiment, by adopting the strategy of exchanging time for space to store data that exceeds the execution space of the retrieval task in other storage spaces and reading and processing the nodes and their associations in batches, it is possible to effectively manage large-scale data, avoid memory overflow, improve the stability of the system, ensure the efficiency and accuracy of the generation of the node connectivity graph, adapt to data sets of different sizes and different memory capacities, be suitable for various computing environments, and improve the overall performance of data retrieval.

[0130] In order to enable those skilled in the art to better understand the above steps, the embodiment of the present application is illustrated below by using an example, but it should be understood that the embodiment of the present application is not limited to this.

[0131] Specifically, as shown in FIG6 , after receiving the network protocol information retrieval request, the request is first parsed to extract one or more retrieval keywords. The keywords can be obtained directly from the request, or by parsing the query pattern diagram determined by the network protocol information retrieval request. Among them, the keywords can be SNMP OID, device ID, message type, etc., which will be used to find related nodes in the I-Index.

[0132] I-Index is a hashed index structure that records each keyword and its associated node UNI set. By querying I-Index, the system can quickly locate the nodes related to the keyword and obtain the UNI values ​​of these nodes. The specific process includes querying the relevant nodes of each keyword in I-Index; sorting the keywords according to the number of nodes to optimize the processing order; selecting relevant nodes according to preset parameters; and storing the selected node UNIs in the set.

[0133] Based on the node UNI set matched by I-index, by querying M-Index, the system returns a result set containing node details and relationships. According to the node weight and preset parameters, the target nodes that meet the conditions are screened out to ensure the relevance and accuracy of the result set.

[0134] Finally, the connectivity graph CS is constructed based on the result set returned by M-Index. The connectivity graph CS shows all relevant nodes and their relationships, providing a complete view of network protocol information. At the same time, if the execution space of the retrieval task is insufficient, the system will store the excess nodes and relationships in other storage spaces, and read and process these data in batches to determine the retrieval results.

[0135] For example, given a query pattern graph Q:

[0136] Extract the keyword set K and use the I-Index index to match the node. , yes The hash value of , find the keyword set in I-Index Each keyword and knowledge information map Related nodes in . Sorting Keyword Set In the case of limited memory space for retrieval, users can set input parameters (maximum number of nodes), only selectively associate part or all of the I-Index with the keyword set The relevant node UNIs are imported into memory. According to the adjacency index file, the imported node UNIs are compared with the input query pattern graph. and discard the query pattern graph The unrelated node UNIs are stored in the node UNI set. middle.

[0137] Based on the obtained node UNI set , preset node number adjustment parameters ,when Eδ * Lord ∈[ My , Max ] When the result set size ;when < hour, ;when > hour, . (Expansion factor < 1) is an important parameter for adjusting the size of the result set R, which can be defined by user input, system performance (actual response required, system load, etc.) or according to the task responsibility. When performing general queries that do not require a large amount of historical data, you can set =0.2; when high-quality results are needed and query time can be sacrificed, you can set =0.5 or greater. This determines the upper and lower limits of the query quality.

[0138] Define weight rules based on the characteristics of SNMP messages (such as timestamp, device ID, message type, etc.) to assign weights to the node UNIs in the set 𝐿𝑟d. In some embodiments, recent messages and special types of warnings (CPU alarms, memory alarms, etc.) can have higher weights. Select the one with the highest weight Node UNI is put into the collection middle.

[0139] Iterating over a collection The node relationship index of the node in the query mode graph is insufficient because the memory space is insufficient to store the query mode graph. The connected graph of The collection will be processed in batches using disk space. The node UNI in the query pattern graph Constructing a connected graph , according to the obtained connectivity graph , the network protocol information retrieval results can be determined.

[0140] In this embodiment, the system can efficiently extract keywords from network protocol information retrieval requests. By using two lossless indexes, I-Index and M-Index, it can achieve fast indexing and querying of SNMP information knowledge graph G, ensuring the integrity of the data and the accuracy of the query, so that each returned result set R is a matching subgraph of the query pattern graph Q in the information knowledge graph G. By optimizing the index and setting the query parameters, Strategies such as these can minimize the impact on user query response time, thereby reducing query latency while ensuring data integrity and accuracy, and ultimately generating a comprehensive and accurate connectivity graph. , providing efficient and reliable network protocol information retrieval and analysis services.

[0141] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0142] Based on the same inventive concept, the embodiment of the present application also provides a network protocol information retrieval device for implementing the network protocol information retrieval method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more network protocol information retrieval device embodiments provided below can refer to the limitations on the network protocol information retrieval method above, and will not be repeated here.

[0143] In an exemplary embodiment, as shown in FIG. 7 , a network protocol information retrieval device is provided, comprising: a retrieval request acquisition module 810, an index establishment module 820, a retrieval execution module 830 and a retrieval result generation module 840, wherein:

[0144] The search request acquisition module 810 is used to obtain search keywords in response to a network protocol information search request.

[0145] The index establishment module 820 is used to obtain the node index and node relationship index corresponding to the information knowledge graph; the information knowledge graph includes the first nodes corresponding to multiple network protocol information, and the association relationship between multiple first nodes. The node index records the first nodes associated with each keyword, and the node relationship index records the association relationship between each first node and other associated first nodes.

[0146] The retrieval execution module 830 is used to match the retrieval keyword and the node index, determine the second node associated with the retrieval keyword based on the matching result, and determine the third node associated with the second node and the node association relationship between the second node and the third node according to the node relationship index.

[0147] The search result generation module 840 is used to generate a node connectivity graph according to the second node, the third node and the node association relationship, and obtain the search result based on the node connectivity graph.

[0148] In one embodiment, the index building module 820 is used to:

[0149] Extract keywords corresponding to each association relationship in the information knowledge graph; for each keyword, determine the first nodes associated with the keyword, and merge the first nodes associated with the keyword to obtain a node list; generate a node index based on the node lists corresponding to multiple keywords.

[0150] In one embodiment, the index building module 820 is used to:

[0151] Determine multiple first nodes in the information knowledge graph, and obtain relationship description information corresponding to each first node in the information knowledge graph; the relationship description information records the node relationship between each first node and other first nodes; for each first node, determine the edges connecting the first node and other first nodes and the types of each edge according to the relationship description information, and associate each type of edge with the first node as the first node relationship information corresponding to the first node; based on the first node relationship information corresponding to each of the multiple first nodes, obtain a node relationship index.

[0152] In one embodiment, the retrieval request acquisition module 810 is used to: in response to a received network protocol information retrieval request, obtain a query pattern graph corresponding to the network protocol information request, and extract one or more retrieval keywords from the query pattern graph; and / or, if the network protocol information retrieval request carries keywords, use the keywords carried by the network protocol information retrieval request as retrieval keywords.

[0153] In one embodiment, the retrieval execution module 830 is used to: determine the upper limit of the number of edges to be processed at a single time; divide multiple edges in the information knowledge graph into at least one edge tuple list according to the upper limit of the number of edges; the number of edges contained in each edge tuple list is less than or equal to the upper limit of the number of edges; process at least one edge tuple list in turn to obtain an ordered edge tuple list corresponding to each edge tuple list; wherein each processing is used to sequentially sort the edges in the edge tuple list according to the first node; merge the ordered edge tuple lists to obtain an adjacency relationship index file.

[0154] In one embodiment, the retrieval execution module 830 is used to:

[0155] Determine the first node that matches the search keyword according to the node index; arrange multiple search keywords in ascending order according to the number of first nodes that match the keywords to obtain the order of each search keyword, and determine the target first node corresponding to the search keyword whose order meets the order condition; when the search keyword is determined based on the query pattern graph, determine the first adjacency relationship corresponding to the target first node from a preset adjacency relationship index file, and retain the target first node that matches the first adjacency relationship with the second adjacency relationship of the target first node in the query pattern graph; based on the retained target first node, obtain the second node associated with the search keyword.

[0156] In one embodiment, the retrieval execution module 830 is used to:

[0157] Obtain the weight of the second node, adjust the parameters according to the preset number of nodes, and filter out the target second node that meets the weight condition from multiple second nodes; obtain the second node relationship information corresponding to each target second node from the node relationship index, and determine the third node associated with the target second node and the node association relationship between the target second node and the third node based on the second node relationship information.

[0158] In one embodiment, the search result generating module 840 is used to:

[0159] If the retrieval task execution space is smaller than the space threshold for batch processing, the second node, the third node and the node association relationship are stored in other storage spaces outside the retrieval task execution space; the second node, the third node and the node association relationship are read in batches from other storage spaces to the retrieval task execution space for processing to generate a node connectivity graph.

[0160] Each module in the above network protocol information retrieval device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0161] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG8. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store node indexes and node relationship indexes. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a network protocol information retrieval method is implemented.

[0162] Those skilled in the art will understand that the structure shown in FIG. 8 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0163] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0164] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0165] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0166] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0167] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0168] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0169] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network protocol information retrieval method, characterized in that: The method comprises: In response to a network protocol information retrieval request, obtaining a retrieval keyword; Obtaining a node index and a node relationship index corresponding to an information knowledge graph; the information knowledge graph includes first nodes corresponding to each of a plurality of network protocol information, and association relationships between the plurality of first nodes, the node index records the first nodes associated with each keyword, and the node relationship index records the association relationship between each of the first nodes and other associated first nodes; Matching the search keyword with the node index, determining a second node associated with the search keyword based on the matching result, and determining a third node associated with the second node and a node association relationship between the second node and the third node according to the node relationship index; A node connectivity graph is generated according to the second node, the third node and the node association relationship, and a search result is obtained based on the node connectivity graph.

2. The method according to claim 1, characterized in that Before obtaining the search keyword in response to the network protocol information search request, the method further includes: Extracting the keywords corresponding to each of the association relationships in the information knowledge graph; For each of the keywords, determine each of the first nodes associated with the keyword, and merge each of the first nodes associated with the keyword to obtain a node list; The node index is generated according to the node lists corresponding to each of the multiple keywords.

3. The method according to claim 1, characterized in that Before obtaining the search keyword in response to the network protocol information search request, the method further includes: Determine a plurality of the first nodes in the information knowledge graph, and obtain relationship description information corresponding to each of the first nodes in the information knowledge graph; the relationship description information records the node relationship between each of the first nodes and other first nodes; For each of the first nodes, determine, according to the relationship description information, edges connecting the first node and the other first nodes and types of the edges, and associate the edges of each type with the first node as first node relationship information corresponding to the first node; The node relationship index is obtained based on the first node relationship information corresponding to each of the plurality of first nodes.

4. The method according to claim 1, characterized in that: In response to the network protocol information search request, obtaining the search keyword includes: In response to the received network protocol information retrieval request, obtaining a query pattern graph corresponding to the network protocol information request, and extracting one or more retrieval keywords from the query pattern graph; and / or, If the network protocol information retrieval request carries a keyword, the keyword carried in the network protocol information retrieval request is used as the retrieval keyword.

5. The method according to claim 1, characterized in that The step of matching the search keyword with the node index and determining a second node associated with the search keyword based on the matching result includes: Determine the first node matching the search keyword according to the node index; Arrange the plurality of search keywords in ascending order according to the number of the first nodes matched by the keywords to obtain the order of each search keyword, and determine the target first nodes corresponding to the search keywords whose order meets the order condition; In the case where the search keyword is determined based on the query pattern graph, a first adjacency relationship corresponding to the target first node is determined from a preset adjacency relationship index file, and the target first node that matches the first adjacency relationship with the second adjacency relationship of the target first node in the query pattern graph is retained; Based on the retained target first node, a second node associated with the search keyword is obtained.

6. The method according to claim 5, characterized in that The association relationship between the plurality of first nodes includes edges between the plurality of first nodes; the adjacency relationship index file is constructed by the following steps: Determine the upper limit of the number of edges processed at a single time; Dividing the plurality of edges in the information knowledge graph into at least one edge tuple list according to the upper limit of the number of edges; the number of edges contained in each edge tuple list is less than or equal to the upper limit of the number of edges; Processing the at least one edge tuple list in sequence to obtain an ordered edge tuple list corresponding to each edge tuple list; wherein each processing is used to sequentially sort the edges in the edge tuple list according to the first node; Each of the ordered edge tuple lists is merged to obtain the adjacency relationship index file.

7. The method according to claim 1, characterized in that The determining, according to the node relationship index, a third node associated with the second node and a node relationship between the second node and the third node comprises: Obtaining the weight of the second node, adjusting the parameter according to a preset number of nodes, and selecting a target second node that meets the weight condition from the plurality of second nodes; The second node relationship information corresponding to each of the target second nodes is obtained from the node relationship index, and the third node associated with the target second node and the node association relationship between the target second node and the third node are determined according to the second node relationship information.

8. The method according to claim 1, characterized in that The generating a node connectivity graph according to the second node, the third node and the node association relationship comprises: If the retrieval task execution space is smaller than the space threshold for batch processing, storing the second node, the third node and the node association relationship in other storage spaces outside the retrieval task execution space; The second node, the third node and the node association relationship are read in batches from the other storage space to the retrieval task execution space for processing to generate the node connectivity graph.

9. A network protocol information retrieval device, characterized in that: The device comprises: A search request acquisition module, used to obtain search keywords in response to a network protocol information search request; An index building module, used to obtain a node index and a node relationship index corresponding to an information knowledge graph; the information knowledge graph includes a plurality of first nodes corresponding to each of the network protocol information and an association relationship between the plurality of the first nodes, the node index records the first nodes associated with each keyword, and the node relationship index records the association relationship between each of the first nodes and other associated first nodes; A search execution module, used to match the search keyword with the node index, determine a second node associated with the search keyword based on the matching result, and determine a third node associated with the second node and a node association relationship between the second node and the third node according to the node relationship index; The retrieval result generating module is used to generate a node connectivity graph according to the second node, the third node and the node association relationship, and obtain the retrieval result based on the node connectivity graph.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images