Decision tree generation method, packet processing method, device and storage medium

Abstract

The application provides a decision tree generation method, a message processing method, equipment and a storage medium, wherein the method comprises: detecting whether a range field exists in a received to-be-processed rule set; if the range field exists in the to-be-processed rule set, converting the range field into a mask form; for a to-be-cut target node, determining a first rule replication rate corresponding to a bit cutting mode; determining whether the first rule replication rate is greater than or equal to a preset threshold; if yes, determining a second rule replication rate corresponding to a geometric space cutting mode based on the range field cutting; according to the first rule replication rate and the second rule replication rate, determining a target cutting mode suitable for the target node to cut the corresponding target node into two child nodes, and generating a decision tree corresponding to the to-be-processed rule set according to the cutting result. The application adaptively selects a suitable cutting mode to construct a decision tree for a rule set containing various fields, improves the tree construction speed of the rule set, and reduces the storage resource consumption.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a decision tree generation method, message processing method, device and storage medium. Background Technology

[0002] With the development of information technology, packet classification is a fundamental mechanism for achieving Quality of Service (QoS) assurance and security protection in today's network devices such as routers and firewalls. The purpose of packet classification is to distinguish packet types based on multiple field values ​​in the network packet header, thereby performing corresponding differentiated operations on the packets. A packet classifier contains a list of rules, where each rule consists of a priority, a matching field (also called a "dimension" or "domain," which will be referred to as "field" hereafter), and the action to be taken when matching a packet.

[0003] Message classification is a problem of finding the highest-priority rule that matches a message from a list of rules. Currently, widely used message classification methods include hardware solutions based on ternary content addressable memory (TCAM) and algorithm-based software solutions. Among software algorithms, decision trees are considered the most promising alternative to hardware methods due to their advantages such as supporting large numbers of rules, high scalability, and fast search speed.

[0004] In decision tree construction, the key lies in how to cut the nodes to achieve recursive tree building. Generally, there are two methods for node cutting in decision trees: one is equal division or equal density cutting based on geometric space; the other is bit cutting using the bits of the rules. In the geometric space cutting scheme, the entire rule space is divided into several independent subspaces, and each rule is assigned to a different space. Rules spanning multiple subspaces will appear simultaneously in multiple spaces, a phenomenon known as rule duplication. Geometric space cutting often suffers from severe rule duplication, complex node indexes, and excessive tree depth, and it struggles to handle rules with wildcards in arbitrary positions. Bit cutting, on the other hand, selects effective bits to map rules to different child nodes, thus avoiding blindly cutting the entire search space. It is computationally simpler, more efficient in tree building, and supports rules with arbitrary wildcard positions, making it the mainstream cutting method in current decision tree schemes.

[0005] However, bit splitting cannot be directly applied to all matching fields, such as destination port numbers, which are often given in range form. These range fields cannot be directly split using bit splitting. The relevant solution is to expand the range field into bit form before or during the splitting process. A range field represented by 16 bits (range interval 0:65535) can be expanded to a maximum of 30 rules. If a rule has two such range fields, it may be expanded to 900 rules. All expanded rules must participate in the subsequent tree building process, and each expanded rule is treated as an independent rule during storage, which makes the limited hardware resources that can process and store fewer rules. Summary of the Invention

[0006] The main objective of this application is to provide a decision tree generation method, message processing method, device, and storage medium that can adaptively select appropriate slicing methods to construct decision trees from rule sets containing various fields, thereby improving the speed and efficiency of rule set tree construction and reducing storage resource consumption.

[0007] In a first aspect, embodiments of this application provide a decision tree generation method, comprising: when a set of rules to be processed is received, detecting whether a range field exists in the set of rules to be processed; if a range field exists in the set of rules to be processed, converting the range field into a mask form to obtain a preprocessed rule set; for a target node to be cut in the preprocessed rule set, determining a first rule replication rate corresponding to cutting the target node based on the range field using a bit cutting method; determining whether the first rule replication rate is greater than or equal to a preset threshold; if the first rule replication rate is greater than or equal to the preset threshold, determining a second rule replication rate corresponding to cutting the target node based on the range field using a geometric space cutting method; determining a target cutting method applicable to the target node based on the first rule replication rate and the second rule replication rate, and cutting the corresponding target node into two child nodes using the target cutting method, and generating a decision tree corresponding to the set of rules to be processed based on the cutting result.

[0008] In one embodiment, converting the range field into a mask form includes: expanding the range field in the rule set to be processed into a target range range that includes the original range interval defined by the range field and can be represented in mask form, and representing the target range range in mask form.

[0009] In one embodiment, determining the first rule replication rate corresponding to cutting the target node using a bit-cutting method includes: converting all fields of the rules in the target node into a bit string, determining the target bit position as the bit-cutting point in the bit string; counting the number of first wildcards located at the target bit position in the bit string, and determining the ratio of the number of first wildcards to the number of all rules in the target node as the first rule replication rate.

[0010] In one embodiment, determining the target bit position as a bit cutting point in the bit string includes: statistically analyzing the set of candidate bit positions in the rules of the target node that have not been used as cutting points, and determining a first difference between the number of rules where each candidate bit position is "1" and the number of rules where each candidate bit position is "0", and statistically analyzing the number of second wildcards located at each candidate bit position in the bit string; determining a first measure value corresponding to the candidate bit position based on the first difference and the number of second wildcards, wherein the first measure value is positively correlated with the absolute value of the first difference and the number of second wildcards; and determining the candidate bit position with the smallest first measure value in the set of candidate bit positions as the target bit position.

[0011] In one embodiment, determining the second rule replication rate corresponding to cutting the target node based on the range field using a geometric space cutting method includes: determining a set of boundary values ​​for the range field corresponding to all rules in the target node, the set of boundary values ​​including the upper and lower limits of all range intervals in the target node; selecting target boundary values ​​from the set of boundary values ​​as geometric space cutting points; and determining the second rule replication rate as the ratio of the number of rules in the target node whose range intervals cross the target boundary value to the total number of rules in the target node.

[0012] In one embodiment, selecting the target boundary value as the geometric space cutting point from the boundary value set includes: deleting the maximum and minimum boundary values ​​from the boundary value set to obtain a processed boundary value set; increasing the upper limit value in the processed boundary value set by a first preset value and decreasing the lower limit value in the candidate boundary value set by a second preset value to obtain a candidate boundary value set; for each candidate boundary value in the candidate boundary value set, respectively counting the number of first rules that fall to the left of the candidate boundary value, the number of second rules that fall to the right of the candidate boundary value, and the number of third rules that cross the candidate boundary value; determining a second measurement value corresponding to the candidate boundary value based on the second difference between the first and second rule counts and the third rule count, wherein the second measurement value is positively correlated with the absolute value of the second difference and the third rule count; and determining the candidate boundary value with the smallest second measurement value in the candidate boundary value set as the target boundary value.

[0013] In one embodiment, determining a target segmentation method applicable to the target node based on the first rule replication rate and the second rule replication rate, and segmenting the corresponding target node into two child nodes using the target segmentation method, includes: determining whether the first rule replication rate is less than the second rule replication rate; if the first rule replication rate is less than the second rule replication rate, mapping the target node into two child nodes using a bit segmentation method; if the first rule replication rate is greater than the second rule replication rate, mapping the target node into two child nodes using a geometric space segmentation method.

[0014] In one embodiment, if the first rule replication rate is equal to the second rule replication rate, a target cutting method is randomly determined from the bit cutting method and the geometric space cutting method.

[0015] In one embodiment, the target node is split into a first child node and a second child node; the step of mapping the target node into two child nodes using a bit splitting method includes: converting all fields of the rules in the target node into a bit string, determining the target bit position as the bit splitting point in the bit string; assigning the rules in the target node that are "0" at the target bit position to the first child node, assigning the rules in the target node that are "1" at the target bit position to the second child node, and assigning the rules in the target node that are wildcards at the target bit position to both the first child node and the second child node.

[0016] In one embodiment, the target node is divided into a first child node and a second child node; the step of mapping the target node into two child nodes using a geometric space cutting method includes: determining the set of boundary values ​​of the range fields corresponding to all rules in the target node, and selecting target boundary values ​​from the set of boundary values ​​as geometric space cutting points, wherein the set of boundary values ​​includes the upper and lower limits of all range intervals in the target node; assigning rules in the target node whose corresponding range intervals fall to the left of the target boundary value to the first child node, assigning rules in the target node whose corresponding range intervals fall to the right of the target boundary value to the second child node, and assigning rules in the target node whose corresponding range intervals cross the target boundary value to both the first child node and the second child node.

[0017] In one embodiment, the method further includes: if the range field does not exist in the set of rules to be processed, or if the replication rate of the first rule is less than the preset threshold, mapping the target node into two child nodes by bit splitting to generate a decision tree corresponding to the set of rules to be processed.

[0018] Secondly, embodiments of this application provide a message processing method, the method comprising: receiving message data to be processed; classifying the message data using a preset decision tree, determining a target rule in the decision tree that matches the message data and has the highest priority; and performing corresponding action processing on the message data according to the action instruction of the target rule; wherein the preset decision tree is generated using the method described in any of the above aspects.

[0019] Thirdly, embodiments of this application provide a decision tree generation apparatus, comprising:

[0020] The detection module is used to detect whether a range field exists in the rule set to be processed when a rule set to be processed is received.

[0021] The conversion module is used to convert the range field into a mask form if the rule set to be processed contains a range field, so as to obtain the preprocessed rule set.

[0022] The first determining module is used to determine the first rule replication rate corresponding to cutting the target node using the bit cutting method for the target node to be cut in the preprocessed rule set;

[0023] The judgment module is used to determine whether the replication rate of the first rule is greater than or equal to a preset threshold.

[0024] The second determining module is used to determine the second rule replication rate when cutting the target node based on the range field using the geometric space cutting method if the first rule replication rate is greater than or equal to the preset threshold.

[0025] The cutting module is used to determine the target cutting method applicable to the target node based on the first rule replication rate and the second rule replication rate, and to cut the corresponding target node into two child nodes using the target cutting method, and to generate a decision tree corresponding to the set of rules to be processed based on the cutting result.

[0026] Fourthly, embodiments of this application provide an electronic device, including:

[0027] At least one processor; and

[0028] A memory that is communicatively connected to the at least one processor;

[0029] The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, cause the electronic device to perform the method described in any of the above aspects.

[0030] Fifthly, embodiments of this application provide a cloud device, including:

[0031] At least one processor; and

[0032] A memory that is communicatively connected to the at least one processor;

[0033] The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, cause the cloud device to perform the method described in any of the above aspects.

[0034] Sixthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the method described in any of the above aspects.

[0035] In a seventh aspect, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the methods described in any of the above aspects.

[0036] The decision tree generation method, message processing method, device, and storage medium provided in this application, when cutting tree nodes, convert the range field of the rule set into a mask form. For each target node to be cut, the first rule replication rate of bit cutting is evaluated first to determine whether it is greater than or equal to a preset threshold. If so, it indicates that the bit cutting result is not good. At this time, the evaluation of the effect of the geometric space cutting method is triggered. The second rule replication rate when cutting the range field of the rules in the target node using the geometric space cutting method can be further evaluated, and the relationship between the second rule replication rate and the bit cutting replication rate is compared. Based on the evaluation result, a more suitable cutting method for the target node is adaptively determined. The target node is cut into two child nodes using the determined target cutting method. After all child nodes of the rule set become leaf nodes, the construction of the decision tree is completed. In this way, there is no need to expand the rules, and the bit cutting is no longer limited by the range field. The bit cutting can be applied to all known rule fields without generating redundant rules. By unifying bit segmentation and geometric space segmentation, we can adaptively select the appropriate segmentation method to build a decision tree for rule sets containing various fields, thereby improving the speed and efficiency of rule set tree building and reducing storage resource consumption. Attached Figure Description

[0037] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are some embodiments of the invention, and that those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0038] Figure 1 A schematic diagram of a geometric space cutting scheme provided in an embodiment of this application;

[0039] Figure 2 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application;

[0040] Figure 3 This is a schematic diagram illustrating an application scenario of a decision tree generation scheme provided in an embodiment of this application;

[0041] Figure 4 A schematic diagram of the overall system flow architecture of a message classification scheme provided in this application embodiment;

[0042] Figure 5 A flowchart illustrating a decision tree generation method provided in an embodiment of this application;

[0043] Figure 6 This is a schematic diagram of a decision tree construction result provided in an embodiment of this application;

[0044] Figure 7 This is a schematic diagram of a decision tree construction result provided in an embodiment of this application;

[0045] Figure 8 A flowchart illustrating a message processing method provided in an embodiment of this application;

[0046] Figure 9 This is a schematic diagram of the structure of a decision tree generation device provided in an embodiment of this application;

[0047] Figure 10 This is a schematic diagram of the structure of a cloud device provided in an embodiment of this application.

[0048] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0049] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application.

[0050] In this article, the term "and / or" is used to describe the relationship between related objects. Specifically, it means that there can be three kinds of relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, or B exists alone.

[0051] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0052] To clearly describe the technical solutions of the embodiments of this application, the terms involved in this application are first defined as follows:

[0053] TCAM: Ternary Content Addressable Memory.

[0054] QoS: Quality of Service.

[0055] IP stands for Internet Protocol, referring to the Internet connection protocol.

[0056] IPv4: Internet Protocol version 4.

[0057] IPv6: Internet Protocol Version 6.

[0058] Binary tree: A tree structure in which each node has at most two subtrees.

[0059] In modern network devices such as routers and firewalls, packet classification is a fundamental mechanism for achieving Quality of Service (QoS) guarantees and security protection. The purpose of packet classification is to distinguish packet types based on multiple field values ​​in the network packet header, thereby performing corresponding differentiated operations on the packets. A packet classifier contains a list of rules, where each rule consists of a priority, a matching field (also called a "dimension" or "domain," hereinafter referred to as "field"), and the action to be taken when matching a packet. In packet classification, matching field types can be divided into mask fields and range fields. Mask fields consist of a keyword plus a mask, such as the destination IP address or protocol number. Range fields are given in the form of a range interval, such as the destination port number. Specifically, if wildcards in the mask field only appear consecutively in the last few bits of the keyword, this type of mask field can also be called a prefix field.

[0060] Table 1 below shows an example of a message classification rule base, containing four rules: rule1, rule2, rule3, and rule4. Each rule contains five fields: source address, destination address, protocol number, source port, and destination port, in the common 5-tuple format. Field representations can be either masked or range-based. For example, the source address in Table 1 is constructed using IP address plus a mask. A mask value of "1" corresponds to a valid IP bit, while a mask value of "0" corresponds to a neutral bit, which can be either 0 or 1. This bit is typically represented by the wildcard "*". For instance, 10.18.1.0 / 255.255.255.0 can be written as: 0000101000010010 00000001********. In this rule, wildcards only appear in the last 8 bits. In this case, the prefix length can also be used to replace the mask, which can be written as: 10.18.1.0 / 24. Obviously, the prefix is ​​a special form of the mask. If a field is given in the form of a certain range, it is called a range field. A range field can be a certain range or a certain definite value, such as the destination port in Table 1.

[0061] Table 1. Examples of Message Classification Rule Base

[0062]

[0063] Message classification is a problem of finding the highest-priority rule that matches a message from a list of rules. Currently, widely used message classification methods include hardware solutions based on ternary content addressable memory (TCAM) and algorithm-based software solutions. Among software algorithms, decision trees are considered the most promising alternative to hardware methods due to their advantages such as supporting large numbers of rules, high scalability, and fast search speed.

[0064] The key to constructing a decision tree lies in how to cut its nodes to achieve recursive tree building. Generally, there are two methods for cutting decision tree nodes: one is equal division or equal-density cutting based on geometric space; the other is bit cutting using regular bit positions.

[0065] Figure 1 This paper presents an example of equally dividing a set of two-dimensional rules (rules R1 to R6) on fields X and Y. The entire rule space is divided into four independent subspaces, with each rule assigned to a different space. Rules spanning multiple subspaces will appear simultaneously in multiple spaces (e.g., R1), a phenomenon known as rule duplication. Geometric space division often suffers from severe rule duplication, complex node indexes, and excessive tree depth. It also struggles to handle rules with wildcards in arbitrary positions, such as rule2 in Table 1, which is not spatially contiguous in the source address dimension. Bit-based division, on the other hand, selects valid bits to map rules to different child nodes, thus avoiding blindly dividing the entire search space. It is computationally simpler, more efficient in tree construction, and supports rules with arbitrary wildcard positions, making it the mainstream division method in current decision tree schemes.

[0066] However, bit splitting cannot be directly applied to all matching fields, such as destination port numbers, which are often given in range form. These range fields cannot be directly split using bit splitting. The solution in related technologies is to expand the range field into bit form before or during the splitting process. For example, in rule3 in Table 1, the destination port 0:1024 needs to be split into two parts: 0:1023 and 1024:1024, so that they can be represented by 0000 00********** and 0000 01000000 0000. In this case, one rule will be expanded into two. A range field represented by 16 bits (within the range of 0:65535) can be expanded to a minimum of 30 rules. If a rule has two such range fields, it may be expanded to 900 rules. All expanded rules must participate in the subsequent tree construction process, and each expanded rule is treated as an independent rule during storage, which makes the limited hardware resources that can process and store even fewer rules. Therefore, it is necessary to implement a message classification decision tree scheme that can support fields of any form and is not constrained by wildcard positions, and can efficiently build the tree.

[0067] For message classification based on decision trees, the main solutions are as follows:

[0068] 1. Bit splitting algorithm for regular expansion before tree construction

[0069] Modular Packet Classification (MBCC) was the first algorithm to propose using rule bits for node segmentation. If the rule set contains range fields, rule expansion is performed before tree node segmentation, converting the range fields into prefix forms, and then a binary tree is built using bit segmentation. This technique selects a bit at a time during node segmentation, mapping all rules in the parent node to the left and right child nodes based on the bit's "0" or "1" value. If the selected bit for a rule in the parent node is a wildcard, it is copied to both the left and right child nodes. Following this approach, nodes are recursively segmented until the number of rules in a child node is less than or equal to a set threshold, at which point the segmentation ends, and that child node is considered a leaf node. Because this algorithm involves rule expansion from the outset, the number of rules actually involved in tree construction is several times larger than the original number, and the preprocessing is extremely complex.

[0070] 2. Bit splitting algorithm for rule expansion during tree construction

[0071] To address the massive rule expansion problem in modular message classification algorithms, an improved algorithm is proposed. This approach temporarily ignores range field information, first performing bit segmentation on non-range fields in the rule set. When the segmentation efficiency falls below a pre-set threshold, the range rules in the rule set are expanded, converted into prefix form, and then segmented again, with a binary tree constructed. This approach alleviates rule expansion to some extent, but does not completely eliminate it.

[0072] 3. Geometric Space-Based Equal Density Cutting Algorithm

[0073] This technical solution employs a geometric space cutting method, where each tree node is cut only on one field. First, all rules are projected onto each field, resulting in M ​​endpoints. Then, a heuristic method is used based on these M endpoints to determine the cutting field and its cut point, splitting the current search space into two subspaces. Similarly, nodes are recursively cut until the number of rules in the child nodes is less than or equal to a set threshold. Because this solution selects an optimal cut point from the entire search space each time, its cutting is more refined. However, it also suffers from high computational cost, long tree construction time, and complex node indexing. Furthermore, geometric space cutting can only handle prefix and range fields; when wildcards are in arbitrary positions, this solution becomes inapplicable.

[0074] Therefore, it is evident that the aforementioned solutions suffer from at least the following technical problems:

[0075] 1. Although geometric cutting algorithms are suitable for cutting range fields, they have low cutting efficiency, complex node indexes, and do not support wildcards in arbitrary positions.

[0076] 2. If you want to support fields where wildcards can appear in any position, you can only use a bit splitting algorithm. However, bit splitting requires rule expansion when processing range fields, which wastes hardware resources.

[0077] To address the aforementioned issues, this application provides a decision tree generation scheme. For the input set of rules to be processed, during node cutting, the range field of the rule set is converted into a mask. For each target node to be cut, the replication rate of the first rule (bit cutting) is evaluated first to determine if it is greater than or equal to a preset threshold. If so, the bit cutting result is unsatisfactory, triggering an evaluation of the geometric space cutting method. This evaluation further assesses the replication rate of the second rule when using geometric space cutting to cut the range field of the rules in the target node, comparing the second rule replication rate with the bit cutting replication rate. Based on the evaluation results, a more suitable cutting method for the target node is adaptively determined. The determined target cutting method is used to cut the target node into two child nodes. After all child nodes of the rule set become leaf nodes, the decision tree is constructed. If the rule set does not contain a range field, bit cutting is prioritized, and geometric space cutting will not be executed. Geometric space cutting is used as a supplement to bit cutting. Bit cutting can be applied to any field (including mask fields and range fields) and is the preferred cutting method, while geometric space cutting can only be applied to range fields and is only executed when the "preset threshold" is met. In this way, no rule expansion is needed, and bit segmentation is no longer limited by the range field. Bit segmentation can be applied to all currently known rule fields without generating redundant rules. By unifying bit segmentation and geometric space segmentation, adaptive selection of appropriate segmentation methods can be achieved to build decision trees for rule sets containing various fields, improving the speed and efficiency of rule set construction and reducing storage resource consumption.

[0078] like Figure 2 As shown, this embodiment provides an electronic device 1, including: at least one processor 11 and a memory 12. Figure 2 Taking a processor as an example, processor 11 and memory 12 are connected via bus 10. Memory 12 stores instructions that can be executed by processor 11. The instructions are executed by processor 11 to enable electronic device 1 to perform all or part of the process of the method in the following embodiments, so as to achieve adaptive selection of appropriate cutting methods to cut nodes during the tree construction process. This is suitable for building decision trees with rule sets containing various fields, improving the tree construction speed and efficiency of rule sets, and reducing storage resource consumption.

[0079] In one embodiment, the electronic device 1 may be a mobile phone, tablet computer, laptop computer, desktop computer, or a large computing system composed of multiple computers.

[0080] Figure 3 This is a schematic diagram of an application scenario system 200 for a decision tree generation scheme provided in an embodiment of this application.

[0081] like Figure 3As shown, the system includes: a server 210 and a terminal 220, wherein:

[0082] Server 210 can be a data platform that provides decision tree generation services, such as a message data processing platform. In a real-world scenario, a message data processing platform may have multiple servers 210. Figure 3 Taking a single server (210) as an example.

[0083] Terminal 220 can be a computer, mobile phone, tablet, or other device used by the user to log in to the message data processing platform. There can also be multiple terminals 220. Figure 3 The following example uses two terminals, 220, for illustration.

[0084] Terminal 220 and server 210 can transmit information via the Internet, enabling terminal 220 to access data on server 210. Both terminal 220 and / or server 210 can be implemented by electronic device 1.

[0085] The decision tree generation scheme of this application embodiment can be deployed on server 210, on terminal 220, or partially on server 210 and partially on terminal 220. The appropriate deployment method can be chosen based on actual needs in a real-world scenario, and this embodiment does not impose any limitations.

[0086] When the decision tree generation scheme is deployed entirely or partially on server 210, an interface can be opened to terminal 220 to provide algorithm support to terminal 220.

[0087] The method provided in this application embodiment can be implemented by electronic device 1 executing corresponding software code, and is achieved through data interaction with a server. Electronic device 1 can be a local terminal device. When the method runs on a server, it can be implemented and executed based on a cloud interaction system, which includes a server and client devices.

[0088] In one possible implementation, the method provided by the embodiments of the present invention provides a graphical user interface through a terminal device, wherein the terminal device may be the aforementioned local terminal device or a client device in the aforementioned cloud interaction system.

[0089] The decision tree generation method of this application embodiment can be applied to any field that requires the construction of decision trees.

[0090] like Figure 4 The diagram shown is a schematic representation of the overall system architecture of a message classification scheme provided in this application embodiment, including the following process steps:

[0091] First, the set of rules to be processed is received, and the set of rules is preprocessed. Preprocessing may include expanding the range of the range field. Then, a decision tree is constructed from the preprocessed set of rules.

[0092] Taking binary tree construction as an example, the tree construction part forms a root node from all the rules in the preprocessed rule set. Based on the determined target splitting method, the root node is divided into two child nodes. In each split, the number of rules in the child node is always less than that in its parent node. This process is repeated for the child nodes until the number of rules in the child node is less than or equal to a preset number (BINTH). At this point, the child node is called a leaf node, and further splitting stops. The tree construction process ends when all child nodes have become leaf nodes.

[0093] When a message to be processed is received, the tree is traversed level by level according to the decisions in the nodes until a leaf node is reached. In a decision tree, a message can find one and only one matching leaf node. A linear search is performed on all rules in the leaf node, and the rule with the highest priority that matches the message is returned as the final matching rule. The message is then processed according to the action corresponding to the matching rule.

[0094] The following detailed description of some embodiments of this application is provided in conjunction with the accompanying drawings. Where there is no conflict between the embodiments, the following embodiments and features can be combined with each other. Furthermore, the timing of the steps in the following method embodiments is merely an example and not a strict limitation.

[0095] Please refer to Figure 5 This is a decision tree generation method according to an embodiment of this application. The method can be derived from... Figure 2 The electronic device 1 shown is used to perform this action and can be applied to... Figures 3 to 4 In the application scenario of decision tree generation shown, the method adaptively selects an appropriate cutting method to cut nodes during the tree construction process. This is suitable for building decision trees from rule sets containing various fields, improving the speed and efficiency of rule set tree construction, and reducing storage resource consumption. This embodiment uses terminal 220 as the execution end as an example, and the method includes the following steps:

[0096] Step 501: Receive the set of rules to be processed.

[0097] In this step, "rules" refers to the rules used for message classification. The preprocessing section may include the received input set of rules to be processed. This set can be the original set of rules or a subset of rules processed by a rule set partitioning method. Rules belonging to the same rule set should have fields of exactly the same type and size, also known as having the same key (value pair), such as a rule set consisting of IPv4 5-tuples. Rules with different keys should belong to different rule sets, such as IPv4 5-tuples and IPv6 5-tuples. For different rule sets, a separate tree can be built for each rule set, ultimately constructing multiple decision trees.

[0098] Step 502: Check if a range field exists in the set of rules to be processed. If it exists, proceed to step 503; otherwise, proceed to step 508.

[0099] In this step, the range field refers to a field given in the form of a range interval, such as the field content of the destination port in Table 1 above. As mentioned before, since the existence of the range field will affect the node splitting method, it is first determined whether each rule in the rule set to be processed has a range field. If a range field exists, proceed to step 503 to perform range field preprocessing; if no range field exists, proceed directly to step 508 to construct the decision tree using bit splitting.

[0100] Step 503: Convert the range field into a mask form to obtain the preprocessed rule set.

[0101] In this step, if a range field exists in the rule set to be processed, the range field can be converted into a mask form so that all fields in the preprocessed rule set can be represented in the form of binary bit strings without generating any redundant rules.

[0102] In one embodiment, step 503 may specifically include: expanding the range field in the rule set to be processed into a target range range that includes the original range interval defined by the range field and can be represented in mask form, and representing the target range range in mask form.

[0103] In this embodiment, the target range interval can be the smallest range interval that includes the original range interval and can be represented in mask form, in order to reduce the consumption of data storage resources. To unify the range field and the mask field, the range interval of some range fields that cannot be directly represented in mask form can be expanded. For range fields, they are all written as the smallest range interval that includes the range interval and can be represented in mask form, and this smallest range interval is represented in mask form, where mask form specifically refers to prefix form. Specifically, it can be divided into the following three cases:

[0104] (1) For range fields where the upper and lower limits are the same, a mask can be used to represent them directly. For example, the range field 152:152 can be converted as follows: 152:152 → 1001 1000.

[0105] (2) For range fields where the upper and lower limits of the range are different but no rule expansion is required, they can be converted into a prefix form. For example, the range field 152:159 can be converted as follows: 152:159→1001 1***.

[0106] (3) For range fields where the upper and lower limits of the range are different and cannot be written as a prefix, the original range range of the range field can be expanded to find the smallest range range that can include the original range range and can be written as a prefix. For example, the range field 5:6 can be expanded to 4:7 and then converted into a prefix. Specifically, the conversion can be done as follows: 5:6→4:7→0000 01**.

[0107] In conjunction with other mask fields in the rules, all fields in the preprocessed rule set can be represented in the form of binary bit strings, without generating any redundant rules, thus providing a data computation foundation for subsequent decision tree construction.

[0108] Step 504: For the target nodes to be cut in the preprocessed rule set, determine the first rule replication rate corresponding to the bit cutting method when cutting the target nodes.

[0109] In this step, taking the construction of a binary tree as an example, the tree construction part forms a root node from all the rules in the preprocessed rule set. Based on a certain decision, the root node is divided into two child nodes. Each time it is cut, the number of rules in the child node is always less than that in its parent node. This process is repeated for the child nodes until the number of rules in the child node is less than or equal to a preset number (in this embodiment, this preset number can be called BINTH). At this point, the child node is called a leaf node, and further cutting stops. The tree construction process ends when all child nodes become leaf nodes. In a decision tree, nodes that contain more rules than the preset BINTH value and are not root nodes are called intermediate nodes. The target node in this step can include any node that needs to be cut during the decision tree construction process, including but not limited to the root node and intermediate nodes.

[0110] For rules containing range fields, after converting the range fields into a mask form, a decision tree can be constructed on the preprocessed rule set, prioritizing bit splitting to avoid the massive computational burden of haphazardly using geometric space splitting. During bit splitting, the effectiveness of the splitting for the target node needs to be evaluated. The rule replication rate characterizes the effectiveness of the splitting method on the target node; a higher replication rate indicates a worse splitting effect, while a lower replication rate indicates a better splitting effect. Therefore, a first rule replication rate can be determined when using bit splitting to cut the target node, and this first rule replication rate characterizes the splitting effect when using bit splitting to cut the target node.

[0111] In one embodiment, step 504 may specifically include: converting all fields of the rules in the target node into a bit string, and determining the target bit position as the bit cut point in the bit string. The number of first wildcards located at the target bit position in the bit string is counted, and the ratio of the number of first wildcards to the number of all rules in the target node is determined as the first rule replication rate.

[0112] In this embodiment, when evaluating the effect of bit splitting, all fields of the rules in the target node are first converted into bit strings. Each bit splitting calculation selects an optimal target bit as the splitting point, and the rule replication rate at the splitting point is taken as the first rule replication rate corresponding to the bit splitting method. In real-world scenarios, rules with wildcard bits will simultaneously enter both child nodes after splitting. Therefore, the ratio of the number of first wildcards located at the target bit in the bit string to the total number of rules in the target node can be used to accurately characterize the first rule replication rate.

[0113] In one embodiment, step 504, determining the target bit position in the bit string as a bit cutting point, may specifically include: calculating a set of candidate bit positions that have not been used as cutting points in the rules for the target node based on the bit string; determining a first difference between the number of rules where each candidate bit position is "1" and the number of rules where each candidate bit position is "0"; and calculating the number of second wildcards located at each candidate bit position in the bit string. Based on the first difference and the number of second wildcards, a first measure value is determined for the corresponding candidate bit position, where the first measure value is positively correlated with the absolute value of the first difference and the number of second wildcards. The candidate bit position with the smallest first measure value in the candidate bit position set is determined as the target bit position.

[0114] In this embodiment, the absolute value of the first difference can be used to represent the sum of the number of the second wildcards to characterize the first measure value. When bit cutting is used: first, count the set of candidate bits in the node that have not been used as cutting points, obtain the first measure value of each candidate bit according to formula (1), and select the candidate bit with the smallest first measure value as the target bit of the cutting point.

[0115] m b (v)=|num(0)-num(1)|+num(*) (1)

[0116] Where, m b (v) represents the first measure value of the v-th candidate bit, mum(0) represents the number of rules where the v-th candidate bit is "0", and mum(1) represents the number of rules where the v-th candidate bit is "1". num(*) represents the total number of rules where the v-th candidate bit is a wildcard. The first measure value takes into account both the imbalance of candidate bits and the replication rate. After selecting the target bit, the first rule replication rate can be determined by the ratio of the number of first wildcards in the target bit in the bit string to the total number of rules in the target node.

[0117] In one embodiment, the product of the absolute value of the first difference and the number of the second wildcard can also be used to characterize the first measure value, which can be selected based on actual needs in a real-world scenario.

[0118] Step 505: Determine whether the replication rate of the first rule is greater than or equal to the preset threshold. If yes, proceed to step 506; otherwise, proceed to step 508.

[0119] In this step, to ensure the effective slicing of the target node, a preset threshold can be configured for the rule replication rate. Slicing methods with a rule replication rate lower than the preset threshold meet the requirements, while slicing methods with a rule replication rate greater than or equal to the preset threshold do not. Here, the node's rule replication rate is set to an adjustable preset threshold, which is between 0 and 1. The specific value of the preset threshold can be set based on actual needs, for example, it can be set to 30%. For the target node to be sliced, before performing bit slicing, it is first determined whether the first rule replication rate is greater than or equal to the preset threshold. If so, proceed to step 506; otherwise, proceed to step 508 to avoid wasting resources by rashly performing slicing.

[0120] Step 506: Determine the second rule replication rate when cutting target nodes based on the range field using the geometric space cutting method.

[0121] In this step, if the replication rate of the first rule is greater than or equal to a preset threshold, it indicates that the effect of bit cutting on the target node does not meet the requirements of the preset threshold. At this time, the evaluation process of the geometric space cutting method is triggered, which can further evaluate the cutting effect of the geometric space cutting method on the target node. Since geometric space cutting is applied to other mask fields, the computational load will be very large, and it is not necessarily applicable. For example, it is not applicable to mask fields where wildcards appear in any position. Therefore, in this embodiment, the geometric space cutting method is only applied to range fields. When the rules in the target node contain range fields, the replication rate of the second rule corresponding to the cutting of the range fields of the rules in the target node using the geometric space cutting method can be calculated. The replication rate of the second rule can characterize the cutting effect of cutting the target node using the geometric space method.

[0122] In one embodiment, step 506 may specifically include: determining the set of boundary values ​​for the range fields corresponding to all rules in the target node; selecting target boundary values ​​from the set of boundary values ​​as geometric space cutting points; and determining the ratio of the number of rules in the target node whose range intervals cross the target boundary values ​​to the total number of rules in the target node as the second rule replication rate.

[0123] In this embodiment, when using geometric space cutting: First, the set of boundary values ​​included in the range field of all rules in the target node is determined. The set of boundary values ​​includes the upper and lower limits of all range intervals in the target node. Here, the range interval refers to the original range interval defined by the range field of all rules in the target node. Then, a target boundary value is determined from the set of boundary values ​​as a geometric space cutting point. The cutting point divides the original range interval of the range field into two parts, denoted as the left and right intervals. Range intervals located in the left interval will be assigned to the left child node, and range intervals located in the right interval will be assigned to the right child node. Range intervals that cross the cutting point will be assigned to both the left and right child nodes. Therefore, rules whose range intervals cross the cutting point will enter both the left and right child nodes. Thus, the ratio of the number of rules whose range intervals cross the cutting point to the total number of rules in the target node can be used to accurately characterize the replication rate of the second rule.

[0124] In one embodiment, step 506, selecting the target boundary value as the geometric space cutting point from the boundary value set, may specifically include: deleting the maximum and minimum boundary values ​​from the boundary value set to obtain a processed boundary value set; increasing the upper limit value in the processed boundary value set by a first preset value and decreasing the lower limit value in the candidate boundary value set by a second preset value to obtain a candidate boundary value set; for each candidate boundary value in the candidate boundary value set, counting the number of first rules falling to the left of the candidate boundary value, the number of second rules falling to the right of the candidate boundary value, and the number of third rules crossing the candidate boundary value in the corresponding range interval of the target node; determining the second measurement value corresponding to the candidate boundary value based on the second difference between the number of first rules and the number of second rules, and the number of third rules, where the second measurement value is positively correlated with the absolute value of the second difference and the number of third rules; and determining the candidate boundary value with the smallest corresponding second measurement value in the candidate boundary value set as the target boundary value.

[0125] In this embodiment, all rules are first projected onto each range field, resulting in a boundary value set of M (where M is a positive integer) at a given range field. The minimum and maximum values ​​are then removed from these M boundary values, yielding a processed boundary value set containing M-2 boundary values. Assuming a first preset value of 1 and a second preset value of 1, the upper limit values ​​in the processed boundary value set are incremented by 1, and the lower limit values ​​are decremented by 1 to optimize these M-2 boundary values, resulting in a candidate boundary value set. This reduces the rule boundary duplication problem caused by directly cutting boundary values. The merits of these M-2 cut points are then evaluated based on the rule duplication rate. The evaluation criteria include the balance of the two resulting child nodes and the duplication rate caused by cutting that point. This evaluation is performed across multiple range fields of all rules to determine the optimal cut point and cut field.

[0126] In one embodiment, the second measure can be characterized by the sum of the absolute value of the second difference and the number of third rules. The second measure corresponding to each candidate boundary value can be calculated using the following formula (2):

[0127] m r (v)=|num(L)-num(R)|+num(*) (2)

[0128] Where, m r(v) represents the second metric for the v-th candidate boundary value, num(L) represents the number of first rules in the left node, num(R) represents the number of second rules in the left and right child nodes, and num(*) represents the number of third rules that span the range interval across the v-th candidate boundary value, i.e., the number of rules that are copied. Similar to the evaluation of bit cutting, the second metric characterizes the balance and copy rate in the left and right child nodes when the v-th candidate boundary value is used as the cutting point. The metric is chosen to make m... r (v) The smallest candidate boundary value is used as the target boundary value of the cutting point.

[0129] In one embodiment, the product of the absolute value of the second difference and the number of third rules can also be used to represent the first measurement value. In actual scenarios, the choice can be made based on actual needs, and this embodiment does not limit it.

[0130] Step 507: Based on the replication rate of the first rule and the replication rate of the second rule, determine the target cutting method applicable to the target node, and cut the corresponding target node into two child nodes using the target cutting method. Generate the decision tree corresponding to the set of rules to be processed based on the cutting results.

[0131] In this step, due to the expanded scope, the geometric space represented by the expanded rules is larger than the original rules. This may lead to situations where bit-based cutting alone is insufficient to distinguish rules within non-leaf nodes. In such cases, geometric space cutting is needed to continue building the decision tree. Specifically, the algorithm monitors the rule replication of the target node at each node cut. After determining the first rule replication rate of bit-based cutting and the second rule replication rate of geometric space cutting, it can further evaluate which cutting method is more suitable for the target node based on these replication rates. The more suitable cutting method is then determined as the target cutting method, achieving adaptive selection of the appropriate cutting method for the target node, rather than blindly using a single method. This improves the efficiency of decision tree construction and reduces storage resource consumption.

[0132] In one embodiment, step 507, based on the first rule replication rate and the second rule replication rate, determines the target segmentation method applicable to the target node, and segments the corresponding target node into two child nodes using the target segmentation method. This includes: determining whether the first rule replication rate is less than the second rule replication rate. If the first rule replication rate is less than the second rule replication rate, a bit segmentation method is used to map the target node into two child nodes. If the first rule replication rate is greater than the second rule replication rate, a geometric space segmentation method is used to map the target node into two child nodes.

[0133] In this embodiment, the rule replication rate is negatively correlated with the effectiveness of the cutting method; that is, the higher the rule replication rate, the worse the cutting effect, and the lower the rule replication rate, the better the cutting effect. The relative merits of bit cutting and geometric space cutting can be evaluated by the relationship between the first rule replication rate and the second rule replication rate. If the first rule replication rate is less than the second rule replication rate, it means that for the target node, although the first rule replication rate of bit cutting is greater than or equal to the preset threshold, the cutting effect of bit cutting is still better than that of geometric space cutting. Therefore, bit cutting is used to map the target node into two child nodes. If the first rule replication rate is greater than the second rule replication rate, it means that for the target node, geometric space cutting is better than bit cutting. Therefore, geometric space cutting is used to map the target node into two child nodes. In this way, based on the actual situation of the target node, a more suitable cutting method is adaptively selected for node cutting, improving the tree building speed and efficiency of the rule set and reducing storage resource consumption.

[0134] In one embodiment, step 507, which determines the target cutting method applicable to the target node based on the first rule replication rate and the second rule replication rate, and cuts the corresponding target node into two child nodes using the target cutting method, may further include: if the first rule replication rate is equal to the second rule replication rate, randomly determining a target cutting method from the bit cutting method and the geometric space cutting method.

[0135] In this embodiment, if the first rule replication rate is equal to the second rule replication rate, it means that for the target node, the effect of bit cutting is basically the same as the effect of geometric space cutting. At this time, either of the two cutting methods can be selected as the target cutting method according to actual needs. For example, one of the two cutting methods can be randomly selected as the target cutting method.

[0136] In one embodiment, step 507 uses a bit-splitting method to map the target node into two child nodes, including: converting all fields of the rules in the target node into a bit string, and determining the target bit position as the bit splitting point in the bit string. Rules in the target node that are "0" at the target bit position are assigned to the first child node, rules in the target node that are "1" at the target bit position are assigned to the second child node, and rules in the target node that are wildcards at the target bit position are assigned to both the first and second child nodes.

[0137] In this embodiment, taking the construction of a binary tree as an example, the target node is cut into a first child node and a second child node. The method described in step 504 above for determining the target bit position can be used. All fields of the rules in the target node are converted into bit strings. Based on the bit strings, the set of candidate bit positions in the rules of the target node that have not been used as cut points is counted. A first difference is determined between the number of rules with each candidate bit position being "1" and the number of rules with each candidate bit position being "0". The number of second wildcards located at each candidate bit position in the bit string is also counted. Based on the first difference and the number of second wildcards, a first measure value is determined for the corresponding candidate bit position. The first measure value is positively correlated with the absolute value of the first difference and the number of second wildcards. The candidate bit position with the smallest first measure value in the candidate bit position set is determined as the target bit position.

[0138] Specifically, the first measure value can be represented by the sum of the absolute value of the first difference and the number of the second wildcards. When bit cutting is used: first, count the set of candidate bits in the node that have not been used as cutting points, obtain the first measure value of each candidate bit according to formula (1), and select the candidate bit with the smallest first measure value as the target bit of the cutting point. The rules in the target node that are 0 in the target bit are assigned to the first child node, the rules in the target node that are 1 in the target bit are assigned to the second child node, and the rules in the target node that are wildcards * in the target bit are assigned to both the first and second child nodes, thus completing the cutting process of the target node.

[0139] Taking the rule set example shown in Table 2 below, Table 2 shows 8 rules containing two types of fields: a mask field field 1 and a range field field 2. The range field has been expanded, and field 2 has been converted to field 2*.

[0140] Table 2. Examples of rule sets

[0141]

[0142] Assuming the preset number of BINTH is 4, that is, when the number of rules contained in a child node is less than or equal to 4, the child node is determined to be a leaf node. According to the calculation results of Table 2 based on formula (1), the third bit in field 1 (counting from the left of the field in Table 2) is selected as the target bit, and the tree construction result is as follows. Figure 6 As shown:

[0143] In the first cut, node 0, which contains all the rules in Table 2, is taken as the target node, resulting in a leaf node 2 (i.e., the first child node) and an intermediate node 1 (i.e., the second child node). The rules included in node 1 are: R1, R2, R3, R5, and R7, and the rules included in node 2 are: R4, R6, and R8.

[0144] The second cut takes the middle node 1 as the target node, selecting the second bit in field 1 (counting from the left in Table 2) as the target bit, and continues cutting the middle node 1 to obtain nodes 3 and 4. Node 3 includes the rules R3 and R5. Node 4 includes the rules R1, R2, and R7. Both are leaf nodes, and the tree construction is complete.

[0145] In one embodiment, the target node is segmented into a first child node and a second child node. Mapping the target node into two child nodes using a geometric space segmentation method may specifically include: determining the set of boundary values ​​for the range fields corresponding to all rules in the target node, and selecting target boundary values ​​from the boundary value set as geometric space segmentation points, wherein the boundary value set includes the upper and lower limits of all range intervals in the target node. Rules in the target node whose corresponding range intervals fall to the left of the target boundary value are assigned to the first child node, rules in the target node whose corresponding range intervals fall to the right of the target boundary value are assigned to the second child node, and rules in the target node whose corresponding range intervals cross the target boundary value are assigned to both the first and second child nodes.

[0146] In this embodiment, when using geometric space cutting, a target boundary value needs to be selected as the cutting point. This can be determined using the method described in the relevant embodiment of step 506. Specifically, the set of boundary values ​​for the range fields corresponding to all rules in the target node is determined. The maximum and minimum boundary values ​​are removed from this set to obtain a processed boundary value set. The upper limit value in the processed boundary value set is increased by a first preset value, and the lower limit value in the candidate boundary value set is decreased by a second preset value to obtain a candidate boundary value set. For each candidate boundary value in the candidate boundary value set, the number of first rules falling to the left of the candidate boundary value, the number of second rules falling to the right of the candidate boundary value, and the number of third rules crossing the candidate boundary value are counted. Based on the second difference between the number of first and second rules, and the number of third rules, a second measurement value corresponding to the candidate boundary value is determined. The second measurement value is positively correlated with the absolute value of the second difference and the number of third rules. The candidate boundary value with the smallest corresponding second measurement value in the candidate boundary value set is determined as the target boundary value.

[0147] First, all rules are projected onto each range field, resulting in a boundary value set of M (where M is a positive integer) for each range field. The minimum and maximum values ​​are removed from these M boundary values, resulting in a processed boundary value set containing M-2 boundary values. Assume the first and second preset values ​​are both 1. The upper limits of the processed boundary value set are incremented by 1, and the lower limits are decremented by 1 to optimize these M-2 boundary values, resulting in a candidate boundary value set. This reduces the rule boundary duplication problem caused by directly cutting boundary values. Then, the merits of these M-2 cut points are evaluated based on the rule duplication rate. The evaluation criteria include the balance of the two resulting child nodes and the duplication rate caused by cutting that point. This evaluation is performed across multiple range fields of all rules to determine the optimal cut point and cut field.

[0148] Taking the target node formed by the rule set shown in Table 3 below as an example, the process of selecting the cutting point in the geometric space cutting process is explained:

[0149] Table 3 Examples of Geometric Space Cutting

[0150]

[0151] Suppose we have four rules as shown in Table 3, and these rules contain only one range field. First, we obtain their boundary value set as: 1, 7, 20, 61, 50, 100, 200, 255, a total of eight boundary values. Since the minimum and maximum values ​​cannot distinguish these four rules, we remove the minimum and maximum values, resulting in six processed boundary values. We then optimize these six points by subtracting 1 from the lower limit and adding 1 to the upper limit of the processed boundary values, thus obtaining the candidate boundary value set as: 8, 19, 62, 49, 101, 199.

[0152] Then, the absolute value of the second difference can be summed with the number of third rules to characterize the second metric. The cutting effect of these 6 points is evaluated according to formula (2), and an optimal cutting point is finally selected. The second metric characterizes the balance and replication rate of the left and right child nodes when the v-th candidate boundary value is used as the cutting point, and the optimal cutting point is selected based on the ratio of m... r (v) The smallest candidate boundary value is used as the target boundary value of the cutting point.

[0153] After determining the target boundary value, the target boundary value is used as the cutting point in the geometric space, dividing the range field of the target node into two parts, assuming they are called the left and right intervals. The rules of the target node whose corresponding range interval falls into the left interval are assigned to the first child node, and the rules of the target node whose corresponding range interval falls into the right interval are assigned to the second child node. The rules of the target node whose corresponding range interval crosses the target boundary value are assigned to both the first and second child nodes, completing one cut of the target node. Taking Table 3 as an example, according to formula (2), the m of these 6 points is calculated. r The (v) values ​​are 2, 2, 1, 2, 2, 2. Therefore, "62" can be selected as the target boundary value and the cut point. In this case, the left child node can contain rules: R1, R2, R3, and the right child node can contain rules: R3, R4, where rule R3 produces a copy.

[0154] In one embodiment, taking the rule example in Table 2 above as an example, in the above example, if the preset quantity BINTH value is 1, then Figure 6 The leaf nodes in the code need to be further chopped. For example... Figure 7 The image shows a schematic diagram of the tree construction result when the preset number of BINTH values ​​is 1:

[0155] In the first cut, node 0, which contains all the rules in Table 2, is taken as the target node. The third bit in field 1 (counting from the left of the field in Table 2) is selected as the target bit, generating node 2 and node 1. The rules included in node 1 are: R1, R2, R3, R5, and R7. The rules included in node 2 are: R4, R6, and R8.

[0156] The second cut takes intermediate node 1 as the target node and selects the second bit in field 1 as the target bit. It then cuts intermediate node 1 further, resulting in nodes 3 and 4. Node 3 includes rules R3 and R5. Node 4 includes rules R1, R2, and R7. Simultaneously, intermediate node 2 is taken as the target node, and the fifth bit in field 1 is selected as the target bit. It then cuts intermediate node 2 further, resulting in nodes 5 and 6. Node 5 includes rule R8. Node 5 is a leaf node. Node 4 includes rules R4 and R6 and is an intermediate node.

[0157] The third cut takes intermediate node 1 as the target node, selects the first bit in field 1 as the target bit, and continues cutting intermediate node 3 to obtain nodes 7 and 8. Node 7 includes rule R5 and is a leaf node. Node 8 includes rule R3 and is a leaf node. Simultaneously, taking intermediate node 2 as the target node, selects the first bit in field 2* as the target bit and continues cutting intermediate node 4 to obtain nodes 9 and 10. Node 9 includes rule R7 and is a leaf node. Node 10 includes rules R1 and R2 and is an intermediate node. Simultaneously, taking intermediate node 2 as the target node, selects the first bit in field 2* as the target bit and continues cutting intermediate node 6 to obtain nodes 11 and 12. Node 11 includes rule R4 and is a leaf node. Node 12 includes rule R6 and is a leaf node.

[0158] When only rules R1 and R2 remain in node 10, fields 1 and 2* can no longer provide effective distinguishing information. In fact, these two rules do not overlap in field 2 and can be distinguished. However, due to the aforementioned expansion of the range interval, 112:123 is expanded to 112:127, causing rule R2 to completely cover rule R1. At this point, a geometric space cutting scheme should be used, with position 124 in field 2 as the cutting point. Rule R1, with a range interval greater than 124, is assigned to node 13, and rule R2, with a range interval less than or equal to 124, is assigned to node 14. Nodes 13 and 14 are both leaf nodes. The result is as follows... Figure 7 As shown in the dashed box in Table 2. At this point, the decision tree for the rule set in Table 2 is complete.

[0159] Step 508: Map the target node into two child nodes using bit splitting to generate the decision tree corresponding to the set of rules to be processed.

[0160] In this step, if the range field does not exist in the set of rules to be processed, or if the range field exists but the replication rate of the first rule is less than a preset threshold, then bit-based segmentation can be prioritized to segment the target node. Since the range field has been converted into a mask, bit-based segmentation is no longer limited by the range field. During the bit-based segmentation process, an optimal bit is selected each time to map all rules in the target node to two child nodes. The optimal bit should consider the balance of the two resulting child nodes and the replication rate caused by the segmentation. Then, it is determined whether the number of rules in the tree node is less than or equal to the preset leaf node rule threshold BINTH. If so, a leaf node is constructed; otherwise, the bit selection process is repeated to finally construct a hierarchical decision tree. The bit-based segmentation process can be referred to the description of the aforementioned related embodiments, and will not be repeated here.

[0161] The aforementioned decision tree generation method sets the rule replication rate of the target node to an adjustable preset threshold, between 0 and 1. The algorithm prioritizes bit splitting to avoid the massive computational burden of premature geometric space splitting. Simultaneously, it monitors the rule replication status of the node during each split. When the node replication rate is greater than or equal to the preset threshold, geometric space splitting is activated. Clearly, when the preset threshold is set to 1, geometric space splitting is only activated after all valid bits have participated in the splitting (see [link to relevant documentation]). Figure 7 (The tree construction process). This setting results in faster node cutting and is suitable for large rule sets. When the threshold is set to 0, each node evaluates the merits of bit cutting and geometric space cutting to select the optimal cutting method. This setting generates a better tree structure but takes longer and is suitable for small rule sets.

[0162] The decision tree generation method of this application embodiment can not only be used to build a tree directly on the original rule set, but also applied to the rule subset generated after the original rule set is divided into rules, and to the root node generated by building a jump table on the rule set. The tree building method of this embodiment will further improve the tree building effect.

[0163] Please refer to Figure 8 This is a message processing method according to an embodiment of this application, which can be performed by... Figure 2 The electronic device 1 shown is used to perform this action and can be applied to... Figures 3 to 4 In the application scenario of decision tree generation shown, the appropriate cutting method is adaptively selected to cut nodes during the tree construction process. This method is suitable for building decision trees from rule sets containing various fields, improving the speed and efficiency of rule set tree construction, and reducing storage resource consumption. This embodiment uses terminal 220 as the execution end as an example. Compared with the previous embodiment, this embodiment uses a message processing scenario as an example. The method includes the following steps:

[0164] Step 801: Receive message data to be processed.

[0165] Step 802: Classify the message data using a preset decision tree, and determine the target rule in the decision tree that matches the message data and has the highest priority. The preset decision tree is generated using the method described in any of the above embodiments.

[0166] Step 803: Perform the corresponding action processing on the message data according to the action instructions of the target rule.

[0167] In this embodiment, a decision tree can be generated using the method described in any of the preceding embodiments. In addition to storing necessary information about the child node index, each tree node also stores the cutting method and cutting bits (cutting points) used by that node. The input message starts from the root node and traverses the tree hierarchically according to the bits used for node cutting or the cutting points of a certain field until a leaf node is reached. In a decision tree, a message can find one and only one matching leaf node. This leaf node stores no more than BINTH rules, and performs bit-by-bit matching on the mask field and interval matching on the range field of all rules. It then returns the rule with the highest priority that successfully matches the message. Based on the action instructions of this rule, corresponding actions are taken to process the message data. This improves the processing efficiency of message data.

[0168] For details of each step of the above message processing method, please refer to the relevant descriptions of the foregoing embodiments, which will not be repeated here.

[0169] Please refer to Figure 9 This is a decision tree generation device 900 according to an embodiment of this application, which can be applied to... Figure 1 The electronic device 1 shown can be applied to... Figures 3 to 4 In the application scenario of decision tree generation shown, the appropriate cutting method is adaptively selected to cut nodes during the tree construction process. This is suitable for building decision trees from rule sets containing various fields, improving the speed and efficiency of rule set tree construction, and reducing storage resource consumption. The device includes: a detection module 901, a transformation module 902, a first determination module 903, a judgment module 904, a second determination module 905, and a cutting module 906. The functional principles of each module are as follows:

[0170] The detection module 901 is used to detect whether a range field exists in the rule set to be processed when a rule set to be processed is received.

[0171] The conversion module 902 is used to convert the range field into a mask form if there is a range field in the rule set to be processed, so as to obtain the preprocessed rule set.

[0172] The first determining module 903 is used to determine the first rule replication rate corresponding to the bit cutting method when cutting the target node in the preprocessed rule set.

[0173] The judgment module 904 is used to determine whether the replication rate of the first rule is greater than or equal to the preset threshold.

[0174] The second determining module 905 is used to determine the second rule replication rate when the target node is cut based on the range field using the geometric space cutting method if the first rule replication rate is greater than or equal to a preset threshold.

[0175] The cutting module 906 is used to determine the target cutting method applicable to the target node based on the replication rate of the first rule and the replication rate of the second rule, and to cut the corresponding target node into two child nodes using the target cutting method, and to generate a decision tree corresponding to the set of rules to be processed based on the cutting result.

[0176] In one embodiment, the conversion module 902 is used to expand the range field in the rule set to be processed into a target range range that includes the original range interval defined by the range field and can be represented in the form of a mask, and to represent the target range range in the form of a mask.

[0177] In one embodiment, the first determining module 903 is used to convert all fields of the rules in the target node into a bit string, and determine the target bit position as the bit cutting point in the bit string. The number of first wildcards located at the target bit position in the bit string is counted, and the ratio of the number of first wildcards to the number of all rules in the target node is determined as the first rule replication rate.

[0178] In one embodiment, the first determining module 903 is configured to: determine the set of candidate bits that have not been used as cut points in the rules for counting the target node in the bit string; determine a first difference between the number of rules where each candidate bit is "1" and the number of rules where each candidate bit is "0"; and count the number of second wildcards located at each candidate bit in the bit string. Based on the first difference and the number of second wildcards, a first measure value is determined for the corresponding candidate bit, wherein the first measure value is positively correlated with the absolute value of the first difference and the number of second wildcards. The candidate bit with the smallest first measure value in the candidate bit set is determined as the target bit.

[0179] In one embodiment, the second determining module 905 is used to determine the boundary value set of all rules corresponding to the range fields in the boundary value set of the target node. The boundary value set includes the upper and lower limits of all range intervals in the target node. Target boundary values ​​are selected from the boundary value set as geometric space cutting points. The ratio of the number of rules whose range intervals in the target node cross the target boundary value to the total number of rules in the target node is determined as the second rule replication rate.

[0180] In one embodiment, the second determining module 905 is used to remove the maximum and minimum boundary values ​​from the boundary value set to obtain a processed boundary value set. The upper limit value in the processed boundary value set is increased by a first preset value, and the lower limit value in the candidate boundary value set is decreased by a second preset value to obtain a candidate boundary value set. For each candidate boundary value in the candidate boundary value set, the number of first rules falling to the left of the candidate boundary value, the number of second rules falling to the right of the candidate boundary value, and the number of third rules crossing the candidate boundary value are counted for the corresponding range interval in the target node. Based on the second difference between the number of first rules and the number of second rules, and the number of third rules, a second measurement value corresponding to the candidate boundary value is determined. The second measurement value is positively correlated with the absolute value of the second difference and the number of third rules. The candidate boundary value with the smallest corresponding second measurement value in the candidate boundary value set is determined as the target boundary value.

[0181] In one embodiment, the cutting module 906 is used to determine whether the first rule replication rate is less than the second rule replication rate. If the first rule replication rate is less than the second rule replication rate, a bit-based cutting method is used to map the target node into two child nodes. If the first rule replication rate is greater than the second rule replication rate, a geometrical cutting method is used to map the target node into two child nodes. Alternatively, if the first rule replication rate is equal to the second rule replication rate, a target cutting method is randomly determined from the bit-based cutting method and the geometrical cutting method.

[0182] In one embodiment, the target node is segmented into a first child node and a second child node. The segmentation module 906 is used to convert all fields of the rules in the target node into a bit string, and determine the target bit position as the bit segmentation point within the bit string. Rules in the target node that are "0" at the target bit position are assigned to the first child node, rules in the target node that are "1" at the target bit position are assigned to the second child node, and rules in the target node that are wildcards at the target bit position are assigned to both the first and second child nodes.

[0183] In one embodiment, the target node is segmented into a first child node and a second child node. The segmentation module 906 is used to determine the boundary value set of all rules corresponding to the range fields in the boundary value set of the target node, and to select target boundary values ​​from the boundary value set as geometric space segmentation points. The boundary value set includes the upper and lower limits of all range intervals in the target node. Rules whose corresponding range intervals in the target node fall to the left of the target boundary value are assigned to the first child node; rules whose corresponding range intervals in the target node fall to the right of the target boundary value are assigned to the second child node; and rules whose corresponding range intervals in the target node cross the target boundary value are assigned to both the first and second child nodes.

[0184] In one embodiment, the cutting module 906 is further configured to map the target node into two child nodes by bit cutting if there is no range field in the rule set to be processed, or if the replication rate of the first rule is less than a preset threshold, thereby generating a decision tree corresponding to the rule set to be processed.

[0185] For a detailed description of the decision tree generation device 900 described above, please refer to the description of the relevant method steps in the above embodiments. The implementation principle and technical effect are similar, and will not be repeated here in this embodiment.

[0186] Figure 10 This is a schematic diagram of the structure of a cloud device 100 provided as an exemplary embodiment of this application. The cloud device 100 can be used to run the methods provided in any of the above embodiments. Figure 10 As shown, the cloud device 100 may include: a memory 1004 and at least one processor 1005. Figure 10 Let's take a processor as an example.

[0187] The storage device 1004 is used to store computer programs and can be configured to store various other data to support operations on the cloud device 100. The storage device 1004 may be object storage (OSS).

[0188] The memory 1004 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0189] The processor 1005, coupled to the memory 1004, is used to execute the computer program in the memory 1004 to implement the solution provided in any of the above method embodiments. The specific functions and technical effects that can be achieved will not be described here.

[0190] Furthermore, such as Figure 10 The cloud device also includes other components such as firewall 1001, load balancer 1002, communication component 1006, and power supply component 1003. Figure 10 The diagram only shows some components and does not mean that cloud devices only include... Figure 10 The components shown.

[0191] In one embodiment, the above Figure 10The communication component 1006 is configured to facilitate wired or wireless communication between the device containing the communication component 1006 and other devices. The device containing the communication component 1006 can access wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G, LTE (Long Term Evolution), 5G, or combinations thereof. In one exemplary embodiment, the communication component 1006 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component 1006 also includes a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wide Band (UWB), Bluetooth, and other technologies.

[0192] In one embodiment, the above Figure 10 The power supply component 1003 provides power to various components of the device in which it resides. The power supply component 1003 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply component resides.

[0193] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the method of any of the foregoing embodiments.

[0194] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the method of any of the foregoing embodiments.

[0195] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed.

[0196] The integrated modules described above, implemented as software functional modules, can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods of the various embodiments of this application.

[0197] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor. The memory may include high-speed RAM (Random Access Memory), and may also include non-volatile memory (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk, or optical disc, etc.

[0198] The aforementioned storage media can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage media can be any available medium accessible to general-purpose or special-purpose computers.

[0199] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. Both the processor and the storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and storage medium can exist as discrete components in an electronic device or host device.

[0200] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0201] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0202] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods of the various embodiments of this application.

[0203] The collection, storage, use, processing, transmission, provision, and disclosure of user data and other information involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0204] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A method for generating decision trees, characterized in that, The method includes: When a set of rules to be processed is received, it is checked whether a range field exists in the set of rules to be processed; If the set of rules to be processed contains a range field, the range field is converted into a mask form to obtain the preprocessed rule set. For the target node to be cut in the preprocessed rule set, determine the first rule replication rate corresponding to cutting the target node using the bit cutting method; Determine whether the replication rate of the first rule is greater than or equal to a preset threshold; If the first rule replication rate is greater than or equal to the preset threshold, determine the second rule replication rate corresponding to the use of geometric space cutting to cut the target node based on the range field. Based on the first rule replication rate and the second rule replication rate, a target cutting method applicable to the target node is determined, and the target node is cut into two child nodes using the target cutting method. Based on the cutting result, a decision tree corresponding to the set of rules to be processed is generated. The determination of the first rule replication rate corresponding to the bit-cutting method for the target node includes: Convert all fields of the rules in the target node into a bit string, and determine the target bit bit as the bit cutting point in the bit string; The number of first wildcards located at the target bit position in the bit string is counted, and the ratio of the number of first wildcards to the total number of rules in the target node is determined as the first rule replication rate; The determination of the second rule replication rate corresponding to cutting the target node based on the range field using the geometric space cutting method includes: Determine the set of boundary values ​​for the range fields corresponding to all rules in the target node, wherein the set of boundary values ​​includes the upper and lower limits of all range intervals in the target node; Select the target boundary value as the geometric space cutting point from the set of boundary values; The second rule replication rate is determined by the ratio of the number of rules in the target node whose range spans the target boundary value to the total number of rules in the target node.

2. The method according to claim 1, characterized in that, The step of converting the range field into a mask format includes: The range field in the set of rules to be processed is expanded to include the original range interval defined by the range field and the target range interval that can be represented in mask form, and the target range interval is represented in mask form.

3. The method according to claim 1, characterized in that, The step of determining the target bit position as the bit cutting point in the bit string includes: The set of candidate bits that have not been used as cutting points in the rules of the target node is counted according to the bit string, and the first difference between the number of rules with each candidate bit being "1" and the number of rules with each candidate bit being "0" is determined, and the number of second wildcards located in each candidate bit in the bit string is counted. Based on the first difference and the number of second wildcards, a first measure value corresponding to the candidate bit is determined. The first measure value is positively correlated with the absolute value of the first difference and the number of second wildcards. The candidate bit with the smallest first metric value in the candidate bit set is determined as the target bit.

4. The method according to claim 1, characterized in that, The step of selecting the target boundary value as the geometric space cutting point from the set of boundary values ​​includes: Remove the maximum and minimum boundary values ​​from the boundary value set to obtain the processed boundary value set; The upper limit value in the processed boundary value set is increased by a first preset value, and the lower limit value in the processed boundary value set is decreased by a second preset value to obtain a candidate boundary value set. For each candidate boundary value in the candidate boundary value set, the number of first rules in the target node whose corresponding range interval falls to the left of the candidate boundary value, the number of second rules whose corresponding range interval falls to the right of the candidate boundary value, and the number of third rules whose corresponding range interval crosses the candidate boundary value are counted respectively. Based on the second difference between the first number of rules and the second number of rules, and the third number of rules, a second measurement value corresponding to the candidate boundary value is determined. The second measurement value is positively correlated with the absolute value of the second difference and the third number of rules. The candidate boundary value with the smallest corresponding second metric value in the candidate boundary value set is determined as the target boundary value.

5. The method according to claim 1, characterized in that, The step of determining a target cutting method applicable to the target node based on the first rule replication rate and the second rule replication rate, and cutting the corresponding target node into two child nodes using the target cutting method, includes: Determine whether the replication rate of the first rule is less than the replication rate of the second rule; If the replication rate of the first rule is less than the replication rate of the second rule, the target node is mapped into two child nodes using a bit splitting method. If the replication rate of the first rule is greater than the replication rate of the second rule, the target node is mapped into two child nodes using a geometric space cutting method. Alternatively, if the first rule replication rate is equal to the second rule replication rate, a target cutting method is randomly determined from the bit cutting method and the geometric space cutting method.

6. The method according to claim 5, characterized in that, The target node is divided into a first child node and a second child node; the bit-splitting method used to map the target node into two child nodes includes: Convert all fields of the rules in the target node into a bit string, and determine the target bit bit as the bit cutting point in the bit string; The rules in the target node that are "0" at the target bit position are assigned to the first child node, the rules in the target node that are "1" at the target bit position are assigned to the second child node, and the rules in the target node that are wildcards at the target bit position are assigned to both the first child node and the second child node.

7. The method according to claim 5, characterized in that, The target node is cut into a first child node and a second child node; the process of mapping the target node into two child nodes using a geometric space cutting method includes: Determine the set of boundary values ​​for the range fields corresponding to all rules in the target node, and select the target boundary values ​​from the set of boundary values ​​as geometric space cutting points, wherein the set of boundary values ​​includes the upper and lower limits of all range intervals in the target node; The rule that the corresponding range interval in the target node falls to the left of the target boundary value is assigned to the first child node, the rule that the corresponding range interval in the target node falls to the right of the target boundary value is assigned to the second child node, and the rule that the corresponding range interval in the target node crosses the target boundary value is assigned to both the first child node and the second child node.

8. The method according to claim 1, characterized in that, Also includes: If the range field does not exist in the set of rules to be processed, or if the replication rate of the first rule is less than the preset threshold, the target node is mapped into two child nodes by bit splitting to generate a decision tree corresponding to the set of rules to be processed.

9. A message processing method, characterized in that, The method includes: Receive message data to be processed; The message data is classified using a preset decision tree to determine the target rule in the decision tree that matches the message data and has the highest priority. According to the action instructions of the target rule, the corresponding action processing is performed on the message data; The preset decision tree is generated using the method described in any one of claims 1-8 above.

10. A decision tree generation device, characterized in that, The device includes: The detection module is used to detect whether a range field exists in the rule set to be processed when a rule set to be processed is received. The conversion module is used to convert the range field into a mask form if the rule set to be processed contains a range field, so as to obtain the preprocessed rule set. The first determining module is used to determine the first rule replication rate corresponding to cutting the target node using the bit cutting method for the target node to be cut in the preprocessed rule set; The judgment module is used to determine whether the replication rate of the first rule is greater than or equal to a preset threshold. The second determining module is used to determine the second rule replication rate when cutting the target node based on the range field using the geometric space cutting method if the first rule replication rate is greater than or equal to the preset threshold. The cutting module is used to determine the target cutting method applicable to the target node based on the first rule replication rate and the second rule replication rate, and to cut the corresponding target node into two child nodes using the target cutting method, and to generate a decision tree corresponding to the set of rules to be processed based on the cutting result; The first determining module is used to convert all fields of the rules in the target node into a bit string, determine the target bit position as the bit cutting point in the bit string, count the number of first wildcards located at the target bit position in the bit string, and determine the first rule replication rate by the ratio of the number of first wildcards to the number of all rules in the target node. The second determining module is used to determine the set of boundary values ​​of the range fields corresponding to all rules in the target node, the set of boundary values ​​including the upper limit and lower limit of all range intervals in the target node; select the target boundary value as the geometric space cutting point from the set of boundary values; and determine the second rule replication rate as the ratio of the number of rules in the target node whose range intervals cross the target boundary value to the total number of rules in the target node.

11. An electronic device, characterized in that, include: At least one processor; as well as A memory that is communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, cause the electronic device to perform the method according to any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, implement the method as described in any one of claims 1-9.

Images