Decision tree generation method, message processing method, equipment and storage medium

Abstract

The invention provides a decision tree generation method, a message processing method, equipment and a storage medium. The method comprises the following steps: detecting whether a range field exists in a received to-be-processed rule set or not; if the range field exists in the rule set to be processed, converting the range field into a mask form; for the to-be-cut target node, determining a first rule copy rate corresponding to a bit cutting mode; judging whether the first rule copy rate is greater than or equal to a preset threshold; if yes, determining a corresponding second rule copy rate when the geometric space cutting mode is adopted to cut based on the range field; and according to the first rule replication rate and the second rule replication rate, determining a target cutting mode suitable for the target node to cut the corresponding target node into two sub-nodes, and according to a cutting result, generating a decision tree corresponding to the to-be-processed rule set. According to the method, a proper cutting mode is adaptively selected to construct the decision tree for the rule set containing various fields, so that the tree construction speed of the rule set is improved, and the consumption of storage resources is reduced.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a decision tree generation method, a message processing method, a device and a storage medium. Background Art

[0002] With the development of information technology, in today's network devices such as routers and firewalls, message classification is a basic mechanism to achieve quality of service (QoS) assurance and security protection. The purpose of message classification is to distinguish message types based on the values ​​of multiple fields in the network message header, so as to perform corresponding differentiated operations on the message. The message classifier contains a list of rules, each of which consists of a priority, a matching field (also called a "dimension" or "domain", which is uniformly represented by fields in the following text) and an action taken when matching a message.

[0003] The message classification problem is to find the rule with the highest priority that matches the message from the rule list. Currently, the widely used message classification methods include hardware solutions based on ternary content addressable memory (TCAM) and software solutions based on algorithms. Among software algorithms, the decision tree solution is considered the most promising method to replace hardware because it can support large-capacity rules, has strong scalability, and has fast search speed.

[0004] When building a decision tree, the key is how to cut the nodes of the decision tree to achieve recursive tree building. Generally, there are two ways to cut nodes of a decision tree: one is equal division or equal density cutting based on geometric space cutting. The other is bit cutting using the bits of the rules. In the geometric space cutting scheme, the entire rule space is cut into several independent subspaces, and the rules are each classified into different spaces. Rules that span multiple subspaces will appear in multiple spaces at the same time. This phenomenon is called rule replication. Geometric space cutting is often accompanied by serious rule replication, complex node indexing, and excessive tree depth, and it is difficult to handle rules with wildcards in any position. Bit cutting selects valid bits to map rules to different subnodes, thereby avoiding blind cutting of the entire search space. Its calculation is simpler, tree building is more efficient, and it can support rules with any wildcard position. It has become the mainstream cutting method for current decision tree schemes.

[0005] However, bit cutting cannot be directly applied to all matching fields, such as the destination port number, which are often given in the form of ranges. These range fields cannot be directly cut using bit cutting. The relevant solution is to expand the range field into bit form before or during cutting. A range field represented by 16 bits (range interval 0:65535) can be expanded to a maximum of 30 items. If a rule has two such range fields, it may be expanded to 900 items. All the expanded rules must participate in the subsequent tree building process, and each expanded rule is regarded as an independent rule when stored, resulting in fewer rules that can be processed and stored by limited hardware resources. Summary of the invention

[0006] The main purpose of the embodiments of the present application is to provide a decision tree generation method, a message processing method, a device and a storage medium, so as to realize adaptive selection of a suitable cutting method to construct a decision tree for a rule set containing various fields, improve the speed and efficiency of building the rule set, and reduce storage resource consumption.

[0007] In a first aspect, an embodiment of the present application provides a decision tree generation method, comprising: when receiving a set of rules to be processed, detecting whether there is a range field in the set of rules to be processed; if there is a range field in the set of rules to be processed, converting the range field into a mask form to obtain a preprocessed rule set; for a target node to be cut in the preprocessed rule set, determining a first rule copy rate corresponding to when the target node is cut based on the range field using a bit cutting method; judging whether the first rule copy rate is greater than or equal to a preset threshold; if the first rule copy rate is greater than or equal to the preset threshold, determining a second rule copy rate corresponding to when the target node is cut based on the range field using a geometric space cutting method; according to the first rule copy rate and the second rule copy rate, determining a target cutting method applicable to the target node, and using the target cutting method to cut the corresponding target node into two sub-nodes, and generating a decision tree corresponding to the set of rules to be processed according to the cutting result.

[0008] In one embodiment, converting the range field into a mask form includes: expanding the range field in the rule set to be processed into a target range interval that includes the original range interval defined by the range field and can be expressed in a mask form, and expressing the target range interval in a mask form.

[0009] In one embodiment, determining the first rule replication rate corresponding to when the target node is cut by bit cutting includes: converting all fields of the rule in the target node into a bit string, and determining the target bit position as the bit cutting point in the bit string; counting the number of first wildcards located at the target bit position in the bit string, and determining the ratio of the first wildcard number to the number of all rules in the target node as the first rule replication rate.

[0010] In one embodiment, determining the target bit position as a bit cutting point in the bit string includes: counting a set of candidate bit positions that have not been used as cutting points in the rules of the target node according to the bit string, and determining a first difference between the number of rules in which each candidate bit position is "1" and the number of rules in which the candidate bit position is "0", and counting the number of second wildcards located at each candidate bit position in the bit string; determining a first measurement value corresponding to the candidate bit position according to the first difference and the number of the second wildcards, the first measurement value being positively correlated with the absolute value of the first difference and the number of the second wildcards; and determining the candidate bit position in the candidate bit position set with the smallest corresponding first measurement value as the target bit position.

[0011] In one embodiment, the determination of the second rule replication rate corresponding to cutting the target node based on the range field using the geometric space cutting method includes: determining a set of boundary values ​​of the range field corresponding to all rules in the target node, the boundary value set including upper and lower limits of all range intervals in the target node; selecting a target boundary value as a geometric space cutting point from the boundary value set; and determining the ratio of the number of rules whose range intervals in the target node cross the target boundary value to the number of all rules in the target node as the second rule replication rate.

[0012] In one embodiment, the target boundary value selected from the boundary value set as the cutting point of the geometric space includes: deleting the maximum boundary value and the minimum boundary value from the boundary value set to obtain a processed boundary value set; increasing the upper limit value in the processed boundary value set by a first preset value, and reducing the lower limit value in the candidate boundary value set by a second preset value to obtain a candidate boundary value set; for each candidate boundary value in the candidate boundary value set, respectively counting the number of first rules whose corresponding range intervals in the target node fall on the left side of the candidate boundary value and the number of second rules whose corresponding range intervals fall on the right side of the candidate boundary value, and the number of third rules whose corresponding range intervals span the candidate boundary value; determining a second measurement value corresponding to the candidate boundary value based on a second difference between the first number of rules and the second number of rules, and the third number of rules, the second measurement value is positively correlated with the absolute value of the second difference and the third number of rules; determining the candidate boundary value in the candidate boundary value set with the smallest corresponding second measurement value as the target boundary value.

[0013] In one embodiment, the target cutting method applicable to the target node is determined according to the first rule replication rate and the second rule replication rate, and the corresponding target node is cut into two sub-nodes by using the target cutting method, including: judging whether the first rule replication rate is less than the second rule replication rate; if the first rule replication rate is less than the second rule replication rate, mapping the target node into two sub-nodes by using a bit cutting method; if the first rule replication rate is greater than the second rule replication rate, mapping the target node into two sub-nodes by using a geometric space cutting method;

[0014] In one embodiment, if the first rule replication rate is equal to the second rule replication rate, a target cutting method is randomly determined from the bit cutting methods and the geometric space cutting methods.

[0015] In one embodiment, the target node is cut into a first sub-node and a second sub-node; the bit cutting method is used to map the target node into two sub-nodes, including: converting all fields of the rules in the target node into a bit string, and determining the target bit position as the bit cutting point in the bit string; classifying the rules in the target node that are "0" at the target bit position into the first sub-node, classifying the rules in the target node that are "1" at the target bit position into the second sub-node, and classifying the rules in the target node that are wildcards at the target bit position into both the first sub-node and the second sub-node.

[0016] In one embodiment, the target node is cut into a first child node and a second child node; the target node is mapped into two child nodes by using a geometric space cutting method, including: determining a set of boundary values ​​of the range fields corresponding to all rules in the target node, and selecting a target boundary value as a geometric space cutting point from the boundary value set, wherein the boundary value set includes upper and lower limits of all range intervals in the target node; the rules whose corresponding range intervals in the target node fall on the left side of the target boundary value are classified into the first child node, the rules whose corresponding range intervals in the target node fall on the right side of the target boundary value are classified into the second child node, and the rules whose corresponding range intervals in the target node cross the target boundary value are classified into both the first child node and the second child node.

[0017] In one embodiment, it also includes: if there is no range field in the set of rules to be processed, or if the first rule replication rate is less than the preset threshold, the target node is mapped into two child nodes by bit cutting to generate a decision tree corresponding to the set of rules to be processed.

[0018] In a second aspect, an embodiment of the present application provides a message processing method, the method comprising: receiving message data to be processed; classifying the message data using a preset decision tree, and determining a target rule in the decision tree that matches the message data and has the highest priority; performing corresponding action processing on the message data according to the action instruction of the target rule; wherein the preset decision tree is generated using a method as described in any of the above aspects.

[0019] In a third aspect, an embodiment of the present application provides a decision tree generating device, comprising:

[0020] A detection module, configured to detect whether a range field exists in the rule set to be processed when receiving the rule set to be processed;

[0021] A conversion module, configured to convert the range field into a mask form if there is a range field in the rule set to be processed, so as to obtain a preprocessed rule set;

[0022] A first determination module is used to determine, for the target node to be cut of the preprocessed rule set, a first rule replication rate corresponding to when the target node is cut by a bit cutting method;

[0023] A judging module, used to judge whether the first rule duplication rate is greater than or equal to a preset threshold;

[0024] A second determination module is used to determine a second rule replication rate corresponding to when the target node is cut based on a range field using a geometric space cutting method if the first rule replication rate is greater than or equal to the preset threshold;

[0025] A cutting module is used to determine a target cutting method applicable to the target node according to the first rule replication rate and the second rule replication rate, and use the target cutting method to cut the corresponding target node into two sub-nodes, and generate a decision tree corresponding to the rule set to be processed according to the cutting result.

[0026] In a fourth aspect, an embodiment of the present application provides an electronic device, including:

[0027] at least one processor; and

[0028] a memory communicatively coupled to the at least one processor;

[0029] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the electronic device to execute the method described in any one of the above aspects.

[0030] In a fifth aspect, an embodiment of the present application provides a cloud device, including:

[0031] at least one processor; and

[0032] a memory communicatively coupled to the at least one processor;

[0033] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the cloud device to execute any of the methods described above.

[0034] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions. When a processor executes the computer-executable instructions, the method described in any one of the above aspects is implemented.

[0035] In a seventh aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements the method described in any of the above aspects when executed by a processor.

[0036] The decision tree generation method, message processing method, device and storage medium provided by the embodiments of the present application, for the input rule set to be processed, when building the node cutting of the tree, by converting the range field of the rule set into a mask form, for each target node to be cut, it is preferentially evaluated whether the first rule replication rate of bit cutting is greater than or equal to the preset threshold value, if so, it means that the result of bit cutting is not very good, and the evaluation of the effect of the geometric space cutting method is triggered at this time, and the second rule replication rate when the range field of the rule in the target node is cut by the geometric space cutting method can be further evaluated, and the relationship between the second rule replication rate and the bit cutting replication rate can be compared, and based on the evaluation result, a more suitable cutting method for the target node is adaptively determined, and the target node is cut into two child nodes by the determined target cutting method. After all the child nodes of the rule set become leaf nodes, the construction of the decision tree is completed. In this way, there is no need to expand the rules, so that the bit cutting is no longer restricted by the range field, and the bit cutting can be applied to all currently known rule fields without generating redundant rules. The bit cutting and geometric space cutting are unified to realize the adaptive selection of appropriate cutting methods to build decision trees for rule sets containing various fields, thereby improving the speed and efficiency of rule set construction and reducing storage resource consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and are used together with the specification to explain the principles of the present application. Obviously, the drawings described below are some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor.

[0038] Figure 1 A schematic diagram of a scene of a geometric space cutting solution provided in an embodiment of the present application;

[0039] Figure 2 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0040] Figure 3 A schematic diagram of an application scenario of a decision tree generation solution provided in an embodiment of the present application;

[0041] Figure 4 A schematic diagram of the overall system flow architecture of a message classification solution provided in an embodiment of the present application;

[0042] Figure 5 A flowchart of a decision tree generation method provided in an embodiment of the present application;

[0043] Figure 6 A schematic diagram of a decision tree construction result provided in an embodiment of the present application;

[0044] Figure 7 A schematic diagram of a decision tree construction result provided in an embodiment of the present application;

[0045] Figure 8 A flowchart of a message processing method provided in an embodiment of the present application;

[0046] Fig. 9 A schematic diagram of the structure of a decision tree generation device provided in an embodiment of the present application;

[0047] Fig.10 A schematic diagram of the structure of a cloud device provided in an embodiment of the present application.

[0048] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0049] Here, exemplary embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application.

[0050] The term "and / or" in this article is used to describe the association relationship of associated objects, specifically indicating that there may be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0051] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0052] In order to clearly describe the technical solution of the embodiment of the present application, the terms involved in the present application are first defined:

[0053] TCAM: Ternary Content Addressable Memory, ternary content addressable memory.

[0054] QoS: Quality of Service.

[0055] ip: Internet Protocol, refers to the Internet interconnection protocol.

[0056] IPv4: Internet Protocol version 4.

[0057] IPv6: Internet Protocol Version 6, Internet Protocol version 6.

[0058] Binary tree: A tree structure in which each node has at most two subtrees.

[0059] In today's network devices such as routers and firewalls, packet classification is a basic mechanism for achieving quality of service (QoS) and security protection. The purpose of packet classification is to distinguish packet types based on the values ​​of multiple fields in the network packet header, so as to perform corresponding differentiated operations on the packets. The packet classifier contains a list of rules, each of which consists of a priority, a matching field (also called a "dimension" or "domain", and is uniformly represented by fields in the following text) and an action taken when matching a packet. In the packet classification problem, the matching field type can be divided into a mask field and a range field, where the mask field consists of a keyword plus a mask, such as the destination IP, protocol number, etc., and the range field is given in the form of a certain range interval, such as the destination port number, etc. In particular, if the wildcard in the mask field only appears continuously in the last few bits of the keyword, this mask field can also be called a prefix field.

[0060] As shown in Table 1 below, it is an example of a packet classification rule base, which contains 4 rules: rule 1, rule 2, rule 3 and rule 4. Each rule contains 5 fields: source address, destination address, protocol number, source port and destination port, which is a common 5-tuple form. The representation of the field can be divided into mask form and range form. For example, the source address in Table 1 is composed of IP plus mask. The IP bit corresponding to the mask of "1" is a valid bit, and the IP bit corresponding to the mask of "0" is a don't care bit. On this bit, it can be either 0 or 1. Usually, this bit is represented by the wildcard "*". For example, 10.18.1.0 / 255.255.255.0 can be written as: 0000101000010010 00000001********. In this rule, the wildcard only appears in the last 8 bits. In this case, the prefix length can be used instead of the mask, which can be written as: 10.18.1.0 / 24. Obviously, the prefix is ​​a special form of the mask. If the field is given in the form of a range interval, it is called a range field. The range field can be a range or a certain value, such as the destination port in Table 1.

[0061] Table 1. Example of message classification rule base

[0062]

[0063] The message classification problem is to find the rule with the highest priority that matches the message from the rule list. Currently, the widely used message classification methods include hardware solutions based on ternary content addressable memory (TCAM) and software solutions based on algorithms. Among software algorithms, the decision tree solution is considered the most promising method to replace hardware because it can support large-capacity rules, has strong scalability, and has fast search speed.

[0064] When building a decision tree, the key is how to cut the nodes of the decision tree to achieve recursive tree building. Generally, there are two ways to cut the nodes of a decision tree: one is equal division or equal density cutting based on geometric space cutting, and the other is bit cutting using regular bit positions.

[0065] Figure 1 This paper shows an example of an equal division of a set of two-dimensional rules (rules R1 to R6) on fields X and Y. The entire rule space is divided into four independent subspaces, and each rule is assigned to a different space. Rules that span multiple subspaces will appear in multiple spaces at the same time (such as R1). This phenomenon is called rule replication. Geometric space cutting is often accompanied by serious rule replication, complex node indexing, and excessive tree depth. It is also difficult to handle rules with wildcards in any position, such as rule 2 in Table 1, which is not continuous in space in the source address dimension. Bit cutting selects valid bits to map rules to different subnodes, thereby avoiding blind cutting of the entire search space. Its calculation is simpler, tree building is more efficient, and it can support rules with any wildcard position. It has become the mainstream cutting method for current decision tree solutions.

[0066] However, bit cutting cannot be directly applied to all matching fields, such as the destination port number, which is often given in the form of a range. These range fields cannot be directly cut using bit cutting. The solution in the related art is to expand the range field into bit form before or during cutting. For example, in rule 3 in Table 1, the destination port 0:1024 needs to be split into two parts, 0:1023 and 1024:1024, so that it can be represented by 0000 00********** and 0000 01000000 0000. At this time, one rule will be expanded into two. A range field represented by 16 bits (with a range interval of 0:65535) can be expanded to 30 at worst. If a rule has two such range fields, it may be expanded to 900. All the expanded rules must participate in the subsequent tree building process, and each expanded rule is regarded as an independent rule when stored, resulting in fewer rules that can be processed and stored by limited hardware resources. Therefore, it is necessary to implement a message classification decision tree solution that can support fields of any form, is not restricted by the position of wildcards, and can efficiently build trees.

[0067] There are several main solutions to the message classification problem based on decision trees:

[0068] 1. Bit cutting algorithm for rule expansion before tree building

[0069] The Modular Packet Classification algorithm was the first to propose a solution that uses the bits of rules to perform node cutting. If the processed rule set contains a range field, the rule expansion is performed before the tree node is cut, the range field is converted into a prefix form, and then the binary tree is established using the bit cutting method. When cutting a node, this technology selects a bit each time, and maps all the rules in the parent node to the left and right child nodes according to the "0" or "1" value of the bit. If the selected bit corresponding to a rule in the parent node is a wildcard, a copy is made in both the left and right child nodes. According to this idea, the node is recursively cut until the number of rules in the child node is less than or equal to the set threshold, then the cutting is terminated and the child node is regarded as a leaf node. Since the algorithm adopts rule expansion at the beginning, the rules actually involved in the tree construction are several times larger than the original rules, and the preprocessing process is very complicated.

[0070] 2. Bit cutting algorithm for rule expansion during tree building

[0071] In order to solve the problem of massive rule expansion in the modular message classification algorithm, an improved algorithm based on it was proposed. This technical solution temporarily ignores the information of the range field, first performs bit cutting on the non-range field in the rule set, and when the cutting efficiency is lower than the preset threshold, the range rules in the rule set are expanded, converted into prefix form, and then cut, and a binary tree is established. This solution alleviates the rule expansion to a certain extent, but it still cannot completely avoid it.

[0072] 3. Equidense cutting algorithm based on geometric space

[0073] This technical solution adopts a geometric space cutting method, and each tree node is cut only on one field. First, all rules are projected on each field, and M endpoints are obtained for each field. Then, based on these M endpoints, a heuristic method is used to determine the cutting field and the cutting point of the field, and the current search space is split into two subspaces. Similarly, the node is recursively cut until the number of rules in the child node is less than or equal to the set threshold. Since this solution selects an optimal cutting point in the entire search space each time, its cutting is more refined. However, it is also accompanied by problems such as large amount of calculation, long tree building time, and complex node indexing. In addition, geometric space cutting can only process prefix fields and range fields. When the wildcard is in any position, this solution will no longer apply.

[0074] It can be seen that the above solutions have at least the following technical problems:

[0075] 1. Although the geometric cutting algorithm is suitable for cutting range fields, it has low cutting efficiency, complex node indexing, and does not support wildcards at any position.

[0076] 2. If you want to support fields where wildcards appear at any position, you can only use the bit cutting algorithm. However, bit cutting requires rule expansion when processing range fields, resulting in a waste of hardware resources.

[0077] In order to solve the above problems, the embodiment of the present application provides a decision tree generation scheme. For the input rule set to be processed, when the tree node is cut, by converting the range field of the rule set into a mask form, for each target node to be cut, the first rule copy rate of the bit cut is preferentially evaluated to be greater than or equal to the preset threshold. If so, it means that the result of the bit cut is not good. At this time, the evaluation of the effect of the geometric space cutting method is triggered. The second rule copy rate when the range field of the rule in the target node is cut by the geometric space cutting method can be further evaluated, and the size relationship between the second rule copy rate and the bit cutting copy rate can be compared. Based on the evaluation result, a more suitable cutting method for the target node is adaptively determined, and the target node is cut into two child nodes by the determined target cutting method. After all the child nodes of the rule set become leaf nodes, the construction of the decision tree is completed. If the rule set does not contain a range field, bit cutting is preferentially used, and geometric space cutting will not be performed. Geometric space cutting is used as a supplement to bit cutting. Bit cutting can act on any field (including mask field and range field) and is a preferred cutting method. Geometric space cutting can only act on range fields and is a cutting method that is only executed when the "preset threshold" condition is met. In this way, there is no need to expand the rules, so that bit cutting is no longer limited by the range field, and bit cutting can be applied to all currently known rule fields without generating redundant rules. Bit cutting and geometric space cutting are unified to achieve adaptive selection of appropriate cutting methods to build decision trees for rule sets containing various fields, improve the speed and efficiency of rule set construction, and reduce storage resource consumption.

[0078] like Figure 2 As shown, this embodiment provides an electronic device 1, including: at least one processor 11 and a memory 12, Figure 2 A processor is taken as an example. The processor 11 and the memory 12 are connected via a bus 10. The memory 12 stores instructions that can be executed by the processor 11, and the instructions are executed by the processor 11 so that the electronic device 1 can execute all or part of the process of the method in the following embodiment, so as to realize the adaptive selection of a suitable cutting method to cut the nodes during the tree building process, which is suitable for building a decision tree with a rule set containing various fields, improving the speed and efficiency of the rule set building, and reducing the consumption of storage resources.

[0079] In one embodiment, the electronic device 1 may be a mobile phone, a tablet computer, a laptop computer, a desktop computer, or a large computing system composed of multiple computers.

[0080] Figure 3 A schematic diagram of an application scenario system 200 of a decision tree generation solution provided in an embodiment of the present application.

[0081] like Figure 3As shown, the system includes: a server 210 and a terminal 220, wherein:

[0082] The server 210 may be a data platform that provides decision tree generation services, such as a message data processing platform. In actual scenarios, a message data processing platform may have multiple servers 210. Figure 3 In the figure, one server 210 is taken as an example.

[0083] The terminal 220 may be a computer, mobile phone, tablet or other device used by a user to log in to the message data processing platform. There may be multiple terminals 220. Figure 3 Two terminals 220 are taken as an example for illustration.

[0084] The terminal 220 and the server 210 can transmit information via the Internet, so that the terminal 220 can access the data on the server 210. The terminal 220 and / or the server 210 can be implemented by the electronic device 1.

[0085] The decision tree generation solution of the embodiment of the present application can be deployed on the server 210, can also be deployed on the terminal 220, or can be partially deployed on the server 210 and partially deployed on the terminal 220. In actual scenarios, it can be selected based on actual needs, and this embodiment does not limit it.

[0086] When the decision tree generation solution is fully or partially deployed on the server 210 , a calling interface may be opened to the terminal 220 to provide algorithm support to the terminal 220 .

[0087] The method provided in the embodiment of the present application can be implemented by executing the corresponding software code by the electronic device 1, and can be implemented by exchanging data with the server. The electronic device 1 can be a local terminal device. When the method is run on the server, the method can be implemented and executed based on the cloud interaction system, wherein the cloud interaction system includes a server and a client device.

[0088] In a possible implementation, the method provided by the embodiment of the present invention provides a graphical user interface through a terminal device, wherein the terminal device can be the local terminal device mentioned above, or can be the client device in the cloud interaction system mentioned above.

[0089] The decision tree generation method of the embodiment of the present application can be applied to any field that needs to build a decision tree.

[0090] like Figure 4 As shown, it is a schematic diagram of the overall system process architecture of a message classification solution provided in an embodiment of the present application, which includes the following process steps:

[0091] First, a rule set to be processed is received, and the rule set is preprocessed. The preprocessing may be to expand the range of a range field, and then a decision tree is constructed for the preprocessed rule set.

[0092] Taking the construction of a binary tree as an example, the tree construction part constructs a root node with all the rules in the preprocessed rule set. According to the target cutting method decided, the root node is divided into two child nodes. Each time the cutting is performed, the number of rules contained in the child node must be less than its parent node. The process is repeated for the child node until the number of rules in the child node is less than or equal to the preset number BINTH. The child node is called a leaf node and the cutting is stopped. When all child nodes become leaf nodes, the tree construction process ends.

[0093] When a message to be processed is received, the tree is traversed hierarchically according to the decision in the node until it reaches a leaf node. In a decision tree, a message can and can only find one leaf node that matches it. A linear search is performed on all rules in the leaf node, and the rule that can match the message and has the highest priority is returned as the final matching rule. The message is processed according to the action corresponding to the matching rule.

[0094] Some embodiments of the present application are described in detail below in conjunction with the accompanying drawings. In the case where there is no conflict between the embodiments, the following embodiments and the features in the embodiments can be combined with each other. In addition, the step sequence in the following method embodiments is only an example and not a strict limitation.

[0095] Please see Figure 5 , which is a decision tree generation method of an embodiment of the present application, the method can be Figure 2 The electronic device 1 shown is used to perform and can be applied to Figure 3 to Figure 4 In the application scenario of decision tree generation shown in , in order to realize adaptive selection of appropriate cutting methods to cut nodes during the tree building process, it is applicable to rule sets containing various fields to build decision trees, improve the speed and efficiency of rule set building, and reduce storage resource consumption. In this embodiment, the terminal 220 is used as an execution end as an example, and the method includes the following steps:

[0096] Step 501: Receive a set of rules to be processed.

[0097] In this step, the rule refers to the rule used for message classification. The preprocessing part may include receiving an input to-be-processed rule set, which may be an original rule set or a rule subset processed by a certain rule set division method. Rules belonging to the same rule set should have fields and sizes of exactly the same type, also referred to as having the same Key (key value), such as a rule set consisting of an ipv4 quintuple. Rules with different Keys should belong to different rule sets, such as an ipv4 quintuple and an ipv6 quintuple. For different rule sets, each rule set can be constructed separately, and multiple decision trees can be constructed in the end.

[0098] Step 502: Check whether there is a range field in the rule set to be processed. If yes, proceed to step 503; otherwise, proceed to step 508.

[0099] In this step, the range field refers to a field given in the form of a range interval, such as the field content of the destination port in the aforementioned Table 1. As before, since the existence of the range field will affect the node cutting method, it is first determined whether there is a range field in each rule in the rule set to be processed. If there is a range field, enter step 503 to perform range field preprocessing. If there is no range field, you can directly enter step 508 and use bit cutting to construct a decision tree.

[0100] Step 503: Convert the range field into a mask form to obtain a preprocessed rule set.

[0101] In this step, if there is a range field in the rule set to be processed, the range field can be converted into a mask form, so that all fields in the rule set after preprocessing can be represented in the form of a binary bit string without generating any redundant rules.

[0102] In one embodiment, step 503 may specifically include: expanding the range field in the rule set to be processed into a target range interval that includes the original range interval defined by the range field and can be represented in a mask form, and representing the target range interval in a mask form.

[0103] In this embodiment, the target range interval can be the minimum range interval that includes the original range interval and can be expressed in mask form to reduce the consumption of data storage resources. In order to unify the range field and the mask field, the range interval of some range fields that cannot be directly expressed in mask form can be expanded. For the range field, it is written as the minimum range interval that includes the range interval and can be expressed in mask form, and the minimum range interval is expressed in mask form. The mask form here specifically refers to the prefix form. Specifically, it can be divided into the following three cases:

[0104] (1) For range fields whose upper and lower limits are the same, they can be directly represented in mask form. For example, the range field 152:152 can be converted as follows: 152:152→1001 1000.

[0105] (2) For range fields whose upper and lower limits are different but do not require rule extension, they can be converted into a prefix form. For example, the range field 152:159 can be converted as follows: 152:159→1001 1***.

[0106] (3) For a range field whose upper and lower limits are different and cannot be written as a prefix, the original range of the range field can be expanded to find the minimum range that includes the original range and can be written as a prefix. For example, the range field 5:6 can be expanded to 4:7 and then converted into a prefix. Specifically, the conversion can be as follows: 5:6→4:7→0000 01**.

[0107] In conjunction with other mask fields in the rule, all fields in the rule set after preprocessing can be represented in the form of binary bit strings without generating any redundant rules, providing a data calculation basis for subsequent decision tree construction.

[0108] Step 504: for the target node to be cut in the preprocessed rule set, determine the first rule replication rate corresponding to cutting the target node in a bit cutting manner.

[0109] In this step, taking the construction of a binary tree as an example, the tree construction part constructs a root node with all the rules in the preprocessed rule set. According to a certain decision, the root node is divided into two child nodes. Each time a cut is made, the number of rules contained in the child node must be less than its parent node. The process is repeated for the child node until the number of rules in the child node is less than or equal to a preset number (the preset number can be called BINTH in this embodiment). The child node is called a leaf node and the cutting is stopped. When all child nodes become leaf nodes, the tree construction process ends. In a decision tree, those nodes that contain a number of rules greater than the set BINTH value and are not root nodes are also called intermediate nodes. The target nodes in this step can include any nodes that need to be cut during the decision tree construction process, such as but not limited to root nodes and intermediate nodes.

[0110] For rules containing range fields, after the range fields are converted into mask form, the decision tree can be constructed for the preprocessed rule set, and bit cutting can be prioritized to avoid the huge calculations caused by rash use of geometric space cutting. During the bit cutting process, it is necessary to evaluate the effect of bit cutting on the target node. The rule replication rate can characterize the effect of the cutting method on the target node after cutting. The larger the rule replication rate, the worse the cutting effect, and the smaller the rule replication rate, the better the cutting effect. Therefore, the first rule replication rate corresponding to the bit cutting method when cutting the target node can be determined, and the first rule replication rate is used to characterize the cutting effect when the bit cutting method is used to cut the target node.

[0111] In one embodiment, step 504 may specifically include: converting all fields of the rule in the target node into a bit string, determining a target bit position as a bit cutting point in the bit string, counting the number of first wildcards located at the target bit position in the bit string, and determining the ratio of the number of first wildcards to the number of all rules in the target node as the first rule replication rate.

[0112] In this embodiment, when evaluating the effect of bit cutting, all fields of the rules in the target node are first converted into bit strings, and an optimal target bit position is selected as the cutting point for each bit cutting calculation, and the rule replication rate at the cutting point is used as the first rule replication rate corresponding to the bit cutting method. In actual scenarios, rules with wildcards in the bit position will enter the two child nodes after cutting at the same time, so the ratio of the number of first wildcards in the target bit position in the bit string to the number of all rules in the target node can be used to accurately characterize the first rule replication rate.

[0113] In one embodiment, determining the target bit position as the bit cutting point in the bit string in step 504 may specifically include: counting the set of candidate bit positions that have not been used as cutting points in the rules of the target node according to the bit string, and determining the first difference between the number of rules with each candidate bit position being "1" and the number of rules with the candidate bit position being "0", and counting the number of second wildcards located at each candidate bit position in the bit string. Based on the first difference and the number of second wildcards, determine the first measurement value corresponding to the candidate bit position, and the first measurement value is positively correlated with the absolute value of the first difference and the number of second wildcards. Determine the candidate bit position with the smallest corresponding first measurement value in the candidate bit position set as the target bit position.

[0114] In this embodiment, the absolute value of the first difference and the sum of the number of the second wildcards can be used to represent the first metric. When bit cutting is used: first, a set of candidate bits in the node that have not been used as cutting points is counted, and the first metric value of each candidate bit is obtained according to formula (1), and the candidate bit with the smallest first metric value is selected as the target bit of the cutting point.

[0115] m b (v)=|num(0)-num(1)|+num(*) (1)

[0116] Among them, m b (v) represents the first metric value of the vth candidate bit, mum(0) represents the number of rules with the vth candidate bit being "0", and mum(1) represents the number of rules with the vth candidate bit being "1". num(*) represents the number of all rules with wildcards on the vth candidate bit. The first metric value takes into account the imbalance and replication rate of the candidate bits. After the target bit is selected, the ratio of the number of first wildcards in the target bit in the bit string to the number of all rules in the target node can be determined as the first rule replication rate.

[0117] In one embodiment, the absolute value of the first difference and the product of the second wildcard number may be used to represent the first metric value, which may be selected based on actual needs in actual scenarios.

[0118] Step 505: Determine whether the first rule copy rate is greater than or equal to a preset threshold. If yes, proceed to step 506; otherwise, proceed to step 508.

[0119] In this step, in order to ensure the cutting effect of the target node, a preset threshold value can be configured for the rule copy rate. The cutting effect of the cutting method with a rule copy rate less than the preset threshold value meets the requirements. Conversely, the cutting method with a rule copy rate greater than or equal to the preset threshold value does not meet the requirements. Here, the rule copy rate of the node is set to an adjustable preset threshold value, which is between 0 and 1. The specific value of the preset threshold value can be set based on actual needs, for example, it can be set to 30%. For the target node to be cut, before using bit cutting, first determine whether the first rule copy rate is greater than or equal to the preset threshold value. If so, proceed to step 506, otherwise proceed to step 508 to avoid waste of resources caused by rash cutting.

[0120] Step 506: Determine the second rule replication rate corresponding to cutting the target node based on the range field using the geometric space cutting method.

[0121] In this step, if the first rule replication rate is greater than or equal to the preset threshold, it means that the effect of cutting the target node by bit cutting does not meet the requirements of the preset threshold. At this time, the evaluation process of the effect of the geometric space cutting method is triggered, and the effect of cutting the target node by the geometric space cutting method can be further evaluated. Since geometric space cutting acts on other mask fields, the amount of calculation will be very large, and it may not be applicable. For example, the mask field where the wildcard appears at any position is not applicable. Therefore, the geometric space cutting method in this embodiment only cuts the range field. In the case where the rule in the target node contains a range field, the corresponding second rule replication rate when the geometric space cutting method is used to cut the range field of the rule in the target node can be calculated. The second rule replication rate can characterize the cutting effect when the target node is cut by the geometric space method.

[0122] In one embodiment, step 506 may specifically include: determining a set of boundary values ​​of the range fields corresponding to all rules in the target node. Selecting a target boundary value as a cutting point in the geometric space from the set of boundary values. Determining the ratio of the number of rules whose range intervals in the target node cross the target boundary value to the number of all rules in the target node as the second rule replication rate.

[0123] In this embodiment, when geometric space cutting is adopted: first determine the boundary value set contained in the range field of all rules in the target node, and the boundary value set includes the upper limit value and the lower limit value of all range intervals in the target node. Here, the range interval refers to the original range interval defined by the range field of all rules in the target node. Then determine a target boundary value from the boundary value set as the geometric space cutting point, and the cutting point divides the original range interval of the range field into two, assuming that it is called the left and right intervals. The range interval located in the left interval will be included in the left sub-node, and the range interval located in the right interval will be included in the right sub-node. The range interval that crosses the cutting point will be included in both the left and right sub-nodes. Therefore, the rules whose range interval crosses the cutting point will enter the left and right sub-nodes at the same time, so the ratio of the number of rules whose range interval crosses the cutting point to the number of all rules in the target node can be used to accurately characterize the second rule replication rate.

[0124] In one embodiment, in step 506, the target boundary value as the cutting point of the geometric space is selected from the boundary value set, which may specifically include: deleting the maximum boundary value and the minimum boundary value from the boundary value set to obtain a processed boundary value set. The upper limit value in the processed boundary value set is increased by a first preset value, and the lower limit value in the candidate boundary value set is reduced by a second preset value to obtain a candidate boundary value set. For each candidate boundary value in the candidate boundary value set, the number of first rules whose corresponding range intervals fall on the left side of the candidate boundary value and the number of second rules whose corresponding range intervals fall on the right side of the candidate boundary value in the target node are counted, and the number of third rules whose corresponding range intervals cross the candidate boundary value are counted. According to the second difference between the first rule number and the second rule number, and the third rule number, the second measurement value corresponding to the candidate boundary value is determined, and the second measurement value is positively correlated with the absolute value of the second difference and the third rule number. The candidate boundary value with the smallest corresponding second measurement value in the candidate boundary value set is determined as the target boundary value.

[0125] In this embodiment, all rules are first projected on each range field, and M boundary values ​​are obtained in a certain range field to form a boundary value set, where M is a positive integer. The minimum and maximum values ​​are removed from the M boundary values ​​to obtain a processed boundary value set containing M-2 boundary values. Assume that the first preset value is 1 and the second preset value is also 1. The upper limit values ​​in the processed boundary value set are added by 1, and the lower limit values ​​are subtracted by 1 to optimize the M-2 boundary values ​​to obtain a candidate boundary value set, thereby reducing the rule boundary duplication problem caused by directly cutting the boundary value. Then, the advantages and disadvantages of the M-2 points to be cut are evaluated based on the rule duplication rate, and the evaluation criteria include the balance of the two subnodes generated and the duplication rate caused by cutting the point. This evaluation is performed in multiple range fields of all rules to determine the optimal cutting point and cutting field.

[0126] In one embodiment, the second metric value may be represented by the sum of the absolute value of the second difference and the number of the third rule. The second metric value corresponding to each candidate boundary value may be calculated using the following formula (2):

[0127] m r (v)=|num(L)-num(R)|+num(*) (2)

[0128] Among them, m r(v) represents the second metric of the vth candidate boundary value, num(L) represents the number of first rules in the left node, num(R) represents the number of second rules in the left and right child nodes, and num(*) represents the number of third rules whose range spans the vth candidate boundary value, i.e., the number of copied rules. Similar to the evaluation of bit cutting, the second metric represents the balance and copy rate in the left and right child nodes when the vth candidate boundary value is used as the cutting point. r (v) The smallest candidate boundary value is used as the target boundary value of the cutting point.

[0129] In one embodiment, the product of the absolute value of the second difference and the third rule quantity may be used to represent the first measurement value. In actual scenarios, this may be selected based on actual needs, and this embodiment does not limit this.

[0130] Step 507: Determine a target cutting method applicable to the target node according to the first rule replication rate and the second rule replication rate, and cut the corresponding target node into two sub-nodes using the target cutting method, and generate a decision tree corresponding to the rule set to be processed according to the cutting result.

[0131] In this step, due to the existence of scope expansion, the geometric space represented by the expanded rules is larger than the original rules. It may be impossible to successfully distinguish the rules in non-leaf nodes by relying solely on bit cutting. At this time, it is necessary to continue to build the decision tree with the help of geometric space cutting. Specifically, the algorithm will monitor the rule replication of the target node each time the node is cut. After determining the first rule replication rate of bit cutting and the second rule replication rate of geometric space cutting, it can further evaluate which of the two cutting methods is more suitable for the target node based on the rule replication rate of the two cutting methods, and determine the more suitable cutting method as the target cutting method, so as to achieve adaptive selection of the appropriate cutting method to cut the target node, rather than blindly using a single method for cutting, thereby improving the efficiency of decision tree construction and reducing storage resource consumption.

[0132] In one embodiment, in step 507, a target cutting method applicable to the target node is determined according to the first rule replication rate and the second rule replication rate, and the corresponding target node is cut into two sub-nodes using the target cutting method, including: judging whether the first rule replication rate is less than the second rule replication rate. If the first rule replication rate is less than the second rule replication rate, the target node is mapped into two sub-nodes using a bit cutting method. If the first rule replication rate is greater than the second rule replication rate, the target node is mapped into two sub-nodes using a geometric space cutting method.

[0133] In this embodiment, the rule replication rate is negatively correlated with the effect of the cutting method, that is, the larger the rule replication rate, the worse the cutting effect, and the smaller the rule replication rate, the better the corresponding cutting effect. The advantages and disadvantages of the two methods of bit cutting and geometric space cutting can be evaluated by the size relationship between the first rule replication rate and the second rule replication rate. If the first rule replication rate is less than the second rule replication rate, it means that for the target node, although the first rule replication rate of bit cutting is greater than or equal to the preset threshold, the cutting effect of the bit cutting method is still better than that of the geometric space cutting method, so the bit cutting method is used to map the target node into two child nodes. If the first rule replication rate is greater than the second rule replication rate, it means that for the target node, the effect of geometric space cutting is better than bit cutting at this time, so the geometric space cutting method is used to map the target node into two child nodes. In this way, based on the actual situation of the target node, a more suitable cutting method is adaptively selected for node cutting, the speed and efficiency of building the rule set are improved, and the consumption of storage resources is reduced.

[0134] In one embodiment, in step 507, a target cutting method applicable to the target node is determined based on the first rule replication rate and the second rule replication rate, and the corresponding target node is cut into two sub-nodes using the target cutting method. It may also include: if the first rule replication rate is equal to the second rule replication rate, a target cutting method is randomly determined from the bit cutting method and the geometric space cutting method.

[0135] In this embodiment, if the first rule replication rate is equal to the second rule replication rate, it means that for the target node, the effect of bit cutting is basically the same as the effect of geometric space cutting. At this time, you can continue to select any of the two cutting methods as the target cutting method according to actual needs. For example, you can randomly select one of the two cutting methods as the target cutting method.

[0136] In one embodiment, the target node is mapped into two child nodes by bit cutting in step 507, including: converting all fields of the rule in the target node into a bit string, determining the target bit as the bit cutting point in the bit string, classifying the rule with "0" in the target bit in the target node into the first child node, classifying the rule with "1" in the target bit in the target node into the second child node, and classifying the rule with a wildcard in the target bit in the target node into both the first child node and the second child node.

[0137] In this embodiment, taking the construction of a binary tree as an example, the target node is cut into a first child node and a second child node. The aforementioned step 504 can be used to determine the target bit position, convert all fields of the rule in the target node into a bit string, and count the set of candidate bits that have not been used as cutting points in the rule of the target node according to the bit string, and determine the first difference between the number of rules with each candidate bit position being "1" and the number of rules with the candidate bit position being "0", and count the number of second wildcards located at each candidate bit position in the bit string. According to the first difference and the number of second wildcards, determine the first measurement value corresponding to the candidate bit position, and the first measurement value is positively correlated with the absolute value of the first difference and the number of second wildcards. The candidate bit position with the smallest corresponding first measurement value in the candidate bit position set is determined as the target bit position.

[0138] Specifically, the first measurement value can be represented by the sum of the absolute value of the first difference and the number of the second wildcards. When bit cutting is used: first, a set of candidate bits in the node that have not been used as cutting points is counted, and the first measurement value of each candidate bit is obtained according to formula (1), and the candidate bit with the smallest first measurement value is selected as the target bit of the cutting point. The rule with a 0 in the target bit of the target node is classified into the first child node, the rule with a 1 in the target bit of the target node is classified into the second child node, and the rule with a wildcard * in the target bit of the target node is classified into both the first child node and the second child node, completing the cutting process of the target node.

[0139] Taking the rule set example shown in Table 2 below as an example, Table 2 shows 8 rules containing two fields, namely, mask field field 1 and range field field 2, wherein the range field is expanded and field 2 has been converted into field 2*.

[0140] Table 2. Rule set examples

[0141]

[0142] Assume that the preset number BINTH value is 4, that is, when the number of rules contained in a child node is less than or equal to 4, the child node is determined to be a leaf node. According to the calculation results of Table 2 using formula (1), the third bit in field 1 (counting from the left side of the field in Table 2) is preferentially selected as the target bit. The tree construction result is as follows: Figure 6 As shown:

[0143] In the first cut, node 0 containing all the rules in Table 2 is taken as the target node, generating a leaf node 2 (i.e., the first child node) and an intermediate node 1 (i.e., the second child node). The rules included in node 1 are: R1, R2, R3, R5, R7, and the rules included in node 2 are: R4, R6, R8.

[0144] The second cut takes the middle node 1 as the target node, selects the second bit in field 1 (counted from the left side of the field in Table 2) as the target bit, and continues cutting the middle node 1 to obtain nodes 3 and 4. The rules included in node 3 are: R3, R5. The rules included in node 4 are: R1, R2, R7. Both are leaf nodes, and the tree is built.

[0145] In one embodiment, the target node is cut into a first subnode and a second subnode. The target node is mapped into two subnodes using a geometric space cutting method, which may specifically include: determining a set of boundary values ​​of the range fields corresponding to all rules in the target node, and selecting a target boundary value as a geometric space cutting point from the boundary value set, wherein the boundary value set includes the upper limit and lower limit of all range intervals in the target node. The rules whose corresponding range intervals in the target node fall to the left of the target boundary value are classified into the first subnode, the rules whose corresponding range intervals in the target node fall to the right of the target boundary value are classified into the second subnode, and the rules whose corresponding range intervals in the target node cross the target boundary value are classified into the first subnode and the second subnode at the same time.

[0146] In this embodiment, when geometric space cutting is used, it is first necessary to select a target boundary value as a cutting point, and the target boundary value can be determined in the manner described in the relevant embodiment of step 506. Specifically, the boundary value set of the range field corresponding to all rules in the target node is determined, and the maximum boundary value and the minimum boundary value are deleted from the boundary value set to obtain a processed boundary value set. The upper limit value in the processed boundary value set is increased by a first preset value, and the lower limit value in the candidate boundary value set is reduced by a second preset value to obtain a candidate boundary value set. For each candidate boundary value in the candidate boundary value set, the number of first rules whose corresponding range interval falls on the left side of the candidate boundary value and the number of second rules whose corresponding range interval falls on the right side of the candidate boundary value in the target node are respectively counted, and the number of third rules whose corresponding range interval crosses the candidate boundary value is respectively counted. According to the second difference between the number of first rules and the number of second rules, and the number of third rules, the second measurement value corresponding to the candidate boundary value is determined, and the second measurement value is positively correlated with the absolute value of the second difference and the number of third rules. The candidate boundary value with the smallest corresponding second measurement value in the candidate boundary value set is determined as the target boundary value.

[0147] First, all rules are projected on each range field, and M boundary values ​​are obtained in a certain range field to form a boundary value set, where M is a positive integer. The minimum and maximum values ​​are removed from the M boundary values ​​to obtain a processed boundary value set containing M-2 boundary values. Assume that the first preset value is 1 and the second preset value is also 1. The upper limit values ​​in the processed boundary value set are added by 1, and the lower limit values ​​are subtracted by 1 to optimize the M-2 boundary values, and a candidate boundary value set is obtained to reduce the rule boundary duplication problem caused by directly cutting the boundary value. Then, the advantages and disadvantages of the M-2 points to be cut are evaluated based on the rule duplication rate. The evaluation criteria include the balance of the two subnodes generated and the duplication rate caused by cutting the point. This evaluation is performed in multiple range fields of all rules to determine the optimal cutting point and cutting field.

[0148] Taking the target node formed by the rule set shown in Table 3 as an example, the process of selecting the cutting point in the geometric space cutting process is explained:

[0149] Table 3 Geometric space cutting examples

[0150]

[0151] Assume that there are 4 rules as shown in Table 3, and these rules contain only one range field. First, obtain their boundary value sets: 1, 7, 20, 61, 50, 100, 200, 255, a total of 8 boundary values. Because the minimum and maximum values ​​cannot distinguish these 4 rules, the minimum and maximum values ​​are removed to obtain 6 processed boundary values. The lower limit of the processed boundary value is reduced by 1 and the upper limit is increased by 1 to optimize these 6 points, that is, the candidate boundary value set is obtained: 8, 19, 62, 49, 101, 199.

[0152] Then, the absolute value of the second difference and the sum of the third rule number can be used to represent the second metric. The cutting effect of these 6 points is evaluated according to formula (2), and finally an optimal cutting point is selected. The second metric represents the balance and replication rate of the left and right child nodes when the vth candidate boundary value is used as the cutting point. r (v) The smallest candidate boundary value is used as the target boundary value of the cutting point.

[0153] After determining the target boundary value, use the target boundary value as the cutting point of the geometric space, divide the range interval of the range field in the target node into two, assuming that they are called left and right intervals, and assign the rules whose corresponding range intervals in the target node fall into the left interval to the first child node, and the rules whose corresponding range intervals in the target node fall into the right interval to the second child node. The rules whose corresponding range intervals in the target node cross the target boundary value are assigned to both the first child node and the second child node, completing a cut of the target node. Taking Table 3 as an example, according to formula (2), the m of these 6 points is calculated as r The values ​​of (v) are: 2, 2, 1, 2, 2, 2. Therefore, we can choose "62" as the target boundary value as the cutting point. At this time, the left child node can contain rules: R1, R2, R3, and the right child node can contain rules: R3, R4, among which rule R3 produces replication.

[0154] In one embodiment, taking the rule example in Table 2 as an example, in the above example, if the preset number BINTH value is 1, then Figure 6 The leaf nodes in need to be further cut. Figure 7 As shown, this is a schematic diagram of the tree building result when the preset number BINTH value is 1:

[0155] For the first cut, node 0 containing all the rules in Table 2 is taken as the target node, and the third bit in field 1 (counted from the left side of the field in Table 2) is selected as the target bit, generating nodes 2 and 1. The rules included in node 1 are: R1, R2, R3, R5, R7, and the rules included in node 2 are: R4, R6, R8.

[0156] For the second cut, take the intermediate node 1 as the target node, select the second bit in field 1 as the target bit, and continue to cut the intermediate node 1 to get nodes 3 and 4. The rules included in node 3 are: R3 and R5. The rules included in node 4 are: R1, R2, and R7. At the same time, take the intermediate node 2 as the target node, select the fifth bit in field1 as the target bit, and continue to cut the intermediate node 2 to get nodes 5 and 6. The rule included in node 5 is: R8. Node 5 is a leaf node. The rules included in node 4 are: R4 and R6, and it is an intermediate node.

[0157] For the third cut, take the intermediate node 1 as the target node, select the first bit in field 1 as the target bit, and continue to cut the intermediate node 3 to obtain nodes 7 and 8. The rule included in node 7 is R5, which is a leaf node. The rule included in node 8 is R3, which is a leaf node. At the same time, take the intermediate node 2 as the target node, select the first bit in field 2* as the target bit, and continue to cut the intermediate node 4 to obtain nodes 9 and 10. The rule included in node 9 is R7, which is a leaf node. The rules included in node 10 are R1 and R2, which is an intermediate node. At the same time, take the intermediate node 2 as the target node, select the first bit in field 2* as the target bit, and continue to cut the intermediate node 6 to obtain nodes 11 and 12. The rule included in node 11 is R4, which is a leaf node. The rule included in node 12 is R6, which is a leaf node.

[0158] Among them, when only R1 and R2 are left in node 10, field 1 and field 2* can no longer provide effective distinguishing information. In fact, these two rules do not overlap in field 2 and can be distinguished, but due to the expansion of the aforementioned range, 112:123 is expanded to 112:127, causing rule R2 to completely cover rule R1. At this time, the geometric space cutting scheme should be enabled, with position 124 in field 2 as the cutting point. Rule R1 with a range greater than 124 is included in node 13, and rule R2 with a range less than or equal to 124 is included in node 14. Nodes 13 and 14 are both leaf nodes. The result is as follows: Figure 7 As shown in the dotted box in . So far, the decision tree for the rule set in Table 2 is constructed.

[0159] Step 508: Map the target node into two child nodes by bit cutting to generate a decision tree corresponding to the rule set to be processed.

[0160] In this step, if there is no range field in the set of rules to be processed, or if there is a range field in the set of rules to be processed but the replication rate of the first rule is less than the preset threshold, it is preferred to use the bit cutting method to cut the target node. Since the range field has been converted into a mask form, bit cutting is no longer limited by the range field. During the bit cutting process, an optimal bit is selected each time to map all rules in the target node to two child nodes. The optimal bit should consider the balance of the two child nodes generated and the replication rate caused by the cutting. Then determine whether the number of rules in the tree node is less than or equal to the preset leaf node rule threshold BINTH. If so, construct a leaf node, otherwise repeat the bit selection process, and finally construct a hierarchical decision tree. The process of bit cutting can refer to the description of the aforementioned related embodiments, which will not be repeated here.

[0161] The above decision tree generation method sets the rule replication rate of the target node to an adjustable preset threshold value between 0 and 1. The algorithm will prioritize bit cutting to avoid the huge calculation caused by rash use of geometric space cutting. At the same time, the rule replication of the node is monitored every time the node is cut. When the node replication rate is greater than or equal to the preset threshold, geometric space cutting will be enabled. Obviously, when the preset threshold is set to 1, geometric space cutting will only be enabled after all valid bits are involved in the cutting (see Figure 7 This setting will make node cutting faster and is suitable for large rule sets. When the threshold is set to 0, each node will evaluate the pros and cons of bit cutting and geometric space cutting, and then choose the best cutting method. This setting will generate a better tree structure, but it will take longer and is suitable for small rule sets.

[0162] The decision tree generation method of the embodiment of the present application can not only be used to directly build a tree for the original rule set, but can also be applied to the rule subsets generated after the original rule set is divided into rules, and the root nodes generated by constructing a jump table for the rule set. The tree building method of this embodiment will further improve the tree building effect.

[0163] Please see Figure 8 , which is a message processing method of an embodiment of the present application, the method can be Figure 2 The electronic device 1 shown is used to perform and can be applied to Figure 3 to Figure 4 In the application scenario of decision tree generation shown in , in order to realize adaptive selection of appropriate cutting methods to cut nodes during the tree building process, it is suitable for building decision trees with rule sets containing various fields, improving the speed and efficiency of rule set building, and reducing storage resource consumption. This embodiment takes terminal 220 as an execution end as an example. Compared with the above embodiment, this embodiment takes the message processing scenario as an example. The method includes the following steps:

[0164] Step 801: Receive message data to be processed.

[0165] Step 802: Classify the message data using a preset decision tree, and determine the target rule in the decision tree that matches the message data and has the highest priority, wherein the preset decision tree is generated using the method described in any of the above embodiments.

[0166] Step 803: According to the action instruction of the target rule, perform corresponding action processing on the message data.

[0167] In this embodiment, a decision tree can be generated by using a method as in any of the above embodiments. In addition to storing the necessary information of the child node index, the tree node also stores the cutting method and cutting bit (cutting point) used by the node. The input message starts from the root node, and the tree is hierarchically traversed according to the bit used when the node is cut or the cutting point of a certain field until it reaches the leaf node. In a decision tree, a message can and can only find a leaf node that matches it. The leaf node stores no more than BINTH rules, and the mask fields of all the rules are matched bit by bit, the range fields are interval matched, and the rule that successfully matches the message and has the highest rule priority is returned. According to the action instruction of the rule, the message data is processed with corresponding actions. The processing efficiency of message data is improved.

[0168] For details of each step of the above-mentioned message processing method, please refer to the relevant description of the above-mentioned relevant embodiments, which will not be repeated here.

[0169] Please see Fig. 9 , which is a decision tree generation device 900 of an embodiment of the present application, which can be applied to Figure 1 The electronic device 1 shown can be applied to Figure 3 to Figure 4 In the application scenario of decision tree generation shown in , the node is cut by adaptively selecting a suitable cutting method in the process of tree building, which is suitable for building decision trees with rule sets containing various fields, improving the speed and efficiency of rule set building, and reducing storage resource consumption. The device includes: a detection module 901, a conversion module 902, a first determination module 903, a judgment module 904, a second determination module 905 and a cutting module 906, and the functional principles of each module are as follows:

[0170] The detection module 901 is used to detect whether there is a range field in the rule set to be processed when receiving the rule set to be processed.

[0171] The conversion module 902 is used to convert the range field into a mask form if there is a range field in the rule set to be processed, so as to obtain a pre-processed rule set.

[0172] The first determination module 903 is used to determine, for the target node to be cut in the preprocessed rule set, a first rule replication rate corresponding to cutting the target node in a bit cutting manner.

[0173] The judgment module 904 is used to judge whether the first rule copy rate is greater than or equal to a preset threshold.

[0174] The second determination module 905 is used to determine the corresponding second rule replication rate when the target node is cut based on the range field in a geometric space cutting manner if the first rule replication rate is greater than or equal to a preset threshold.

[0175] The cutting module 906 is used to determine a target cutting method applicable to the target node according to the first rule replication rate and the second rule replication rate, and cut the corresponding target node into two sub-nodes using the target cutting method, and generate a decision tree corresponding to the rule set to be processed according to the cutting result.

[0176] In one embodiment, the conversion module 902 is used to expand the range field in the to-be-processed rule set into a target range interval that includes the original range interval defined by the range field and can be represented in a mask form, and represent the target range interval in a mask form.

[0177] In one embodiment, the first determination module 903 is used to convert all fields of the rule in the target node into a bit string, determine the target bit position as the bit cutting point in the bit string, count the number of first wildcards located at the target bit position in the bit string, and determine the ratio of the number of first wildcards to the number of all rules in the target node as the first rule replication rate.

[0178] In one embodiment, the first determination module 903 is used to count the set of candidate bits that have not been used as cutting points in the rules of the target node according to the bit string, and determine the first difference between the number of rules with each candidate bit as "1" and the number of rules with the candidate bit as "0", and the number of second wildcards located at each candidate bit in the statistical bit string. According to the first difference and the number of second wildcards, the first measurement value corresponding to the candidate bit is determined, and the first measurement value is positively correlated with the absolute value of the first difference and the number of second wildcards. The candidate bit with the smallest corresponding first measurement value in the candidate bit set is determined as the target bit.

[0179] In one embodiment, the second determination module 905 is used to determine the boundary value set of the range field corresponding to all rules of the boundary value set in the target node, the boundary value set including the upper limit value and the lower limit value of all range intervals in the target node. A target boundary value as a cutting point of the geometric space is selected from the boundary value set. The ratio of the number of rules whose range intervals in the target node cross the target boundary value to the number of all rules in the target node is determined as the second rule replication rate.

[0180] In one embodiment, the second determination module 905 is used to delete the maximum boundary value and the minimum boundary value from the boundary value set to obtain a processed boundary value set. The upper limit value in the processed boundary value set is increased by a first preset value, and the lower limit value in the candidate boundary value set is reduced by a second preset value to obtain a candidate boundary value set. For each candidate boundary value in the candidate boundary value set, the number of first rules whose corresponding range intervals fall on the left side of the candidate boundary value and the number of second rules whose corresponding range intervals fall on the right side of the candidate boundary value in the target node are counted, as well as the number of third rules whose corresponding range intervals cross the candidate boundary value. According to the second difference between the number of first rules and the number of second rules, and the number of third rules, the second measurement value corresponding to the candidate boundary value is determined, and the second measurement value is positively correlated with the absolute value of the second difference and the number of third rules. The candidate boundary value with the smallest corresponding second measurement value in the candidate boundary value set is determined as the target boundary value.

[0181] In one embodiment, the cutting module 906 is used to determine whether the first rule replication rate is less than the second rule replication rate. If the first rule replication rate is less than the second rule replication rate, the target node is mapped into two child nodes using a bit cutting method. If the first rule replication rate is greater than the second rule replication rate, the target node is mapped into two child nodes using a geometric space cutting method. Alternatively, if the first rule replication rate is equal to the second rule replication rate, a target cutting method is randomly determined from the bit cutting method and the geometric space cutting method.

[0182] In one embodiment, the target node is cut into a first subnode and a second subnode. The cutting module 906 is used to convert all fields of the rule in the target node into a bit string, and determine the target bit position as the bit cutting point in the bit string. The rules with a target bit position of "0" in the target node are classified into the first subnode, the rules with a target bit position of "1" in the target node are classified into the second subnode, and the rules with a wildcard in the target bit position in the target node are classified into both the first subnode and the second subnode.

[0183] In one embodiment, the target node is cut into a first subnode and a second subnode. The cutting module 906 is used to determine the boundary value set of the range field corresponding to all rules of the boundary value set in the target node, and select the target boundary value as the geometric space cutting point from the boundary value set, wherein the boundary value set includes the upper limit value and the lower limit value of all range intervals in the target node. The rules whose corresponding range intervals in the target node fall to the left of the target boundary value are classified into the first subnode, the rules whose corresponding range intervals in the target node fall to the right of the target boundary value are classified into the second subnode, and the rules whose corresponding range intervals in the target node cross the target boundary value are classified into the first subnode and the second subnode at the same time.

[0184] In one embodiment, the cutting module 906 is also used to map the target node into two child nodes by bit cutting if there is no range field in the rule set to be processed, or if the first rule replication rate is less than a preset threshold, to generate a decision tree corresponding to the rule set to be processed.

[0185] For a detailed description of the above-mentioned decision tree generating device 900, please refer to the description of the relevant method steps in the above-mentioned embodiment. Its implementation principle and technical effect are similar, and will not be repeated here in this embodiment.

[0186] Fig.10 The following is a schematic diagram of a cloud device 100 provided in an exemplary embodiment of the present application. The cloud device 100 can be used to run the method provided in any of the above embodiments. Fig.10 As shown, the cloud device 100 may include: a memory 1004 and at least one processor 1005, Fig.10 A processor is taken as an example.

[0187] The memory 1004 is used to store computer programs and can be configured to store various other data to support operations on the cloud device 100. The memory 1004 can be an object storage service (OSS).

[0188] Memory 1004 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0189] The processor 1005 is coupled to the memory 1004 and is used to execute the computer program in the memory 1004 to implement the solution provided by any of the above method embodiments. The specific functions and technical effects that can be achieved are not repeated here.

[0190] Furthermore, if Fig.10 The cloud device also includes: a firewall 1001, a load balancer 1002, a communication component 1006, a power supply component 1003 and other components. Fig.10 Only some components are shown schematically, which does not mean that the cloud device only includes Fig.10 Components shown.

[0191] In one embodiment, the above Fig.10The communication component 1006 in is configured to facilitate wired or wireless communication between the device where the communication component 1006 is located and other devices. The device where the communication component 1006 is located can access a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G, LTE (Long Term Evolution, Long Term Evolution, referred to as LTE), 5G and other mobile communication networks, or a combination thereof. In an exemplary embodiment, the communication component 1006 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 1006 also includes a near field communication (Near Field Communication, referred to as NFC) module to facilitate short-range communication. For example, the NFC module can be based on Radio Frequency Identification (Radio Frequency Identification, referred to as RFID) technology, Infrared Data Association (Infrared Data Association, referred to as IrDA) technology, Ultra Wide Band (UWB) technology, Bluetooth (bluetooth, referred to as BT) technology and other technologies to achieve.

[0192] In one embodiment, the above Fig.10 The power supply component 1003 provides power to various components of the device where the power supply component 1003 is located. The power supply component 1003 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device where the power supply component is located.

[0193] An embodiment of the present application further provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the method of any of the aforementioned embodiments is implemented.

[0194] An embodiment of the present application also provides a computer program product, including a computer program, which implements the method of any of the aforementioned embodiments when executed by a processor.

[0195] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed.

[0196] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of various embodiments of the present application.

[0197] It should be understood that the above-mentioned processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The memory may include a high-speed RAM (Random Access Memory) memory, and may also include non-volatile storage NVM (Nonvolatile memory, NVM for short), such as at least one disk storage, and can also be a USB flash drive, a mobile hard disk, a read-only memory, a disk or an optical disk, etc.

[0198] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special computer.

[0199] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the storage medium can also exist as discrete components in an electronic device or a main control device.

[0200] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0201] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0202] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods of each embodiment of the present application.

[0203] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of user data and other information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0204] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A decision tree generation method, characterized in that: The method comprises: When receiving a set of rules to be processed, detecting whether a range field exists in the set of rules to be processed; If there is a range field in the to-be-processed rule set, convert the range field into a mask form to obtain a preprocessed rule set; For the target node to be cut of the preprocessed rule set, determining a first rule replication rate corresponding to cutting the target node in a bit cutting manner; Determining whether the first rule replication rate is greater than or equal to a preset threshold; If the first rule replication rate is greater than or equal to the preset threshold, determining a second rule replication rate corresponding to when the target node is cut based on the range field using a geometric space cutting method; According to the first rule replication rate and the second rule replication rate, a target cutting method applicable to the target node is determined, and the corresponding target node is cut into two sub-nodes using the target cutting method, and a decision tree corresponding to the rule set to be processed is generated according to the cutting result.

2. The method according to claim 1, characterized in that The converting the range field into a mask form comprises: The range field in the to-be-processed rule set is expanded to include the original range interval defined by the range field and to be a target range interval that can be represented in a mask form, and the target range interval is represented in a mask form.

3. The method according to claim 1, characterized in that The determining of the first rule replication rate corresponding to when the target node is cut in a bit cutting manner includes: Convert all fields of the rule in the target node into a bit string, and determine a target bit position as a bit cutting point in the bit string; The number of first wildcards located at the target bit position in the bit string is counted, and the ratio of the number of the first wildcards to the number of all rules in the target node is determined as the first rule replication rate.

4. The method according to claim 3, characterized in that The step of determining a target bit position as a bit cutting point in the bit string includes: Counting a set of candidate bit positions that have not been used as cutting points in the rule of the target node according to the bit string, determining a first difference between the number of rules in which each of the candidate bit positions is "1" and the number of rules in which the candidate bit position is "0", and counting the number of second wildcards located at each of the candidate bit positions in the bit string; Determine, according to the first difference and the second wildcard number, a first metric corresponding to the candidate bit, wherein the first metric is positively correlated with an absolute value of the first difference and the second wildcard number; The candidate bit position in the candidate bit position set corresponding to the smallest first measurement value is determined as the target bit position.

5. The method according to claim 1, characterized in that The determining of the second rule replication rate corresponding to when the target node is cut based on the range field in a geometric space cutting manner includes: Determine a set of boundary values ​​of range fields corresponding to all rules in the target node, wherein the set of boundary values ​​includes upper and lower limits of all range intervals in the target node; Selecting a target boundary value as a cutting point in the geometric space from the boundary value set; The ratio of the number of rules whose range intervals in the target node cross the target boundary value to the number of all rules in the target node is determined as the second rule replication rate.

6. The method according to claim 5, characterized in that The step of selecting a target boundary value as a cutting point in the geometric space from the boundary value set includes: Deleting the maximum boundary value and the minimum boundary value from the boundary value set to obtain a processed boundary value set; The upper limit value in the processed boundary value set is increased by a first preset value, and the lower limit value in the candidate boundary value set is reduced by a second preset value to obtain a candidate boundary value set; For each candidate boundary value in the candidate boundary value set, respectively count the number of first rules whose corresponding range interval in the target node falls on the left side of the candidate boundary value, the number of second rules whose corresponding range interval falls on the right side of the candidate boundary value, and the number of third rules whose corresponding range interval crosses the candidate boundary value; Determine, according to a second difference between the first number of rules and the second number of rules, and the third number of rules, a second measurement value corresponding to the candidate boundary value, wherein the second measurement value is positively correlated with an absolute value of the second difference and the third number of rules; The candidate boundary value in the candidate boundary value set corresponding to the smallest second measurement value is determined as the target boundary value.

7. The method according to claim 1, characterized in that The step of determining a target cutting method applicable to the target node according to the first rule replication rate and the second rule replication rate, and cutting the corresponding target node into two sub-nodes by using the target cutting method includes: Determining whether the first rule replication rate is less than the second rule replication rate; If the first rule replication rate is less than the second rule replication rate, mapping the target node into two child nodes by bit cutting; If the first rule replication rate is greater than the second rule replication rate, the target node is mapped into two child nodes by using a geometric space cutting method; Alternatively, if the first rule replication rate is equal to the second rule replication rate, a target cutting method is randomly determined from the bit cutting methods and the geometric space cutting methods.

8. The method according to claim 7, characterized in that The target node is cut into a first child node and a second child node; and the bit cutting method is used to map the target node into two child nodes, including: Convert all fields of the rule in the target node into a bit string, and determine a target bit position as a bit cutting point in the bit string; The rules whose target bit is "0" in the target node are classified into the first subnode, the rules whose target bit is "1" in the target node are classified into the second subnode, and the rules whose target bit is a wildcard in the target node are classified into both the first subnode and the second subnode.

9. The method according to claim 7, characterized in that: The target node is cut into a first child node and a second child node; the target node is mapped into two child nodes by using a geometric space cutting method, including: Determine a boundary value set of range fields corresponding to all rules in the target node, and select a target boundary value as a cutting point in the geometric space from the boundary value set, wherein the boundary value set includes upper and lower limit values ​​of all range intervals in the target node; The rules whose corresponding range intervals in the target node fall on the left side of the target boundary value are classified into the first child node, the rules whose corresponding range intervals in the target node fall on the right side of the target boundary value are classified into the second child node, and the rules whose corresponding range intervals in the target node cross the target boundary value are classified into both the first child node and the second child node.

10. The method according to claim 1, characterized in that Also includes: If there is no range field in the set of rules to be processed, or if the first rule replication rate is less than the preset threshold, the target node is mapped into two child nodes by bit cutting to generate a decision tree corresponding to the set of rules to be processed.

11. A message processing method, characterized in that: The method comprises: Receive message data to be processed; Using a preset decision tree to classify the message data, and determining a target rule in the decision tree that matches the message data and has the highest priority; According to the action instruction of the target rule, perform corresponding action processing on the message data; Wherein, the preset decision tree is generated by using the method described in any one of claims 1-10 above.

12. A decision tree generation device, characterized in that: The device comprises: A detection module, configured to detect whether a range field exists in the rule set to be processed when receiving the rule set to be processed; A conversion module, configured to convert the range field into a mask form if there is a range field in the rule set to be processed, so as to obtain a preprocessed rule set; A first determination module is used to determine, for the target node to be cut of the preprocessed rule set, a first rule replication rate corresponding to when the target node is cut by a bit cutting method; A judging module, used to judge whether the first rule duplication rate is greater than or equal to a preset threshold; A second determination module is used to determine a second rule replication rate corresponding to when the target node is cut based on a range field using a geometric space cutting method if the first rule replication rate is greater than or equal to the preset threshold; A cutting module is used to determine a target cutting method applicable to the target node according to the first rule replication rate and the second rule replication rate, and use the target cutting method to cut the corresponding target node into two sub-nodes, and generate a decision tree corresponding to the rule set to be processed according to the cutting result.

13. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the electronic device to perform the method described in any one of claims 1-11.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the processor executes the computer-executable instructions, the method according to any one of claims 1 to 11 is implemented.

Images