Heterogeneous computing hardware and sensitive data high-speed identification method and system

Abstract

The invention provides heterogeneous computing hardware and a sensitive data high-speed identification method and system, and is applied to the field of sensitive data identification. The heterogeneous computing hardware comprises at least one type of programmable logic unit core, and the number of each type of programmable logic unit core is at least one; each programmable logic unit core configures different data matching rules based on the characteristics of to-be-processed network data so as to execute different data matching modes; and when the number of the programmable logic unit cores is multiple, the multiple programmable logic unit cores are mutually independent so as to realize parallel operation. According to the method and the device, multiple programmable logic unit cores are arranged, each programmable logic unit core can execute different data matching modes, so that parallel processing of different data types can be realized, the number of each programmable logic unit core is at least one, and parallel processing of the same data type can be further realized; and the sensitive data identification speed is greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of sensitive data identification, and in particular to heterogeneous computing hardware, a sensitive data high-speed identification method and a system. Background Art

[0002] With the rapid development and popularization of communication technology and the Internet, network information security issues are becoming more and more serious. Sensitive data identification and network intrusion detection are increasingly concerned by various industries. Sensitive data identification and network intrusion detection have important theoretical value and practical significance. Deep message detection technology is based on string matching algorithms. The intrusion detection system compares the received information through predefined and pattern matching, and compares known dangerous information through predefined and pattern matching. However, the above method is based on the serial precise character matching of the software system implemented by the CPU, matching each rule state one by one, with a single matching object, poor matching flexibility, and low recognition efficiency. It is not suitable for scenarios with large data volumes.

[0003] For sensitive data identification and network intrusion detection under high-speed big data traffic, the features to be detected are becoming more and more complex and difficult to be accurately described with precise strings. Traditional software matching is limited by the performance of resources such as a single CPU and cannot meet the matching requirements. Regular expressions use a single string to describe and match a series of string sets that meet a certain syntactic rule. They have strong semantic expression capabilities and high flexibility, and can describe a wider range of matching features. The circuit design of field programmable gate arrays (FPGAs) has the advantages of customizable flexibility, convenient rule upgrades, natural concurrency, rich logic resources, and scalability. Based on FPGA-based heterogeneous computing hardware, the use of dynamically reconfigurable regular expression matching has become the mainstream solution for sensitive data identification and network intrusion detection under high-speed big data traffic.

[0004] Regular expressions are composed of common characters and metacharacters. Field Programmable Gate Array (FPGA) uses AND gates, OR gates, and triggers to construct single-character matching patterns, thereby implementing complex regular expression matching rules. AND and OR operations are two basic operations of regular expressions. When there are multiple OR operations of characters and cascade operations of AND operations of characters in a regular expression, the existing FPGA-based regular expression matching needs to cascade multiple OR operations of the previous level and configure the results of each OR operation of the character to the next level. When there are many matching characters for the OR operation, the matching may fail due to insufficient dynamic configuration resources reserved by the FPGA, or the FPGA reserves enough dynamic configuration resources but each OR operation requires a clock cycle, resulting in multiple clock cycles required to achieve the matching. Although the second result can complete the matching, it will occupy a large amount of hardware resources and the matching speed is slow. It is not suitable for scenarios where the number of matching characters for the OR operation is large. In addition, the traditional regular expression character matching module can only achieve single-character matching. For the common string range matching in regular expressions, multiple clock cycles are required to achieve it, resulting in long matching time and low matching efficiency. Summary of the invention

[0005] In order to solve the problem that the prior art is slow in identifying sensitive data in network data, the present invention proposes a heterogeneous computing hardware, including:

[0006] At least one programmable logic unit core, with at least one programmable logic unit core of each type;

[0007] Each programmable logic unit core configures different data matching rules based on the characteristics of the network data to be processed to execute different data matching modes;

[0008] When there are multiple types of programmable logic unit cores, the multiple unit cores are independent of each other to achieve parallel computing.

[0009] Optionally, the type of the programmable logic unit core includes one or more of the following: a first unit core, a second unit core or a third unit core, wherein:

[0010] The first unit core is used to compare the starting character of the input string with the preset starting character, and compare the ending character of the input string with the preset ending character. If both characters are matched successfully, the corresponding string is sensitive data;

[0011] The second unit core is used for processing single characters or character strings connected with "or" first, and then processing single characters or character strings connected with "and" when the regular rule expression of the network data to be processed includes multiple "or" and / or multiple "and";

[0012] The third unit core is used to process characters or character strings that cannot be processed by the first unit core and the second unit core.

[0013] Optionally, the second unit core includes an operation module, a plurality of first comparison modules connected in parallel, a first enable control module, a plurality of second comparison modules connected in cascade, and a second enable control module, wherein:

[0014] The operation module is used for splitting the characters connected with "or" or "and" in the regular rule expression of the received network data to obtain single characters or / and character strings connected with "or" or "and", and inputting the single characters or / and character strings into a plurality of parallel first comparison modules respectively;

[0015] The first comparison module is used to match the received single character with a preset single character, or to match the received character string with a preset character string;

[0016] The first enabling control module is used to judge the matching results of multiple parallel first comparison modules, and if the matching result of any first comparison module is successfully matched, the single character or character string connected by "AND" is sequentially input into multiple cascaded second comparison modules;

[0017] The second comparison module is used to match the received single character with a preset single character, or to match the received character string with a preset character string;

[0018] The second enabling control module is used to judge the matching results of multiple cascaded second comparison modules. If the matching results of multiple second comparison modules are all matched successfully, the network data corresponding to the regular rule expression is sensitive data.

[0019] Optionally, the second unit core further includes a timing control module, a connection control module and a clock cycle counting module, wherein:

[0020] The timing control module is used to control the subsequent path after the output of the first enabling control module. If the match is successful, the clock cycle counting module is controlled to count, and the matching result and the characters or strings before and after the "and" are input into the second comparison module through the connection control module; if the match is unsuccessful, the next level "or" operation is directly performed.

[0021] On the other hand, the present application provides a method for high-speed identification of sensitive data based on heterogeneous computing hardware, comprising:

[0022] Acquire at least one target matching pattern and matching rule characteristic parameters corresponding to the target matching pattern based on the characteristics of the network data;

[0023] Storing the target matching pattern and its corresponding matching rule characteristic parameters in a storage device, so that the storage device configures the programmable logic unit cores in the heterogeneous computing hardware based on the matching rule characteristic parameters, wherein each programmable logic unit core corresponds to a target matching pattern;

[0024] Use configured heterogeneous computing hardware to process network data to obtain sensitive data;

[0025] The heterogeneous computing hardware is the heterogeneous computing hardware described above.

[0026] Optionally, the acquiring at least one target matching mode and matching rule characteristic parameters corresponding to the target matching mode based on the characteristics of the network data includes:

[0027] Regularizing the network data to obtain a regular rule expression of the network data;

[0028] Obtaining at least one target matching pattern based on the characteristics of the regular rule expression;

[0029] The corresponding matching rule characteristic parameters are obtained based on the target matching pattern.

[0030] Optionally, obtaining at least one target matching pattern based on the feature of the regular rule expression includes:

[0031] At least one target matching pattern is obtained by screening in a preset matching pattern library based on the characteristics of the regular rule expression.

[0032] Optionally, the matching patterns in the preset matching pattern library include one or more of the following: a single-cycle character fuzzy range interval regular matching pattern, a single-cycle multi-character "or" and character "and" operation cascade regular matching pattern, and a general conventional regular matching pattern, wherein:

[0033] The single-cycle character fuzzy range interval regular matching mode is used to match the starting and ending characters of a string;

[0034] The single-cycle multiple-character "or" and character "and" operation cascade regular matching mode is used to process regular expressions with multiple "or" and / or multiple "and". Specifically, "or" matching is performed first, and if any character or string in the regular rule expression is successfully matched by the "or" operation, "and" matching is performed;

[0035] The general conventional regular matching mode is used to process characters that cannot adopt the single-cycle character fuzzy range interval regular matching mode and the single-cycle multi-character "or" and character "and" operation cascade regular matching mode.

[0036] Optionally, obtaining at least one target matching pattern based on the feature of the regular rule expression includes:

[0037] Obtaining characteristics of the regular rule expression;

[0038] If the feature is an interval string including a start character and an end character, a single-cycle character fuzzy range interval regular matching mode is used as the target matching mode;

[0039] If the feature includes multiple "or" and / or multiple "and" characters, a single-cycle multiple-character "or" and character "and" operation cascade regular matching mode is used as the target matching mode;

[0040] If the feature does not meet the features required by the single-cycle character fuzzy range interval regular matching mode and the single-cycle multi-character "or" and character "and" operation cascade regular matching mode, the general conventional regular matching mode is used as the target matching mode.

[0041] Optionally, the regularizing the network data to obtain a regular rule expression of the network data includes:

[0042] A regular rule expression is selected from a preset regular expression rule library to be matched based on the network data characteristics of the network data.

[0043] Optionally, before regularizing the network data to obtain a regular rule expression for the network data, the process further includes:

[0044] The original network data is classified and screened to obtain the network data.

[0045] In another aspect, the present application further provides a sensitive data high-speed identification system based on heterogeneous computing hardware, comprising:

[0046] Acquisition module: used for acquiring at least one target matching mode and matching rule characteristic parameters corresponding to the target matching mode based on the characteristics of network data;

[0047] Configuration module: used for storing the target matching pattern and its corresponding matching rule characteristic parameters into a storage device, so that the storage device configures the programmable logic unit core in the heterogeneous computing hardware based on the matching rule characteristic parameters, wherein each programmable logic unit core corresponds to a target matching pattern; wherein the heterogeneous computing hardware is the heterogeneous computing hardware as described above;

[0048] Processing module: used to process network data using configured heterogeneous computing hardware to obtain sensitive data.

[0049] Optionally, the acquisition module specifically includes:

[0050] Regularizing the network data to obtain a regular rule expression of the network data;

[0051] Obtaining at least one target matching pattern based on the characteristics of the regular rule expression;

[0052] The corresponding matching rule characteristic parameters are obtained based on the target matching pattern.

[0053] Optionally, the acquisition module obtains at least one target matching pattern based on the characteristics of the regular rule expression, including:

[0054] At least one target matching pattern is obtained by screening in a preset matching pattern library based on the characteristics of the regular rule expression.

[0055] Optionally, the matching patterns in the preset matching pattern library in the acquisition module include one or more of the following: a single-cycle character fuzzy range interval regular matching pattern, a single-cycle multi-character "or" and character "and" operation cascade regular matching pattern, and a general conventional regular matching pattern, wherein:

[0056] The single-cycle character fuzzy range interval regular matching mode is used to match the starting and ending characters of a string;

[0057] The single-cycle multiple-character "or" and character "and" operation cascade regular matching mode is used to process regular expressions with multiple "or" and / or multiple "and". Specifically, "or" matching is performed first, and if any character or string in the regular rule expression is successfully matched by the "or" operation, "and" matching is performed;

[0058] The general conventional regular matching mode is used to process characters that cannot adopt the single-cycle character fuzzy range interval regular matching mode and the single-cycle multi-character "or" and character "and" operation cascade regular matching mode.

[0059] Optionally, the acquisition module obtains at least one target matching pattern based on the characteristics of the regular rule expression, including:

[0060] Obtaining characteristics of the regular rule expression;

[0061] If the feature is an interval string including a start character and an end character, a single-cycle character fuzzy range interval regular matching mode is used as the target matching mode;

[0062] If the feature includes multiple "or" and / or multiple "and" characters, a single-cycle multiple-character "or" and character "and" operation cascade regular matching mode is used as the target matching mode;

[0063] If the feature does not meet the features required by the single-cycle character fuzzy range interval regular matching mode and the single-cycle multi-character "or" and character "and" operation cascade regular matching mode, the general conventional regular matching mode is used as the target matching mode.

[0064] Optionally, the acquisition module performs regular expression on the network data to obtain a regular rule expression of the network data, including:

[0065] A regular rule expression is selected from a preset regular expression rule library to be matched based on the network data characteristics of the network data.

[0066] Optionally, before the acquisition module performs regular expression on the network data to obtain the regular rule expression of the network data, the process further includes:

[0067] The original network data is classified and screened to obtain the network data.

[0068] In another aspect, the present application further provides a computing device, comprising: at least one processor and a memory;

[0069] The memory is used to store one or more programs;

[0070] When the one or more programs are executed by the one or more processors, the high-speed identification method for sensitive data based on heterogeneous computing hardware as described above is implemented.

[0071] On the other hand, the present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed, implements the method for high-speed identification of sensitive data based on heterogeneous computing hardware as described above.

[0072] Compared with the prior art, the present invention has the following beneficial effects:

[0073] The present invention provides a heterogeneous computing hardware, a method and system for high-speed identification of sensitive data, wherein the heterogeneous computing hardware includes: at least one programmable logic unit core, and the number of each programmable logic unit core is at least one; each programmable logic unit core is configured with different data matching rules based on the characteristics of the network data to be processed to execute different data matching modes; when there are multiple programmable logic unit cores, the multiple programmable logic unit cores are independent of each other to achieve parallel computing; the present application sets up multiple programmable logic unit cores, each programmable logic unit core can execute different data matching modes, so that parallel processing of different data types can be achieved, and the number of each programmable logic unit core includes at least one, so parallel processing of the same data type can be achieved, thereby greatly improving the speed of sensitive data identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 This is a schematic structural diagram of the first unit core proposed by the present invention;

[0075] Figure 2 This is a schematic diagram of the structure of the second unit core proposed by the present invention;

[0076] Figure 3 A schematic diagram of the structure of the first comparison module and the second comparison module in the second unit core proposed by the present invention;

[0077] Figure 4 This is a schematic diagram of the structure of the third unit core proposed by the present invention;

[0078] Figure 5 A schematic diagram of the steps of the method for high-speed identification of sensitive data based on heterogeneous computing hardware proposed by the present invention;

[0079] Figure 6 The present invention proposes Figure 5 A detailed schematic diagram of step S1 in FIG.

[0080] Figure 7 A detailed application diagram of the sensitive data high-speed identification method based on heterogeneous computing hardware proposed in the present invention;

[0081] Figure 8 This is a schematic diagram of the structure of the sensitive data high-speed identification system based on heterogeneous computing hardware proposed by the present invention;

[0082] Fig. 9 This is a schematic diagram of the structure of the electronic device proposed by the present invention. DETAILED DESCRIPTION

[0083] The present invention proposes a heterogeneous computing hardware, a sensitive data high-speed identification method and system, which are particularly suitable for network data, especially in the context of high-speed large data traffic, and the application scenario of regular expression matching with a large number of matching characters in the "OR" operation. The method is based on the regular expression of network data, screens in a preset matching pattern library to obtain the corresponding target matching pattern, and further designs the reconfigurable heterogeneous computing hardware based on the matching rule feature parameters corresponding to the target matching pattern.

[0084] The present application sets up a matching pattern library including multiple matching patterns, which can be screened according to the characteristics of regular rule expressions to obtain at least one target matching pattern, and the corresponding unit cores in heterogeneous computing hardware are designed based on the matching rule feature parameters corresponding to the at least one target matching pattern, thereby realizing parallel calculation of multiple matching patterns and selecting corresponding matching patterns based on different data features, which significantly improves the recognition speed of sensitive data.

[0085] Embodiment 1:

[0086] A heterogeneous computing hardware, comprising:

[0087] At least one programmable logic unit core, with at least one programmable logic unit core of each type;

[0088] Each programmable logic unit core configures different data matching rules based on the characteristics of the network data to be processed to execute different data matching modes;

[0089] When there are multiple types of programmable logic unit cores, the multiple types of programmable logic unit cores are independent of each other to achieve parallel computing.

[0090] In a further preferred solution, the types of the programmable logic unit core include one or more of the following: a first unit core, a second unit core or a third unit core.

[0091] The first unit core is used to compare the starting character of the input string with the preset starting character, and compare the ending character of the input string with the preset ending character. If both characters match successfully, the corresponding string is sensitive data; Figure 1As shown, the first unit core includes a matching module, and the matching module is used to match the starting character of the regular rule expression with a preset starting character, and to match the ending character of the regular rule expression with a preset ending character, that is, to achieve fuzzy range interval matching of characters in regular matching within a single cycle. The traditional regular expression character matching module can only achieve single-character matching. For the common string range matching in the regular expression, multiple clock cycles are required to achieve it, the matching time is long, and the matching efficiency is low. On the basis of traditional single-character matching, the first unit core adds a fuzzy range matching interval for dynamically setting the character according to pre-configured information, selects the matching output result form according to the matching requirements, and achieves fuzzy interval range matching of characters within a single cycle, thereby improving the matching speed.

[0092] The second unit core is used for processing the single character or string connected with "OR" first, and then processing the single character or string connected with "AND" when the regular rule expression of the network data to be processed includes multiple "OR" and / or multiple "AND"; in the traditional regular matching algorithm, when there are multiple character "OR" operations and cascade operations of character "AND" operations in the regular expression, the existing FPGA-based regular expression matching needs to cascade multiple character "OR" operations at the previous level and configure each character "OR" operation result to the next level. When there are many matching characters in the "OR" operation, it may be impossible to achieve matching due to insufficient dynamic configuration resources reserved by the FPGA, or the FPGA reserved dynamic configuration resources may be insufficient. There are enough dynamically configured resources, but each "OR" operation requires a clock cycle, resulting in multiple clock cycles to achieve the undesirable result of matching. Although the second result can complete the match, it will occupy a lot of hardware resources and the matching speed is slow. It is not suitable for application scenarios with a large number of matching characters for the "OR" operation. The second unit core uses matching mode selection and matching relay to enable the previous stage multi-character "OR" operation to be reasonably integrated. When the "OR" operation of any character to be matched is successfully matched, the multi-character "OR" match of this level is successful, and the matching result is dynamically configured to the matching character of the "AND" operation of the next level of characters, and parallel operation is used to complete the "OR" operation regular expression matching of multiple characters within one clock cycle.

[0093] The third unit core is used to process characters or character strings that cannot be processed by the first unit core and the second unit core.

[0094] In a further preferred embodiment, Figure 2 As shown, the second unit core includes an operation module, a plurality of first comparison modules connected in parallel, a first enable control module, a plurality of second comparison modules connected in cascade, and a second enable control module, wherein:

[0095] The operation module is used to split the characters connected with "or" or "and" in the regular rule expression of the received network data to obtain single characters or / and character strings connected with "or" or "and", and input the single characters or / and character strings into multiple parallel first comparison modules respectively, and then perform parallel operation to complete the "or" operation matching of multiple characters within one clock cycle;

[0096] like Figure 3 As shown, the first comparison module is used to match the received single character with the preset single character, or to match the received character string with the preset character string; the comparison module sets the character to be matched and the ASCII code representing the character to be matched according to the matching rule characteristic parameters. After the character to be matched is input into the comparison module, it is compared with the character to be matched in turn, and the character matching result outputs four situations: equal to, greater than or equal to, less than or equal to, and not equal to.

[0097] The first enabling control module is used to judge the matching results of multiple parallel first comparison modules, and if the matching result of any first comparison module is successfully matched, the single character or character string connected by "AND" is sequentially input into multiple cascaded second comparison modules;

[0098] The second comparison module is used to match the received single character with a preset single character, or to match the received character string with a preset character string;

[0099] The second enabling control module is used to judge the matching results of multiple cascaded second comparison modules. If the matching results of multiple second comparison modules are all matched successfully, the network data corresponding to the regular rule expression is sensitive data.

[0100] The second unit core uses a matching relay enabling module to reasonably integrate the previous stage multi-character "OR" operation. When the "OR" operation of any character to be matched is matched successfully, the multi-character "OR" matching of this level is successful, and the matching result is dynamically configured to the matching character of the next stage character "AND" operation. Multiple comparison modules operate in parallel to complete the "OR" operation regular expression matching of multiple characters within one clock cycle, reducing the regular matching clock cycle, reducing the consumption of hardware resources, reducing the matching time, and improving the regular expression matching efficiency.

[0101] In a further preferred solution, the second unit core further includes a timing control module, a connection control module and a clock cycle counting module, wherein:

[0102] The timing control module is used to control the subsequent path after the output of the first enabling control module. If the match is successful, the clock cycle counting module is controlled to count, and the matching result and the characters or strings before and after the "and" are input into the second comparison module through the connection control module; if the match is unsuccessful, the next level "or" operation is directly performed.

[0103] The timing control module receives the matching result of the comparison module and the enabling control signal of the enabling control module, performs logic judgment according to the control result of the enabling control module, and determines whether the current comparison result is directly connected to the lower level for connection control or through the clock cycle counting module according to the judgment result; if the current level character "OR" operation matches successfully, the timing control module first connects to the connection control module through the clock cycle counting module for connection control, determines that the multi-character "OR" operation matches successfully through the clock cycle counting module, ends the "OR" operation, and links the "OR" operation matching result to the next level "AND" operation; if the current level character "OR" operation matches unsuccessfully, the timing control module directly transmits the matching result to the connection control module without passing through the clock cycle counting module, and directly performs the next level "OR" operation matching, until the matching is successful or the multi-level matching is unsuccessful, and then transmits it to the connection control through the clock cycle counting module, thereby completing the single-cycle matching of the multi-character "OR" operation.

[0104] Clock cycle counting module, when the multi-character "OR" operation matches successfully, the timing control module controls to complete a clock cycle count and transmits the matching result to the connection control module for the next level of matching.

[0105] The connection control module controls the connection of multiple cascade comparison modules at the next level according to the control signals of the timing control module and the clock cycle counting module.

[0106] When working, the second unit core first parses the regular rule expression, splits the characters before and after "or" and "and", and the storage device controls the enable module therein to enable the single-cycle multi-character "or" and character "and" operation cascade regular matching unit core to run, allowing the sensitive data flow to be matched to pass through the second unit core to realize the identification of sensitive data.

[0107] like Figure 4 As shown, the third unit core is a single character matching unit core, which is used to execute a general regular matching mode.

[0108] Embodiment 2:

[0109] A high-speed identification method for sensitive data based on heterogeneous computing hardware, such as Figure 5 As shown, the method includes the following steps S1 to S3.

[0110] S1: Acquire at least one target matching pattern and matching rule characteristic parameters corresponding to the target matching pattern based on characteristics of network data.

[0111] S2: Store the target matching pattern and its corresponding matching rule characteristic parameters into a storage device, so that the storage device configures the programmable logic unit cores in the heterogeneous computing hardware based on the matching rule characteristic parameters, wherein each programmable logic unit core corresponds to a target matching pattern; wherein the heterogeneous computing hardware is the heterogeneous computing hardware described in Example 1 above.

[0112] S3: Use configured heterogeneous computing hardware to process network data to obtain sensitive data.

[0113] In a further preferred embodiment, Figure 6 As shown, step S1 includes the following steps S11 to S13:

[0114] S11: Regularizing the network data to obtain a regular rule expression of the network data.

[0115] Before the regular expression of the network data is performed on the network data to obtain the regular rule expression of the network data, the method further includes:

[0116] The network data is obtained by classifying and screening the original network data. A high-speed data acquisition module can be used to obtain the original network data, and a neural network or clustering algorithm can be further used to extract features from the original data and perform business classification to obtain the required network data.

[0117] In a further preferred solution, a regular rule expression may be selected from a preset regular expression rule library to be matched based on network data characteristics, thereby achieving regular expression of network data.

[0118] S12: Obtain at least one target matching pattern based on the characteristics of the regular rule expression.

[0119] In a further preferred solution, the obtaining of at least one target matching pattern based on the characteristics of the regular rule expression includes: obtaining at least one target matching pattern by screening in a preset matching pattern library based on the characteristics of the regular rule expression.

[0120] In a further preferred embodiment, the matching patterns in the preset matching pattern library include one or more of the following: a single-cycle character fuzzy range interval regular matching pattern or a single-cycle multi-character "or" and character "and" operation cascade regular matching pattern, and a general conventional regular matching pattern, wherein:

[0121] The single-cycle character fuzzy range interval regular matching mode includes fuzzy range matching of regular rule expressions; it is based on traditional single-character matching, adds a fuzzy range matching interval for dynamically setting characters according to pre-configured information, selects the matching output result form according to matching requirements, realizes fuzzy interval range matching of strings within a single cycle, and improves matching speed.

[0122] The single-cycle multi-character "or" and character "and" operation cascade regular matching mode includes first performing "or" matching on the regular rule expression, and then performing "and" operation matching if any character in the regular rule expression is successfully matched by the "or" operation.

[0123] The general conventional regular matching mode is used to process characters that cannot adopt the single-cycle character fuzzy range interval regular matching mode and the single-cycle multi-character "or" and character "and" operation cascade regular matching mode.

[0124] In a further preferred solution, the step of screening and obtaining at least one target matching pattern in a preset matching pattern library based on the features of the regular rule expression includes:

[0125] Extract the features of the regular expression:

[0126] When the feature has a fuzzy range feature, the single-cycle character fuzzy range interval regular matching mode is used as the target matching mode;

[0127] When the feature has multiple "or" and / or multiple "and" characters, the single-cycle multiple-character "or" and character "and" operation cascade regular matching mode is used as the target matching mode;

[0128] If the feature does not meet the features required by the single-cycle character fuzzy range interval regular matching mode and the single-cycle multi-character "or" and character "and" operation cascade regular matching mode, the general conventional regular matching mode is used as the target matching mode.

[0129] S13: Obtain corresponding matching rule feature parameters based on the target matching pattern.

[0130] Neural network, machine learning and other methods can be used to extract the features of the target matching pattern and obtain the corresponding matching rule feature parameters.

[0131] In step S2, the target matching pattern and its corresponding matching rule characteristic parameters are put into a storage device for storage, and then the storage device configures the editable logic unit core based on the matching rule characteristic parameters.

[0132] The types of programmable logic unit cores in the heterogeneous computing hardware are the same as the number of target matching patterns, each programmable logic unit core operates independently and can be processed in parallel, and the number of each programmable logic unit core is at least one. The register device configures the first unit core to execute the single-cycle character fuzzy range interval regular matching mode, configures the second unit core to execute the single-cycle multi-character "or" and character "and" operation cascade regular matching mode, and configures the third unit core to execute the general conventional regular matching mode.

[0133] Specifically, the register device dynamically sets the parameters of the corresponding editable logic unit core in the heterogeneous computing hardware according to the matching rule characteristic parameters, and maps them into a reconfigurable hardware circuit, so that the corresponding editable logic unit core executes the corresponding target matching mode. Specifically, the matching rule characteristic parameters are converted by software compilation to obtain the configuration parameters of the reconfigurable device, that is, the heterogeneous hardware. The regular expression acceleration matching operator based on the reconfigurable device selects the corresponding regular expression matching structure under the control of the characteristic parameters of the regular rule expression of the register device, configures the regular matching parameters, and uses the reconfigurable editable logic unit core to realize sensitive data recognition.

[0134] like Figure 7 As shown, when the high-speed identification method for sensitive data based on heterogeneous computing hardware is in application, in the upper computer data processing and matching pattern selection module, the network data is acquired and filtered through the high-speed data acquisition module, useful network data traffic service characteristics are extracted and the service is classified, and based on the extracted data, a suitable regular rule expression is selected from the regular expression rule library to be matched, and based on the characteristics of the regular rule expression, the corresponding target matching pattern is selected from the preset matching pattern library and the matching rule feature parameters corresponding to the target matching pattern are extracted.

[0135] The storage device receives the target matching pattern and matching rule characteristic parameters output by the host computer and stores them in the storage device. The storage device dynamically configures the parameters of the unit core in the heterogeneous computing hardware according to the matching rule characteristic parameters, maps them into the hardware circuit of the reconfigurable device, and configures different hardware circuit matching information for different types of regular expressions to realize fast matching of parallel regular expressions.

[0136] The regular expression acceleration matching module based on the reconfigurable device is configured according to the regular matching mode determined by the upper computer data processing and matching mode selection module, and the parameters of the corresponding matching module and the hardware matching circuit parameters are set according to the configuration parameters of the dynamic reconfigurable acceleration control configuration parameter storage device. Three matching modes can be realized, including general conventional regular matching, single-cycle character fuzzy range interval regular matching, and single-cycle multi-character "or" operation and character "and" operation cascade regular matching.

[0137] Embodiment 3:

[0138] The present invention based on the same inventive concept also provides a sensitive data high-speed identification system based on heterogeneous computing hardware, such as Figure 8 As shown, it includes an acquisition module, a configuration module and a processing module.

[0139] The acquisition module is used to acquire at least one target matching pattern and matching rule characteristic parameters corresponding to the target matching pattern based on the characteristics of the network data;

[0140] The configuration module is used to store the target matching pattern and its corresponding matching rule characteristic parameters into a storage device, so that the storage device configures the programmable logic unit core in the heterogeneous computing hardware based on the matching rule characteristic parameters, wherein each programmable logic unit core corresponds to a target matching pattern; wherein the heterogeneous computing hardware is the heterogeneous computing hardware as described above;

[0141] The processing module is used to process network data using configured heterogeneous computing hardware to obtain sensitive data.

[0142] In a further preferred solution, the acquisition module specifically includes:

[0143] Regularizing the network data to obtain a regular rule expression of the network data;

[0144] Obtaining at least one target matching pattern based on the characteristics of the regular rule expression;

[0145] The corresponding matching rule characteristic parameters are obtained based on the target matching pattern.

[0146] In a further preferred solution, the acquisition module obtains at least one target matching pattern based on the characteristics of the regular rule expression, including:

[0147] At least one target matching pattern is obtained by screening in a preset matching pattern library based on the characteristics of the regular rule expression.

[0148] In a further preferred embodiment, the matching patterns in the preset matching pattern library in the acquisition module include one or more of the following: a single-cycle character fuzzy range interval regular matching pattern, a single-cycle multi-character "or" and character "and" operation cascade regular matching pattern, and a general conventional regular matching pattern, wherein:

[0149] The single-cycle character fuzzy range interval regular matching mode is used to match the starting and ending characters of a string;

[0150] The single-cycle multiple-character "or" and character "and" operation cascade regular matching mode is used to process regular expressions with multiple "or" and / or multiple "and". Specifically, "or" matching is performed first, and if any character or string in the regular rule expression is successfully matched by the "or" operation, "and" matching is performed;

[0151] The general conventional regular matching mode is used to process characters that cannot adopt the single-cycle character fuzzy range interval regular matching mode and the single-cycle multi-character "or" and character "and" operation cascade regular matching mode.

[0152] In a further preferred solution, the acquisition module obtains at least one target matching pattern based on the characteristics of the regular rule expression, including:

[0153] Obtaining characteristics of the regular rule expression;

[0154] If the feature is an interval string including a start character and an end character, a single-cycle character fuzzy range interval regular matching mode is used as the target matching mode;

[0155] If the feature includes multiple "or" and / or multiple "and" characters, a single-cycle multiple-character "or" and character "and" operation cascade regular matching mode is used as the target matching mode;

[0156] If the feature does not meet the features required by the single-cycle character fuzzy range interval regular matching mode and the single-cycle multi-character "or" and character "and" operation cascade regular matching mode, the general conventional regular matching mode is used as the target matching mode.

[0157] In a further preferred solution, the acquisition module performs regular expression on the network data to obtain a regular rule expression of the network data, including:

[0158] A regular rule expression is selected from a preset regular expression rule library to be matched based on the network data characteristics of the network data.

[0159] In a further preferred solution, before the acquisition module performs regular expression on the network data to obtain the regular rule expression of the network data, the process further includes:

[0160] The original network data is classified and screened to obtain the network data.

[0161] Example 4

[0162] like Fig. 9As shown, the present invention also provides an electronic device, which may be a computer device, a single-chip device, an intelligent mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, the processor, and the transceiver component are connected via a bus; the memory may be used to store an execution program, and an exemplary execution program may include instructions; the processor is used to execute the instructions stored in the memory. The memory may also be used to store data, which may be called and / or modified when the instructions are executed.

[0163] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in a storage medium to implement corresponding method flows or corresponding functions, so as to implement the steps of a method for high-speed identification of sensitive data based on heterogeneous computing hardware in the above-mentioned embodiment.

[0164] Example 5

[0165] Based on the same inventive concept, the present invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory), which is a memory device in an electronic device for storing programs and data. It can be understood that the storage medium here can include both built-in storage media in electronic devices and, of course, extended storage media supported by electronic devices. The storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by a processor are also stored in the storage space, and these instructions can be one or more execution programs (including program codes). It should be noted that the storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk storage. The processor loads and executes one or more instructions stored in the storage medium, which can implement the steps of a high-speed identification method of sensitive data based on heterogeneous computing hardware in the above embodiment.

[0166] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0167] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0168] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0169] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0170] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are included in the scope of the claims of the present invention to be approved.

Claims

1. A heterogeneous computing hardware, characterized in that: include: At least one programmable logic unit core, with at least one programmable logic unit core of each type; Each programmable logic unit core configures different data matching rules based on the characteristics of the network data to be processed to execute different data matching modes; When there are multiple types of programmable logic unit cores, the multiple types of programmable logic unit cores are independent of each other to achieve parallel computing.

2. The heterogeneous computing hardware according to claim 1, characterized in that: The types of the programmable logic unit core include one or more of the following: a first unit core, a second unit core or a third unit core, wherein: The first unit core is used to compare the starting character of the input string with the preset starting character, and compare the ending character of the input string with the preset ending character. If both characters are matched successfully, the corresponding string is sensitive data; The second unit core is used for processing single characters or character strings connected with "or" first, and then processing single characters or character strings connected with "and" when the regular rule expression of the network data to be processed includes multiple "or" and / or multiple "and"; The third unit core is used to process characters or character strings that cannot be processed by the first unit core and the second unit core.

3. The heterogeneous computing hardware according to claim 2, characterized in that: The second unit core includes an operation module, a plurality of first comparison modules connected in parallel, a first enable control module, a plurality of second comparison modules connected in cascade, and a second enable control module, wherein: The operation module is used for splitting the characters connected with "or" or "and" in the regular rule expression of the received network data to obtain single characters or / and character strings connected with "or" or "and", and inputting the single characters or / and character strings into a plurality of parallel first comparison modules respectively; The first comparison module is used to match the received single character with a preset single character, or to match the received character string with a preset character string; The first enabling control module is used to judge the matching results of multiple parallel first comparison modules, and if the matching result of any first comparison module is successfully matched, the single character or character string connected by "AND" is sequentially input into multiple cascaded second comparison modules; The second comparison module is used to match the received single character with a preset single character, or to match the received character string with a preset character string; The second enabling control module is used to judge the matching results of multiple cascaded second comparison modules. If the matching results of multiple second comparison modules are all matched successfully, the network data corresponding to the regular rule expression is sensitive data.

4. The heterogeneous computing hardware according to claim 3, characterized in that: The second unit core further includes a timing control module, a connection control module and a clock cycle counting module, wherein: The timing control module is used to control the subsequent path after the output of the first enabling control module. If the match is successful, the clock cycle counting module is controlled to count, and the matching result and the characters or strings before and after the "and" are input into the second comparison module through the connection control module; if the match is unsuccessful, the next level "or" operation is directly performed.

5. A method for high-speed identification of sensitive data based on heterogeneous computing hardware, characterized in that: include: Acquire at least one target matching pattern and matching rule characteristic parameters corresponding to the target matching pattern based on the characteristics of the network data; Storing the target matching pattern and its corresponding matching rule characteristic parameters in a storage device, so that the storage device configures the programmable logic unit cores in the heterogeneous computing hardware based on the matching rule characteristic parameters, wherein each programmable logic unit core corresponds to a target matching pattern; Use configured heterogeneous computing hardware to process network data to obtain sensitive data; The heterogeneous computing hardware is the heterogeneous computing hardware as described in any one of claims 1 to 4.

6. The method for high-speed identification of sensitive data based on heterogeneous computing hardware according to claim 5, characterized in that: The acquiring of at least one target matching mode and matching rule characteristic parameters corresponding to the target matching mode based on the characteristics of the network data includes: Regularizing the network data to obtain a regular rule expression of the network data; Obtaining at least one target matching pattern based on the characteristics of the regular rule expression; The corresponding matching rule characteristic parameters are obtained based on the target matching pattern.

7. The method for high-speed identification of sensitive data based on heterogeneous computing hardware according to claim 6, characterized in that: The obtaining at least one target matching pattern based on the feature of the regular rule expression includes: At least one target matching pattern is obtained by screening in a preset matching pattern library based on the characteristics of the regular rule expression.

8. The method for high-speed identification of sensitive data based on heterogeneous computing hardware according to claim 7, characterized in that: The matching patterns in the preset matching pattern library include one or more of the following: a single-cycle character fuzzy range interval regular matching pattern, a single-cycle multi-character "or" and character "and" operation cascade regular matching pattern, and a general conventional regular matching pattern, wherein: The single-cycle character fuzzy range interval regular matching mode is used to match the starting and ending characters of a string; The single-cycle multiple-character "or" and character "and" operation cascade regular matching mode is used to process regular expressions with multiple "or" or / and multiple "and", specifically, "or" matching is performed first, and if any character or string in the regular expression successfully matches the "or" operation, "and" operation matching is performed; The general conventional regular matching mode is used to process characters that cannot adopt the single-cycle character fuzzy range interval regular matching mode and the single-cycle multiple character "or" and character "and" operation cascade regular matching mode.

9. The method for high-speed identification of sensitive data based on heterogeneous computing hardware according to claim 8, characterized in that: The obtaining at least one target matching pattern based on the feature of the regular rule expression includes: Obtaining characteristics of the regular rule expression; If the feature is an interval string including a start character and an end character, a single-cycle character fuzzy range interval regular matching mode is used as the target matching mode; If the feature includes multiple "or" and / or multiple "and" characters, a single-cycle multiple-character "or" and character "and" operation cascade regular matching mode is used as the target matching mode; If the feature does not meet the features required by the single-cycle character fuzzy range interval regular matching mode and the single-cycle multi-character "or" and character "and" operation cascade regular matching mode, the general conventional regular matching mode is used as the target matching mode.

10. The method for high-speed identification of sensitive data based on heterogeneous computing hardware according to claim 6, characterized in that: The regular expression of the network data obtained by regularizing the network data comprises: A regular rule expression is selected from a preset regular expression rule library to be matched based on the network data characteristics of the network data.

11. The method for high-speed identification of sensitive data based on heterogeneous computing hardware according to claim 6, characterized in that: Before the regular expression of the network data is performed on the network data to obtain the regular rule expression of the network data, the method further includes: The original network data is classified and screened to obtain the network data.

12. A high-speed sensitive data identification system based on heterogeneous computing hardware, characterized in that: include: Acquisition module: used for acquiring at least one target matching pattern and matching rule characteristic parameters corresponding to the target matching pattern based on the characteristics of network data; Configuration module: used for storing the target matching pattern and its corresponding matching rule characteristic parameters into a storage device, so that the storage device configures the programmable logic unit core in the heterogeneous computing hardware based on the matching rule characteristic parameters, wherein each programmable logic unit core corresponds to a target matching pattern; wherein the heterogeneous computing hardware is the heterogeneous computing hardware according to any one of claims 1 to 4; Processing module: used to process network data using configured heterogeneous computing hardware to obtain sensitive data.

13. The sensitive data high-speed identification system based on heterogeneous computing hardware according to claim 12, characterized in that: The acquisition module is specifically used for: Regularizing the network data to obtain a regular rule expression of the network data; Obtaining at least one target matching pattern based on the characteristics of the regular rule expression; The corresponding matching rule characteristic parameters are obtained based on the target matching pattern.

14. The sensitive data high-speed identification system based on heterogeneous computing hardware according to claim 13, characterized in that: The acquisition module obtains at least one target matching pattern based on the characteristics of the regular rule expression, including: At least one target matching pattern is obtained by screening in a preset matching pattern library based on the characteristics of the regular rule expression.

15. The sensitive data high-speed identification system based on heterogeneous computing hardware according to claim 14, characterized in that: The matching patterns in the preset matching pattern library in the acquisition module include one or more of the following: a single-cycle character fuzzy range interval regular matching pattern, a single-cycle multi-character "or" and character "and" operation cascade regular matching pattern, and a general conventional regular matching pattern, wherein: The single-cycle character fuzzy range interval regular matching mode is used to match the starting and ending characters of a string; The single-cycle multiple-character "or" and character "and" operation cascade regular matching mode is used to process regular expressions with multiple "or" or / and multiple "and", specifically, "or" matching is performed first, and if any character or string in the regular expression successfully matches the "or" operation, "and" operation matching is performed; The general conventional regular matching mode is used to process characters that cannot adopt the single-cycle character fuzzy range interval regular matching mode and the single-cycle multiple character "or" and character "and" operation cascade regular matching mode.

16. The sensitive data high-speed identification system based on heterogeneous computing hardware according to claim 15, characterized in that: The acquisition module obtains at least one target matching pattern based on the characteristics of the regular rule expression, including: Obtaining characteristics of the regular rule expression; If the feature is an interval string including a start character and an end character, a single-cycle character fuzzy range interval regular matching mode is used as the target matching mode; If the feature includes multiple "or" and / or multiple "and" characters, a single-cycle multiple-character "or" and character "and" operation cascade regular matching mode is used as the target matching mode; If the feature does not meet the features required by the single-cycle character fuzzy range interval regular matching mode and the single-cycle multi-character "or" and character "and" operation cascade regular matching mode, the general conventional regular matching mode is used as the target matching mode.

17. The sensitive data high-speed identification system based on heterogeneous computing hardware according to claim 13, characterized in that: The acquisition module performs regular expression on the network data to obtain a regular rule expression of the network data, including: A regular rule expression is selected from a preset regular expression rule library to be matched based on the network data characteristics of the network data.

18. The sensitive data high-speed identification system based on heterogeneous computing hardware according to claim 13, characterized in that: Before the acquisition module performs regular expression on the network data to obtain the regular rule expression of the network data, the following steps are also included: The original network data is classified and screened to obtain the network data.

19. A computer device, characterized in that: include: at least one processor and memory; The memory and the processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the sensitive data high-speed identification method based on heterogeneous computing hardware as described in any one of claims 5 to 11 is implemented.

20. A computer-readable storage medium, characterized in that: An execution program is stored thereon, and when the execution program is executed, the sensitive data high-speed identification method based on heterogeneous computing hardware as described in any one of claims 5 to 11 is implemented.

Images