Data matching method and device, computer equipment and storage medium

Abstract

The invention relates to a data matching method and device, computer equipment and a storage medium. The method comprises the following steps: performing rule matching on a to-be-detected data packet by adopting each candidate sub-rule to obtain a target sub-rule hit in each candidate sub-rule; determining a target combination rule to which the target sub-rule belongs according to the sub-rule identifier corresponding to the target sub-rule; and determining a matching result of the to-be-detected data packet to the target combination rule according to the target sub-rule, the logic relationship between the sub-rules in the target combination rule and the rule type corresponding to the target combination rule. According to the scheme, compared with only judging whether all sub-rules in the target combination rule are hit or not, whether the to-be-detected data packet hits the target combination rule or not can be more accurately judged, and therefore the network data packet rule matching accuracy is improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a data matching method, apparatus, computer equipment and storage medium. Background Art

[0002] Network security means that the hardware, software and data in the network system are protected from accidental or malicious damage, change or leakage, and the system continues to operate normally and the network service is not interrupted. The network packet feature rules are used to scan and match network packets, and can identify and defend against network attacks to achieve network security.

[0003] In traditional technology, multiple rules are usually used to match network data packets, and the hit is determined by comparing the rule snapshot size with the hit mark. This matching method can only determine the case where the logical relationship between multiple rules is AND. If there are other logical relationships (such as OR, NOT, etc.) between multiple rules, this method cannot be used for judgment, resulting in low accuracy of network data packet rule matching. Summary of the invention

[0004] Based on this, it is necessary to provide a data matching method, device, computer equipment and storage medium to address the above technical problems, which can improve the accuracy of network data packet rule matching.

[0005] In a first aspect, the present application provides a data matching method, the method comprising:

[0006] Use each candidate sub-rule to perform rule matching on the data packet to be detected, and obtain the target sub-rule hit by each candidate sub-rule;

[0007] Determine the target combination rule to which the target sub-rule belongs according to the sub-rule identifier corresponding to the target sub-rule;

[0008] According to the target sub-rule, the logical relationship between the sub-rules in the target combination rule and the rule type corresponding to the target combination rule, the matching result of the data packet to be detected to the target combination rule is determined.

[0009] In an embodiment of the present application, according to the rule type corresponding to the target combination rule, it can be determined whether the matching result of the historical data packet hitting the sub-rule is needed in the process of judging whether the data packet to be detected hits the target combination rule; and further combined with the hit target sub-rule and the logical relationship between the sub-rules in the target combination rule, a judgment is made as to whether the data packet to be detected hits the target combination rule; compared to only judging whether all the sub-rules in the target combination rule are hit, the present application can more accurately judge whether the data packet to be detected hits the target combination rule, thereby improving the accuracy of network data packet rule matching.

[0010] In one of the embodiments, determining the matching result of the target combination rule of the data packet to be detected according to the target sub-rule, the logical relationship between the sub-rules in the target combination rule, and the rule type corresponding to the target combination rule includes:

[0011] If the rule type is a data flow type, then obtain the flow hit information associated with the data packet to be detected; wherein the flow hit information includes the detected data packet corresponding to the data flow to which the data packet to be detected belongs, and the hit result of the data flow sub-rule in each candidate sub-rule;

[0012] According to the flow hit information, the target sub-rule and the logical relationship between the sub-rules in the target combination rule, the matching result of the data packet to be detected to the target combination rule is determined.

[0013] In an embodiment of the present application, by storing the hit results of the detected data packets corresponding to the same data stream for the data stream sub-rules in each candidate sub-rule, cross-packet rule matching can be performed for the data packets in the same data stream. Compared with rule matching for all data packets of different data streams, the problem of data packets in different streams hitting different sub-rules in a combined rule can be avoided, thereby avoiding the problem of false hits in cross-packet rule matching for data packets in different streams, thereby improving the accuracy of matching data packets with rules.

[0014] In one embodiment, determining the matching result of the data packet to be detected to the target combination rule according to the flow hit information, the target sub-rule and the logical relationship between the sub-rules in the target combination rule includes:

[0015] Determine the hit result of the detected data packet on the data flow sub-rule in the target combination rule according to the flow hit information and the data flow sub-rule included in the target combination rule;

[0016] The matching result of the data packet to be detected on the target combination rule is determined based on the hit result of the detected data packet on the data flow sub-rule in the target combination rule, the target sub-rule, and the logical relationship between the sub-rules in the target combination rule.

[0017] In an embodiment of the present application, the data flow sub-rule ID of the target combination rule hit by the detected data packet is screened out from the flow hit information, and further the matching result of the target combination rule of the data packet to be detected can be determined based on the data flow sub-rule ID of the target combination rule hit by the detected data packet, the target sub-rule, and the logical relationship between the sub-rules in the target combination rule, and the hit mode of multiple target combination rules can be detected, thereby improving the accuracy of the matching between the data packet and the rule.

[0018] In one embodiment, the method further comprises:

[0019] According to the session identifier of the data packet to be detected, the data stream to which the data packet to be detected belongs is determined; wherein the session identifier is determined according to the source Internet Protocol IP address, source port, destination IP address, destination port and transmission protocol.

[0020] In an embodiment of the present application, by determining the data stream to which a data packet belongs based on the session identifier of the data packet, data packets in different data streams can be distinguished, so as to facilitate subsequent rule matching judgment for data packets in one data stream, thereby avoiding false hit problems caused by rule matching for data packets in multiple data streams.

[0021] In one of the embodiments, determining the matching result of the target combination rule of the data packet to be detected according to the target sub-rule, the logical relationship between the sub-rules in the target combination rule, and the rule type corresponding to the target combination rule includes:

[0022] If the rule type corresponding to the target combination rule is a single packet type, the matching result of the data packet to be detected to the target combination rule is determined according to the logical relationship between the target sub-rule and each sub-rule in the target combination rule.

[0023] In an embodiment of the present application, an implementable method is provided for determining whether a data packet to be detected hits a target combination rule whose rule type is a single packet type, thereby enriching the detection method for detecting whether the data packet to be detected satisfies the target combination rule, thereby making the matching result of the data packet and the rule more reliable.

[0024] In one embodiment, the method of using each candidate sub-rule to perform rule matching on the data packet to be detected to obtain the target sub-rule hit by each candidate sub-rule includes:

[0025] Determining whether the data packet to be detected needs to be spliced ​​according to the data length and the length threshold of the data packet to be detected;

[0026] If necessary, according to the associated data packet of the data packet to be detected, the data packet to be detected is subjected to a packet splicing operation to obtain a new data packet to be detected; wherein the associated data packet contains the packet content of the data packet to be detected, and the data stream to which the associated data packet belongs is the same as the data stream to which the data packet to be detected belongs;

[0027] Each candidate sub-rule is used to perform rule matching on a new data packet to be detected, and a target sub-rule hit by each candidate sub-rule is obtained.

[0028] In the embodiment of the present application, by determining whether the data packet to be detected needs to be spliced, the data packet is spliced ​​and then rule matching is performed, thereby avoiding the problem of inaccurate matching results caused by incomplete data packet to be detected.

[0029] In one embodiment, the method of using each candidate sub-rule to perform rule matching on the data packet to be detected to obtain the target sub-rule hit by each candidate sub-rule includes:

[0030] The candidate sub-rules in each rule matching library are used in turn to match the data packets to be detected, and the target sub-rules hit in each candidate sub-rule are obtained; wherein each candidate sub-rule contained in each rule matching library is used to match data of the same data type.

[0031] In an embodiment of the present application, each sub-rule is divided into different rule matching libraries according to the data type of the data detected when each sub-rule is matched, and the candidate sub-rules in each rule matching library are used in turn to perform rule matching on the data packets to be detected, which can improve the efficiency of rule matching.

[0032] In a second aspect, the present application further provides a data matching device, the device comprising:

[0033] A matching module, used to perform rule matching on the data packet to be detected by using each candidate sub-rule to obtain a target sub-rule hit by each candidate sub-rule;

[0034] A first determination module, configured to determine a target combination rule corresponding to the target sub-rule according to a sub-rule identifier corresponding to the target sub-rule;

[0035] The second determination module is used to determine the matching result of the target combination rule of the data packet to be detected according to the target sub-rule, the logical relationship between the sub-rules in the target combination rule and the rule type corresponding to the target combination rule.

[0036] In a third aspect, the present application further provides a computer device, the computer device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program:

[0037] Use each candidate sub-rule to perform rule matching on the data packet to be detected, and obtain the target sub-rule hit by each candidate sub-rule;

[0038] Determine the target combination rule to which the target sub-rule belongs according to the sub-rule identifier corresponding to the target sub-rule;

[0039] According to the target sub-rule, the logical relationship between the sub-rules in the target combination rule and the rule type corresponding to the target combination rule, the matching result of the data packet to be detected to the target combination rule is determined.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0041] Use each candidate sub-rule to perform rule matching on the data packet to be detected, and obtain the target sub-rule hit by each candidate sub-rule;

[0042] Determine the target combination rule to which the target sub-rule belongs according to the sub-rule identifier corresponding to the target sub-rule;

[0043] According to the target sub-rule, the logical relationship between the sub-rules in the target combination rule and the rule type corresponding to the target combination rule, the matching result of the data packet to be detected to the target combination rule is determined.

[0044] In a fifth aspect, the present application further provides a computer program product, the computer program product comprising a computer program, which implements the following steps when executed by a processor:

[0045] Use each candidate sub-rule to perform rule matching on the data packet to be detected, and obtain the target sub-rule hit by each candidate sub-rule;

[0046] Determine the target combination rule to which the target sub-rule belongs according to the sub-rule identifier corresponding to the target sub-rule;

[0047] According to the target sub-rule, the logical relationship between the sub-rules in the target combination rule and the rule type corresponding to the target combination rule, the matching result of the data packet to be detected to the target combination rule is determined.

[0048] The above data matching method, device, computer equipment and storage medium use each candidate sub-rule to match the data packet to be detected, and obtain the target sub-rule hit in each candidate sub-rule; and determine the target combination rule to which the target sub-rule belongs according to the sub-rule identifier corresponding to the target sub-rule; and then determine the matching result of the data packet to be detected to the target combination rule according to the target sub-rule, the logical relationship between each sub-rule in the target combination rule and the rule type corresponding to the target combination rule. The above scheme can determine whether the matching result of the historical data packet hitting the sub-rule is needed in the process of judging whether the data packet to be detected hits the target combination rule according to the rule type corresponding to the target combination rule; and further combine the hit target sub-rule and the logical relationship between each sub-rule in the target combination rule to judge whether the data packet to be detected hits the target combination rule; compared with only judging whether all sub-rules in the target combination rule are hit, the present application can more accurately judge whether the data packet to be detected hits the target combination rule, thereby improving the accuracy of network data packet rule matching. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1A A schematic diagram of a flow chart of a data matching method in one embodiment;

[0050] Figure 1B A schematic diagram of a rule preconfiguration process in an embodiment;

[0051] Figure 1C A schematic diagram of a flow chart for determining target combination rules in one embodiment;

[0052] Figure 1D A schematic diagram of a flow chart of determining whether a data packet to be detected hits a target combination rule in one embodiment;

[0053] Figure 2A A schematic diagram of a flow chart of determining a target combination rule matching a data packet to be detected in one embodiment;

[0054] Figure 2B A schematic diagram of a process of storing a data flow sub-rule ID into flow hit information in one embodiment;

[0055] Figure 3 A schematic diagram of a flow chart of determining a target combination rule matching a data packet to be detected in another embodiment;

[0056] Figure 4 A schematic diagram of a process of performing rule matching on a spliced ​​data packet to be detected in one embodiment;

[0057] Figure 5 is a flow chart of a data matching method in another embodiment;

[0058] Figure 6is a structural block diagram of a data matching device in one embodiment;

[0059] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0061] The data matching method provided in the embodiment of the present application can be applied to the application scenario of matching network data packets with rules to identify and defend against network attacks. For example, in the field of network security, network data packet feature rule matching is a basic and important technology, which scans and retrieves network data packets through preset rules to filter out data packets that meet specific rule characteristics, and marks these data packets for subsequent processing. In Deep Packet Inspection (DPI) and Intrusion Prevention System (IPS), network data packet feature rule matching provides a strong guarantee for network security.

[0062] The data matching method provided in the embodiment of the present application can be executed by a server or by a terminal device with a certain computing power. Among them, the server can be implemented by an independent server or a server cluster composed of multiple servers. The terminal can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc.

[0063] In one embodiment, Figure 1A As shown, a flow chart of a data matching method is provided, which is described by taking the method applied to a server as an example, and includes the following steps:

[0064] S101, using each candidate sub-rule to perform rule matching on a data packet to be detected, and obtaining a target sub-rule that is hit in each candidate sub-rule.

[0065] Before matching rules to the data packets to be detected, you can pre-configure rules.

[0066] See also Figure 1B , Figure 1BA schematic diagram of a rule preconfiguration process is provided. Specifically, a rule file can be preloaded, and the rule file includes multiple combination rules, and each combination rule includes one or more sub-rules. The sub-rules under each combination rule in the rule file are used as candidate sub-rules. When there is a data stream, it is necessary to match the rules of each data packet of the data stream to determine whether the data packet is attacked by the network. Each candidate sub-rule is usually matched based on the five-tuple information, timestamp, data payload content and other fields of the data packet, wherein the five-tuple information includes the source Internet Protocol (IP) address, destination IP address, source port, destination port, and transmission protocol.

[0067] Exemplarily, if the candidate sub-rule is for matching IP addresses, it can specifically determine whether the source IP address or destination IP address of the data packet to be detected matches a known malicious IP address list (blacklist) or a trusted IP address list (whitelist).

[0068] If the candidate sub-rule is for matching ports, it can specifically determine whether the source port number or destination port number of the packet to be detected matches the expected port number of a specific service or protocol, or whether it matches a known malicious port number (such as a port used for command and control channels).

[0069] If the candidate sub-rule matches the transport protocol, the possible attack can be identified based on the protocol type of the data packet to be detected; the protocol type can be Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP), etc. For example, some types of attacks may be more common in UDP or ICMP protocols.

[0070] If the candidate sub-rule matches on packet size, an abnormally large packet or a series of small packets may indicate an attack, such as a fragmentation attack or a buffer overflow attack.

[0071] If the candidate sub-rule is to match the data payload content, a keyword search or pattern matching can be performed on the data payload part of the data packet to be detected to detect whether there is malicious code, virus, Trojan horse, etc.

[0072] If the candidate sub-rule matches the time and behavior patterns of data packets, it can identify abnormal network activities that occur within a specific time period, which may indicate planned attack behavior. It can also identify abnormal network behavior patterns by analyzing the interactions and relationships between a series of data packets, such as rapidly changing source IP addresses, port scans, etc.

[0073] Furthermore, the rule content in the rule file can be parsed, and a globally unique combination rule identity (identity, id (rule_id)) is assigned to each combination rule, and a globally unique sub-rule id (sub_rule_id) is assigned to each sub-rule in the combination rule. The logical relationship between the sub-rules in each combination rule is parsed, and the logical relationship of the sub-rules is stored in a logical relationship tree, which is used to determine whether the combination rule is hit after the sub-rule is hit.

[0074] It should be noted that in order to improve the rule matching efficiency of the data packets to be detected, each sub-rule can be divided into different rule matching libraries in advance according to the data type of the data detected when each sub-rule is matched. In this way, the rules in the same rule matching library only match one data type of the data packet to be detected, which can improve the matching efficiency.

[0075] Exemplarily, data types include but are not limited to IP addresses, ports, load contents, etc., and correspondingly, the rule matching library obtained by division can be a numerical matching library, a string matching library, a regular matching library, etc. Among them, each candidate sub-rule contained in each rule matching library is used to match data of the same data type. When performing rule matching on a data packet to be detected, the candidate sub-rules in each rule matching library can be used in turn to perform rule matching on the data packet to be detected, and the target sub-rule hit in each candidate sub-rule can be obtained.

[0076] In an embodiment of the present application, each sub-rule is divided into different rule matching libraries according to the data type of the data detected when each sub-rule is matched, and the candidate sub-rules in each rule matching library are used in turn to perform rule matching on the data packets to be detected, which can improve the efficiency of rule matching.

[0077] Furthermore, a main engine can be built based on the combination rules and sub-rules, the logical relationship tree corresponding to each combination rule, each rule matching library and other data, and the main engine is used for packet rule matching. After creating the main engine, you can also use the non-uniform memory access (NUMA) memory where the thread is located to create a thread-level engine, copy the relevant data structure in the main engine to the thread-level engine, implement localized operations, and use the thread-level engine for scanning when matching packet rules. Since the memory accessed by the thread-level engine is on the same NUMA as the thread-level engine, the rule matching speed can be accelerated.

[0078] Based on this, each candidate sub-rule can be used to match the data packet to be detected to determine whether the field in the data packet to be detected satisfies each candidate sub-rule; if the field in the data packet to be detected satisfies the candidate sub-rule, it is considered that the candidate sub-rule is hit. The hit sub-rules are used as target sub-rules.

[0079] S102: Determine the target combination rule to which the target sub-rule belongs according to the sub-rule identifier corresponding to the target sub-rule.

[0080] Exemplarily, each sub-rule under each combination rule may be associated with the combination rule, so that the IDs of each sub-rule under the combination rule may be determined according to the combination rule ID; the combination rule ID to which the sub-rule belongs may also be determined according to the sub-rule ID.

[0081] Therefore, the target combination rule id to which the target sub-rule belongs can be determined according to the sub-rule identifier corresponding to the target sub-rule, and then the target combination rule can be queried according to the target combination rule id.

[0082] For example, see Figure 1C , Figure 1C A flowchart for determining target combination rules is provided.

[0083] Specifically, when the rule matching is performed on the data packet to be detected, it is determined whether the data packet to be detected currently hits the candidate sub-rule. If the candidate sub-rule is hit, the hit candidate sub-rule is used as the target sub-rule.

[0084] Further, the target sub-rule information is obtained according to the sub-rule id of the target sub-rule, and it can be determined whether the target sub-rule is a data flow sub-rule according to the target sub-rule information. If so, the hit status of the target sub-rule is recorded, and the target sub-rule id is stored in the flow hit information corresponding to the data flow to which the data packet to be detected belongs. If the target sub-rule is a single-packet sub-rule, the hit status of the target sub-rule is directly recorded. Among them, storing the target sub-rule id in the flow hit information can effectively reduce the memory of the flow hit information and improve storage utilization.

[0085] Furthermore, the target combination rule including the target sub-rule can be found according to the target sub-rule id, and the target combination rule can be put into the waiting data group to determine whether the data packet to be detected hits the target combination rule.

[0086] S103, determining a matching result of the target combination rule for the data packet to be detected according to the target sub-rule, the logical relationship between the sub-rules in the target combination rule, and the rule type corresponding to the target combination rule.

[0087] Exemplarily, the logical relationship may be at least one of AND, OR, and NOT; the rule types of the combination rule include data stream type and single packet type; if the combination rule is a single packet type combination rule, the sub-rule in the combination rule is a single packet sub-rule, that is, only when a single data packet hits all or part of the sub-rules under the combination rule, the data packet is considered to hit the combination rule.

[0088] If the combination rule is a data flow type combination rule, the combination rule needs to include at least one data flow sub-rule, which may include a single packet sub-rule or not. That is, if one of the data packets in the same data flow hits the data flow sub-rule, it is considered that all data packets corresponding to the data flow hit the data flow sub-rule. In this way, it can be determined whether multiple data packets hit all or part of the sub-rules under the combination rule to determine whether the data to be detected hits the combination rule.

[0089] Exemplarily, assuming that the target combination rule includes three sub-rules A, B and C, the logical relationship between the sub-rules in the target combination rule can be A||B||C, that is, any one of the three sub-rules can be hit; the logical relationship between the sub-rules in the target combination rule can also be (A||B)&C, that is, sub-rule C is hit and any one of sub-rule A and sub-rule B is hit; the logical relationship between the sub-rules can also be A&B&!C, that is, some sub-rules are prohibited from hitting, and some sub-rules are allowed to hit. Specifically, sub-rule A and sub-rule B can be hit, but sub-rule C is not hit.

[0090] It should be noted that the logical relationship between the above-mentioned sub-rules is only an exemplary description and is not used to limit the logical relationship between the sub-rules; the combination of logical relationships of AND, OR, and NOT between the sub-rules in any target combination rule is within the protection scope of this application.

[0091] Exemplarily, if the rule type of the target combination rule is a single packet type, the target combination rule includes sub-rule 1, sub-rule 2 and sub-rule 3, and the logical relationship between the sub-rules in the target combination rule is (1 or 2) and 3, that is, only when the data packet to be detected hits sub-rule 1 and sub-rule 3 at the same time, or hits sub-rule 2 and sub-rule 3 at the same time, will the data packet to be detected be considered to have hit the target combination rule.

[0092] If the rule type of the target combination rule is a data flow type, the target combination rule includes sub-rule 4, sub-rule 5 and sub-rule 6, and the logical relationship between the sub-rules in the target combination rule is (4 or 5) and 6, where sub-rule 6 is a data flow sub-rule, and sub-rule 4 and sub-rule 5 are single-packet sub-rules; that is, if the data packet to be detected hits sub-rule 4 or sub-rule 5, and other data packets in the data flow to which the data packet to be detected belongs hit sub-rule 6, it is considered that the data packet to be detected hits the combination rule.

[0093] For example, see Figure 1D , Figure 1D A flowchart for determining whether a data packet to be detected hits a target combination rule is provided.

[0094] Specifically, the array on standby can be traversed first to determine whether there is a target combination rule that needs to be matched in the array on standby; if not, it is considered that the data to be detected currently does not hit the candidate sub-rule and does not need to be processed. If there is a target combination rule that needs to be matched in the array on standby, it is determined whether there is a data flow combination rule in the target combination rule, and there is at least one data flow sub-rule in the data flow combination rule.

[0095] If there is a data flow combination rule in the target combination rule, the flow hit information corresponding to the data flow can be imported, and the data flow sub-rule information that has been hit can be determined according to the data flow sub-rule id in the flow hit information, and the hit status of the hit data flow sub-rule can be recorded; then, according to the target sub-rule, the logical relationship between the sub-rules in the target combination rule, and the hit data flow sub-rule, it is determined whether the data packet to be detected hits the target combination rule.

[0096] If there is no data flow combination rule in the target combination rule, it can be directly determined whether the data packet to be detected hits the target combination rule according to the target sub-rule and the logical relationship between the sub-rules in the target combination rule.

[0097] The above data matching method uses each candidate sub-rule to match the data packet to be detected, and obtains the target sub-rule hit in each candidate sub-rule; and according to the sub-rule identifier corresponding to the target sub-rule, determines the target combination rule to which the target sub-rule belongs; and then determines the matching result of the data packet to be detected to the target combination rule according to the target sub-rule, the logical relationship between each sub-rule in the target combination rule and the rule type corresponding to the target combination rule. The above scheme can determine whether the matching result of the historical data packet hitting the sub-rule is needed in the process of judging whether the data packet to be detected hits the target combination rule according to the rule type corresponding to the target combination rule; and further combines the hit target sub-rule and the logical relationship between each sub-rule in the target combination rule to judge whether the data packet to be detected hits the target combination rule; compared with only judging whether all sub-rules in the target combination rule are hit, the present application can more accurately judge whether the data packet to be detected hits the target combination rule, thereby improving the accuracy of network data packet rule matching.

[0098] In some optional implementations, the embodiments of the present application introduce an implementation method in which the rule type is a data flow type target combination rule, and determines whether the data packet to be detected hits the combination rule.

[0099] See also Figure 2A , Figure 2A A flow chart of determining a matching result of a target combination rule for a data packet to be detected is provided, which specifically includes the following steps:

[0100] S201: If the rule type is a data flow type, then obtain flow hit information associated with the data packet to be detected.

[0101] It should be noted that the combined rule whose rule type is data flow type includes data flow sub-rules. If there is a data packet in the same data flow that hits the data flow sub-rule, it is considered that each data packet in the data flow hits the data flow sub-rule. Therefore, it is necessary to store the sub-rule id of the hit data flow sub-rule in the flow hit information. That is, the flow hit information includes the detected data packets corresponding to the data flow to which the data packet to be detected belongs, and the hit results of the data flow sub-rules in each candidate sub-rule.

[0102] For example, see Figure 2B , Figure 2B A flowchart of storing data flow sub-rule IDs into flow hit information is provided.

[0103] Specifically, after obtaining the data packet to be detected, the data stream corresponding to the data packet to be detected is determined; if the data packet needs to be assembled, the data packet is assembled to obtain a complete data packet to be detected.

[0104] The flow hit information corresponding to the data flow to which the data packet to be detected belongs is further imported; if the packet splicing operation is not required, the flow hit information corresponding to the data flow to which the data packet to be detected belongs can be directly imported.

[0105] Next, the data packet to be detected is matched with rules, and it is determined whether the data packet to be detected hits the candidate sub-rule. If the hit candidate sub-rule is a data flow sub-rule, the id of the candidate sub-rule is stored in the flow hit information.

[0106] The flow hit information is exported so as to perform the rule matching operation of the next data packet to be detected. In addition, in the case of a data flow timeout, for example, if no data packet corresponding to the data flow is detected within a preset time period, the data flow is considered to be over. At this time, the flow hit information can be released to reduce memory usage.

[0107] Based on this, if the rule type of the target combination rule is a data flow type, when judging whether the data packet to be detected hits the target combination rule, it is necessary to obtain the flow hit information associated with the data packet to be detected, and judge whether the data packet to be detected hits the target combination rule based on the target sub-rule hit by the data packet to be detected and the flow hit information.

[0108] S202, determining a matching result of the target combination rule of the data packet to be detected according to the flow hit information, the target sub-rule and the logical relationship between the sub-rules in the target combination rule.

[0109] Exemplarily, the sub-rule ID of the data flow sub-rule in the target combination rule hit by the detected data packet in the data flow to which the data packet to be detected belongs can be determined based on the flow hit information, and then the matching result of the data packet to be detected for the target combination rule can be determined based on the flow hit information, the target sub-rule and the logical relationship between the sub-rules in the target combination rule.

[0110] For example, suppose that target combination rule 1 includes sub-rule 11, sub-rule 12 and sub-rule 13, where sub-rule 11 is a data flow sub-rule, and sub-rule 12 and sub-rule 13 are single-packet sub-rules; target combination rule 2 includes sub-rule 21, sub-rule 22 and sub-rule 23, where sub-rule 21 is a data flow sub-rule, and sub-rule 22 and sub-rule 23 are single-packet sub-rules. The logical relationship of target combination rule 1 is (sub-rule 11 or sub-rule 12) and sub-rule 13; the logical relationship of target combination rule 2 is sub-rule 21 and (sub-rule 22 or sub-rule 23).

[0111] If the flow hit information includes the ID of sub-rule 11 and the ID of sub-rule 21, it means that the detected data packet in the data flow corresponding to the data packet to be detected has hit sub-rule 11 and sub-rule 21; if the target sub-rule hit by the data packet to be detected is sub-rule 13, it is determined that the data packet to be detected hits the target combination rule 1, but does not hit the target combination rule 2; if the target sub-rule hit by the data packet to be detected is sub-rule 12, it is determined that the data packet to be detected does not hit the target combination rule 1 and the target combination rule 2.

[0112] In an embodiment of the present application, by storing the hit results of the detected data packets corresponding to the same data stream for the data stream sub-rules in each candidate sub-rule, cross-packet rule matching can be performed for the data packets in the same data stream. Compared with rule matching for all data packets of different data streams, the problem of data packets in different streams hitting different sub-rules in a combined rule can be avoided, thereby avoiding the problem of false hits in cross-packet rule matching for data packets in different streams, thereby improving the accuracy of matching data packets with rules.

[0113] In some optional implementations, the embodiments of the present application introduce in detail a method for implementing a rule type of a data flow type target combination rule to determine whether a data packet to be detected hits the combination rule.

[0114] See also Figure 3 , Figure 3 Another flow chart for determining a matching result of a target combination rule for a data packet to be detected is provided, which specifically includes the following steps:

[0115] S301, determining a hit result of a detected data packet on a data flow sub-rule in a target combination rule according to flow hit information and a data flow sub-rule included in a target combination rule.

[0116] It should be noted that the target combination rule can be one or more, that is, as long as it includes a target sub-rule combination rule, it is considered to be a target combination rule. The flow hit information may include the data flow sub-rule contained in the target combination rule, or it may not include the data flow sub-rule contained in the target combination rule. Therefore, it is necessary to determine the hit result of the detected data packet on the data flow sub-rule in the target combination rule based on the sub-rule id in the flow hit information and the data flow sub-rule id contained in the target combination rule, that is, to determine whether the detected data packet hits the data flow sub-rule id contained in the target combination rule.

[0117] S302, determining a matching result of the data packet to be detected on the target combination rule according to the hit result of the detected data packet on the data flow sub-rule in the target combination rule, the target sub-rule, and the logical relationship between the sub-rules in the target combination rule.

[0118] Furthermore, the data flow sub-rule included in the detected data packet hit target combination rule can be determined according to the hit result of the data flow sub-rule in the detected data packet hit target combination rule, that is, according to the data flow sub-rule id included in the detected data packet hit target combination rule. And according to the data flow sub-rule, target sub-rule included in the detected data packet hit target combination rule, and the logical relationship between each sub-rule in the target combination rule, the matching result of the data packet to be detected to the target combination rule is determined.

[0119] In an embodiment of the present application, the data flow sub-rule ID of the target combination rule hit by the detected data packet is screened out from the flow hit information, and further the matching result of the target combination rule of the data packet to be detected can be determined based on the data flow sub-rule ID of the target combination rule hit by the detected data packet, the target sub-rule, and the logical relationship between the sub-rules in the target combination rule, and the hit mode of multiple target combination rules can be detected, thereby improving the accuracy of the matching between the data packet and the rule.

[0120] It should be noted that, since a flow hit information stores the id of the data flow sub-rule hit by each data packet under a data flow, so that the data packet to be detected in the data flow can determine whether it hits the target combination rule in combination with the flow hit information, different data packets need to be divided into different data flows.

[0121] Exemplarily, the data stream to which the data packet to be detected belongs can be determined based on the session identifier of the data packet to be detected. The session identifier can be at least two of the source IP address, source port, destination IP address, destination port, and transport protocol. The session identifiers of the data packets under the same data stream are the same, so that the data stream can be determined based on the session identifier of the data packet, and the data packets of different data streams can be distinguished.

[0122] Optionally, a hash table can be used to store the mapping relationship between the session identifier and the flow node. The flow node is searched according to the session identifier. If the flow node cannot be found, a flow node is created and placed in the hash table, and a piece of memory is allocated on the flow node to store the flow hit information of the data flow to which the session identifier belongs.

[0123] In an embodiment of the present application, by determining the data stream to which a data packet belongs based on the session identifier of the data packet, data packets in different data streams can be distinguished, so as to facilitate subsequent rule matching judgment for data packets in one data stream, thereby avoiding false hit problems caused by rule matching for data packets in multiple data streams.

[0124] In some optional implementations, the embodiments of the present application introduce an implementation method in which the rule type is a single-packet type target combination rule, and determines whether the data packet to be detected hits the combination rule.

[0125] Exemplarily, if the rule type corresponding to the target combination rule is a single packet type, that is, the sub-rules in the target combination rule are all single packet sub-rules, then the matching result of the target combination rule for the data packet to be detected can be determined based on the logical relationship between the target sub-rule and each sub-rule in the target combination rule.

[0126] It should be noted that if the rule type corresponding to the target combination rule is a single packet type, it is only necessary to determine whether the target sub-rule hit by the data packet to be detected satisfies the logical relationship between the sub-rules in the target combination rule. If so, it is considered that the data packet to be detected hits the target combination rule; otherwise, it is considered that the data packet to be detected does not hit the target combination rule.

[0127] For example, if the target combination rule includes sub-rule a, sub-rule b and sub-rule c; the logical relationship between the sub-rules in the target combination rule is sub-rule a and (sub-rule b or sub-rule c). If the target sub-rule hit by the data to be detected is sub-rule a and sub-rule b, or sub-rule a and sub-rule c, then it is considered that the data packet to be detected hits the target combination rule. If the target sub-rule hit by the data to be detected is sub-rule a, or sub-rule b, or sub-rule c, or sub-rule b and sub-rule c, then it is considered that the data packet to be detected does not hit the target combination rule.

[0128] In an embodiment of the present application, an implementable method is provided for determining whether a data packet to be detected hits a target combination rule whose rule type is a single packet type, thereby enriching the detection method for detecting whether the data packet to be detected satisfies the target combination rule, thereby making the matching result of the data packet and the rule more reliable.

[0129] In some optional implementations, when the length of the transmitted data packet is too long, it may exceed the maximum transmission unit (MTU) limit in the network, resulting in the data packet being unable to be directly transmitted. In this case, the data packet can be split into multiple smaller fragments for transmission. After receiving the fragments corresponding to the data packet, these fragments need to be reassembled to obtain the original data packet; then the original data packet is matched with rules.

[0130] For example, see Figure 4 , Figure 4 A schematic diagram of a process for matching rules on the spliced ​​data packets to be detected is provided, which specifically includes the following steps:

[0131] S401, determining whether a packet splicing operation is required for the data packet to be detected according to the data length and the length threshold of the data packet to be detected.

[0132] The length threshold can be understood as the length of the maximum data packet that the maximum transmission unit can accommodate. When the data length of the data packet to be detected is greater than the length threshold, it is determined that the data packet to be detected needs to be spliced.

[0133] S402: If necessary, according to the associated data packets of the data packet to be detected, a packet splicing operation is performed on the data packet to be detected to obtain a new data packet to be detected.

[0134] If it is determined that the data packet to be detected needs to be spliced, then the associated data packet with the same packet identifier as the data packet to be detected can be queried based on the packet identifier of the data packet to be detected. For example, a portion of the data content at the end of the previous data packet can be copied to the front of the load of the data packet to be detected. Among them, the associated data packet contains the packet content of the data packet to be detected, and the data stream to which the associated data packet belongs is the same as the data stream to which the data packet to be detected belongs. Therefore, the data packet to be detected can be spliced ​​based on the associated data packet of the data packet to be detected to obtain a new data packet to be detected.

[0135] S403, using each candidate sub-rule to perform rule matching on the new data packet to be detected, and obtaining the target sub-rule hit by each candidate sub-rule.

[0136] Furthermore, each candidate sub-rule may be used to perform rule matching on a new data packet to be detected, and obtain a target sub-rule that is hit in each candidate sub-rule.

[0137] In the embodiment of the present application, by determining whether the data packet to be detected needs to be spliced, the data packet is spliced ​​and then rule matching is performed, thereby avoiding the problem of inaccurate matching results caused by incomplete data packet to be detected.

[0138] In some optional implementations, see Figure 5 , Figure 5 A flowchart of another data matching method is provided, which specifically includes the following steps:

[0139] S501, determining the data flow to which the data packet to be detected belongs according to the session identifier of the data packet to be detected.

[0140] S502, determining whether the data packet to be detected needs to be assembled according to the data length and the length threshold of the data packet to be detected, if so, executing S503; if not, executing S504.

[0141] S503, according to the associated data packets of the data packet to be detected, the data packet to be detected is assembled to obtain a new data packet to be detected; the candidate sub-rules in each rule matching library are used in turn to match the new data packet to be detected to obtain the target sub-rule hit in each candidate sub-rule.

[0142] S504, sequentially use the candidate sub-rules in each rule matching library to perform rule matching on the data packet to be detected, and obtain the target sub-rule that is hit in each candidate sub-rule.

[0143] S505: Determine the target combination rule to which the target sub-rule belongs according to the sub-rule identifier corresponding to the target sub-rule.

[0144] S506, determine whether the rule type of the target combination rule is a data flow type, if so, execute S507, if not, execute S510.

[0145] S507: Obtain flow hit information associated with the data packet to be detected.

[0146] S508: Determine the hit result of the detected data packet on the data flow sub-rule in the target combination rule according to the flow hit information and the data flow sub-rule included in the target combination rule.

[0147] S509, determining the matching result of the data packet to be detected on the target combination rule according to the hit result of the detected data packet on the data flow sub-rule in the target combination rule, the target sub-rule, and the logical relationship between the sub-rules in the target combination rule.

[0148] S510, determining a matching result of the target combination rule for the data packet to be detected according to the logical relationship between the target sub-rule and each sub-rule in the target combination rule.

[0149] In an embodiment of the present application, a session identifier is used to establish a data flow, and flow hit information is stored on the flow node to ensure that the cross-packet combination rule will not be mistakenly hit because the data packets on other flows hit the rules in the combination rule; at the same time, because the flow hit information is stored on the flow node, the flow hit information can be released when the data flow ends, and will not take up a large amount of memory.

[0150] In addition, the embodiment of the present application uses a small amount of packet payload splicing to solve the problem that the characteristic rule content appears in two packets due to IP fragmentation and other reasons. Compared with the traditional whole packet reorganization solution, it greatly saves memory and reduces data copying, which greatly improves the system operation speed.

[0151] In addition, for the combination rules of multiple feature rules, the embodiment of the present application can store the logical relationship between the rules (or, and, not, etc.). Even if each rule spans multiple data packets, the embodiment of the present application can summarize and analyze their hit status and determine whether the combination rules are correctly hit based on their logical relationship.

[0152] Finally, the matching rule engine constructed based on the NUMA architecture in the embodiment of the present application fully utilizes the multi-core characteristics of the central processing unit (CPU) and improves the data matching processing efficiency.

[0153] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0154] Based on the same inventive concept, the embodiment of the present application also provides a data matching device for implementing the data matching method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more data matching device embodiments provided below can refer to the limitations on the data matching method above, and will not be repeated here.

[0155] In one embodiment, Figure 6 As shown, a data matching device is provided, comprising:

[0156] A matching module 10 is used to perform rule matching on the data packet to be detected using each candidate sub-rule to obtain a target sub-rule hit by each candidate sub-rule;

[0157] A first determination module 20, configured to determine a target combination rule corresponding to a target sub-rule according to a sub-rule identifier corresponding to the target sub-rule;

[0158] The second determination module 30 is used to determine the matching result of the target combination rule of the data packet to be detected according to the target sub-rule, the logical relationship between the sub-rules in the target combination rule and the rule type corresponding to the target combination rule.

[0159] The above data matching device uses each candidate sub-rule to match the data packet to be detected, and obtains the target sub-rule hit in each candidate sub-rule; and determines the target combination rule to which the target sub-rule belongs according to the sub-rule identifier corresponding to the target sub-rule; and then determines the matching result of the data packet to be detected to the target combination rule according to the target sub-rule, the logical relationship between each sub-rule in the target combination rule and the rule type corresponding to the target combination rule. The above scheme can determine whether the matching result of the historical data packet hitting the sub-rule is needed in the process of judging whether the data packet to be detected hits the target combination rule according to the rule type corresponding to the target combination rule; and further combines the hit target sub-rule and the logical relationship between each sub-rule in the target combination rule to judge whether the data packet to be detected hits the target combination rule; compared with only judging whether all sub-rules in the target combination rule are hit, the present application can more accurately judge whether the data packet to be detected hits the target combination rule, thereby improving the accuracy of network data packet rule matching.

[0160] In one embodiment, the second determining module 30 specifically includes:

[0161] An acquisition unit, for acquiring flow hit information associated with the data packet to be detected if the rule type is a data flow type; wherein the flow hit information includes the detected data packet corresponding to the data flow to which the data packet to be detected belongs, and the hit result of the data flow sub-rule in each candidate sub-rule;

[0162] The first determination unit is used to determine the matching result of the data packet to be detected to the target combination rule according to the flow hit information, the target sub-rule and the logical relationship between the sub-rules in the target combination rule.

[0163] In one embodiment, the determining unit is specifically configured to:

[0164] According to the flow hit information and the data flow sub-rules contained in the target combination rules, the hit result of the detected data packet to the data flow sub-rule in the target combination rules is determined; according to the hit result of the detected data packet to the data flow sub-rule in the target combination rules, the target sub-rules, and the logical relationship between the sub-rules in the target combination rules, the matching result of the data packet to be detected to the target combination rules is determined.

[0165] In one of the embodiments, the apparatus further comprises a determining module, configured to:

[0166] According to the session identifier of the data packet to be detected, the data stream to which the data packet to be detected belongs is determined; wherein the session identifier is determined according to the source Internet Protocol IP address, source port, destination IP address, destination port and transmission protocol.

[0167] In one embodiment, the second determining module 30 further includes:

[0168] The second determining unit is used to determine the matching result of the target data packet to be detected to the target combination rule according to the logical relationship between the target sub-rule and each sub-rule in the target combination rule if the rule type corresponding to the target combination rule is a single packet type.

[0169] In one embodiment, the matching module 10 is specifically used for:

[0170] According to the data length and length threshold of the data packet to be detected, determine whether the data packet to be detected needs to be spliced; if necessary, perform a splicing operation on the data packet to be detected according to the associated data packet of the data packet to be detected to obtain a new data packet to be detected; wherein the associated data packet contains the packet content of the data packet to be detected, and the data stream to which the associated data packet belongs is the same as the data stream to which the data packet to be detected belongs; use each candidate sub-rule to perform rule matching on the new data packet to be detected, and obtain the target sub-rule hit in each candidate sub-rule.

[0171] In one embodiment, the matching module 10 is specifically used for:

[0172] The candidate sub-rules in each rule matching library are used in turn to match the data packets to be detected, and the target sub-rules hit in each candidate sub-rule are obtained; wherein each candidate sub-rule contained in each rule matching library is used to match data of the same data type.

[0173] Each module in the above data matching device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module.

[0174] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data packets, rule information and matching result data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data matching method is implemented.

[0175] Those skilled in the art will understand that Figure 7The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0176] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor implements the data matching method described in any of the above embodiments when executing the computer program.

[0177] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the data matching method described in any of the above embodiments is implemented.

[0178] In one embodiment, a computer program product is provided, including a computer program, which implements the data matching method described in any of the above embodiments when executed by a processor.

[0179] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0180] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0181] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0182] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data matching method, characterized in that: The method comprises: Use each candidate sub-rule to perform rule matching on the data packet to be detected, and obtain the target sub-rule hit by each candidate sub-rule; Determine the target combination rule to which the target sub-rule belongs according to the sub-rule identifier corresponding to the target sub-rule; According to the target sub-rule, the logical relationship between the sub-rules in the target combination rule and the rule type corresponding to the target combination rule, the matching result of the data packet to be detected to the target combination rule is determined.

2. The method according to claim 1, characterized in that Determining a matching result of the target combination rule for the data packet to be detected according to the target sub-rule, the logical relationship between the sub-rules in the target combination rule, and the rule type corresponding to the target combination rule includes: If the rule type is a data flow type, then obtain the flow hit information associated with the data packet to be detected; wherein the flow hit information includes the detected data packet corresponding to the data flow to which the data packet to be detected belongs, and the hit result of the data flow sub-rule in each candidate sub-rule; According to the flow hit information, the target sub-rule and the logical relationship between the sub-rules in the target combination rule, the matching result of the data packet to be detected to the target combination rule is determined.

3. The method according to claim 2, characterized in that Determining a matching result of the target combination rule of the data packet to be detected according to the flow hit information, the target sub-rule and a logical relationship between each sub-rule in the target combination rule includes: Determine the hit result of the detected data packet on the data flow sub-rule in the target combination rule according to the flow hit information and the data flow sub-rule included in the target combination rule; The matching result of the data packet to be detected on the target combination rule is determined based on the hit result of the detected data packet on the data flow sub-rule in the target combination rule, the target sub-rule, and the logical relationship between the sub-rules in the target combination rule.

4. The method according to claim 2, characterized in that: The method further comprises: According to the session identifier of the data packet to be detected, the data stream to which the data packet to be detected belongs is determined; wherein the session identifier is determined according to the source Internet Protocol IP address, source port, destination IP address, destination port and transmission protocol.

5. The method according to claim 1, characterized in that Determining a matching result of the target combination rule for the data packet to be detected according to the target sub-rule, the logical relationship between the sub-rules in the target combination rule, and the rule type corresponding to the target combination rule includes: If the rule type corresponding to the target combination rule is a single packet type, the matching result of the data packet to be detected to the target combination rule is determined according to the logical relationship between the target sub-rule and each sub-rule in the target combination rule.

6. The method according to any one of claims 1 to 5, characterized in that The method of using each candidate sub-rule to perform rule matching on the data packet to be detected to obtain the target sub-rule hit by each candidate sub-rule includes: Determining whether the data packet to be detected needs to be spliced ​​according to the data length and length threshold of the data packet to be detected; If necessary, according to the associated data packet of the data packet to be detected, the data packet to be detected is subjected to a packet splicing operation to obtain a new data packet to be detected; wherein the associated data packet contains the packet content of the data packet to be detected, and the data stream to which the associated data packet belongs is the same as the data stream to which the data packet to be detected belongs; Each candidate sub-rule is used to perform rule matching on a new data packet to be detected, and a target sub-rule hit by each candidate sub-rule is obtained.

7. The method according to any one of claims 1 to 5, characterized in that The method of using each candidate sub-rule to perform rule matching on the data packet to be detected to obtain the target sub-rule hit by each candidate sub-rule includes: The candidate sub-rules in each rule matching library are used in turn to match the data packets to be detected, and the target sub-rules hit in each candidate sub-rule are obtained; wherein each candidate sub-rule contained in each rule matching library is used to match data of the same data type.

8. A data matching device, characterized in that: The device comprises: A matching module, used to perform rule matching on the data packet to be detected by using each candidate sub-rule to obtain a target sub-rule hit by each candidate sub-rule; A first determination module, configured to determine a target combination rule corresponding to the target sub-rule according to a sub-rule identifier corresponding to the target sub-rule; The second determination module is used to determine the matching result of the target combination rule of the data packet to be detected according to the target sub-rule, the logical relationship between the sub-rules in the target combination rule and the rule type corresponding to the target combination rule.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images