Stream-based local message classification method and device

Abstract

The invention discloses a flow-based local message classification method and device, and relates to the field of message classification, and the method comprises the steps: carrying out the parallel comparison of a keyword of a to-be-classified message with a keyword temporarily stored in a shift register, obtaining a comparison result, and generating an index matching result through an arbiter according to the comparison result; according to the locality principle of a message flow, historically queried table item information is cached into a dynamic cache table, an arbiter arbitrates a comparison result of a shift register, calculates an offset address of the dynamic cache table and obtains a matching result, and whether an original rule table needs to be queried and whether a dynamic cache table memory needs to be updated are determined according to a search result. Under the condition that the matching is unsuccessful, the dynamic cache table memory can guide the same message to directly use the offset address to obtain the table item information in the next search without searching from an original rule table, so that the hit rate is increased, the matching efficiency is improved, and the storage resources are saved.

Description

Technical Field

[0001] The present application relates to the technical field of message classification, and more specifically, to a flow-based local message classification method and device. Background Art

[0002] Linear search uses the simplest linear table data structure to store the rule sets in order of priority. In implementation, the five-tuple information is compared with the rule table items in turn until a rule that hits all matching domains is found. The advantages of this algorithm are that the preprocessing data structure is simple, the implementation is simple, and one rule occupies one table item space, with high storage utilization. However, the time required for message classification using this algorithm increases linearly with the increase of the rule set, and the space occupancy also increases linearly with the increase of the rule set. For N rule sets, in the worst case, the time complexity and space complexity are O(N) and O(NW), respectively. At present, based on the traditional linear search, combined with the advantages of FPGA parallelism and pipeline, a multi-way parallel linear search is designed, which can reduce the time complexity to O(N / m), but in principle, it is impossible to avoid the problem of having to traverse all table items in the linear search algorithm. Based on this, the present invention proposes a search structure for optimizing the locality of the flow. By utilizing the local characteristics of the flow, IPv4 packets with the same five-tuple do not need to traverse all rule tables in a short period of time, but instead search the cache table generated by the results of the previous dozens of queries. The size of the cache table is much smaller than the rule table, which can reduce the search time to a certain extent and improve the classification speed.

[0003] At the same time, the existing rule matching methods have technical defects such as being based on static random access memory, requiring multiple jumps, having large delays, or being based on static random access memory arrays, but having large storage areas and being unable to be used for data plane operations. Summary of the invention

[0004] In response to at least one defect or improvement need in the prior art, the present invention provides a flow-based local message classification method and device, which solves the defects of the prior art, designs a first-level search structure through the principle of flow locality, reduces message search time, increases message classification speed, and greatly improves message classification efficiency.

[0005] To achieve the above object, according to a first aspect of the present invention, a flow-based local message classification method is provided, comprising:

[0006] The shift register compares the keyword information of the message to be classified with the storage table entry information to obtain a comparison result, wherein the storage table entry information is the historical query table entry information cached in the dynamic cache table;

[0007] The arbitrator receives the comparison result and generates an index matching result; if the index matching is successful, the lowest index is obtained and the table item result of the dynamic cache table is indexed to complete the query; wherein the lowest index is the message most recently searched;

[0008] If the index does not match successfully, a search is performed in the original rule table, the search result is output, and the current query table item information is updated to the dynamic cache table to complete the query.

[0009] Furthermore, the dynamic cache table includes table entries read from the original rule set and the number of times the table entries are used.

[0010] Further, the updating of the current query table item information to the dynamic cache table includes:

[0011] According to the index number of the current query table item information, the corresponding table item information in the dynamic cache table is updated to the current query table item information;

[0012] The usage count of the entry is increased by 1 and updated to the next address of the corresponding address in the dynamic cache table.

[0013] Furthermore, the method further includes: the search result includes a corresponding bit of the current query table entry in the shift register and an index in the dynamic table memory.

[0014] Furthermore, the dynamic cache table uses a first-in-first-out strategy to update the entry information.

[0015] According to a second aspect of the present invention, there is also provided a flow-based local message classification device, comprising a plurality of shift registers, an arbitrator and a dynamic cache table memory arranged in an FPGA;

[0016] The shift register is used to compare the keyword information of the message to be classified with the storage table item information to obtain a comparison result, wherein the storage table item information is the historical query table item information cached in the dynamic cache table;

[0017] The arbitrator is used to receive the comparison result and generate an index matching result; if the index matching is successful, the lowest index is obtained and the table item result of the dynamic cache table is indexed to complete the query; wherein the lowest index is the message most recently searched;

[0018] If the index does not match successfully, a search is performed in the original rule table, the search result is output, and the current query table item information is updated to the dynamic cache table to complete the query.

[0019] Furthermore, the number of shift registers is specifically set as follows:

[0020]

[0021] Among them, T Consume is the number of shift registers; T MinPacket The time it takes to write an entry into the cache table. It is the time it takes to process the shortest 64-byte Ethernet frame at line speed.

[0022] Furthermore, it also includes a comparison set storage for storing the index matching results.

[0023] Furthermore, the value of each bit in the comparison set memory indicates whether the five-tuple information of the current search message successfully matches the five-tuple value of the stored table entry information, and is determined to be 1 when the match is successful, and is determined to be 0 when the match is not successful.

[0024] According to a third aspect of the present invention, there is further provided a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned flow-based local message classification method when running.

[0025] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects compared with the prior art:

[0026] (1) The present invention provides a flow-based local message classification method. The flow-based local message classification method provided by the present invention solves the problems that the existing rule matching method is based on static random access memory, which requires multiple jumps and has a large delay, or is based on a static random access memory array, but has a large storage area and cannot be used for data plane operations. According to the local characteristics between message flows, the keywords of the message to be classified are compared in parallel with the keywords temporarily stored in the shift register to obtain a comparison result, and the arbitrator generates an index matching result according to the comparison result; according to the local principle of the message flow, the table item information of the historical query is cached in In the dynamic cache table, the arbitrator compares the results of the arbitration shift register, calculates the offset address of the dynamic cache table and obtains the matching result, and determines whether it is necessary to query the original rule table and whether it is necessary to update the dynamic cache table memory based on the search result. In the case of unsuccessful matching, the dynamic cache table memory can guide the same message to directly use its offset address to obtain the table entry information in the next search without searching from the original rule table. This can improve the hit rate of access rules, improve matching efficiency, save storage resources, and reduce processing delays, so as to reduce classification delays, simplify design, reduce implementation costs, and realize real-time high-speed service classification of the data message plane.

[0027] (2) The present invention provides a message classification device based on flow locality. In the traditional TCAM, a dynamic table cache mechanism is adopted, that is, according to the flow query result, the flow table entry information is dynamically updated to the dynamic table. When an SRAM conflict occurs, the LRU minimum recently used replacement algorithm is used in the dynamic table to reduce the SRAM conflict and improve the hit efficiency of the table item, that is, to improve the flow classification matching rate. In terms of implementation, an FPGA implementation scheme is used to improve efficiency and reduce hardware resource costs. Only an arbitrator, a part of the memory, an index table and a shift register are required in hardware. Based on the locality of the flow, the present invention uses a cache mechanism to solve the SRAM conflict, while reducing the storage depth requirements of the TCAM, saving TCAM resources and chip area. The cache table entry update only retains the longest access sequence according to the comparison result, with small resource occupation, solving the problem of low SRAM conflict efficiency during flow classification, reducing hardware TCAM overhead, and improving the TCAM search rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0029] Figure 1 A flowchart of an optional flow-based local message classification method provided in an embodiment of the present application;

[0030] Figure 2 A schematic diagram of the structure of the basic model of message classification provided in the embodiment of the present application;

[0031] Figure 3 A structural schematic diagram of a flow locality principle provided in an embodiment of the present application;

[0032] Figure 4 A flow chart of a flow-based local processing provided in an embodiment of the present application;

[0033] Figure 5 A schematic diagram of a structure of offset address calculation and cache table update position provided in an embodiment of the present application;

[0034] Figure 6 A structural schematic diagram of the detailed internal design of a locally optimized search structure provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0036] The terms "first", "second", "third", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0037] According to one aspect of the embodiments of the present application, a flow-based local message classification method is provided. Figure 1 The present invention describes a flow-based local message classification method provided in an embodiment of the present application.

[0038] Figure 1 is a flow chart of an optional flow-based local message classification method provided in an embodiment of the present application, such as Figure 1 As shown, the process of the method may include the following steps:

[0039] S102, the shift register compares the keyword information of the message to be classified with the storage entry information to obtain a comparison result, wherein the storage entry information is the historical query entry information cached in the dynamic cache table.

[0040] The keyword information may be, for example, a quintuple, a triplet, or a Hash value corresponding thereto, etc. The stored entry information is all the historically queried entry information cached in the dynamic cache table.

[0041] S104, the arbitrator receives the comparison result and generates an index matching result; if the index matching is successful, the lowest index is obtained and the table entry result of the dynamic cache table is indexed to complete the query.

[0042] The lowest index is the message most recently searched.

[0043] S106, when the index is not successfully matched, search is performed in the original rule table, the search result is output, and the current query table item information is updated to the dynamic cache table to complete the query.

[0044] Further, the dynamic cache table includes the table items read from the original rule set and the number of times the table items are used; and the updating of the current query table item information to the dynamic cache table includes:

[0045] According to the index number of the current query table item information, the corresponding table item information in the dynamic cache table is updated to the current query table item information;

[0046] The usage count of the entry is increased by 1 and updated to the next address of the corresponding address in the dynamic cache table.

[0047] The search result includes the corresponding bit of the current query table entry in the shift register and the index in the dynamic table memory.

[0048] like Figure 1 As shown, the present invention can be applied to a forwarding engine in a message classification model, and can be arranged at the previous level of message classification in the forwarding engine.

[0049] Specifically, the principle of flow locality means that in most actual network application services, the data packets of a flow have continuity during the transmission process, that is, after the first data packet of a flow arrives, the data packets that arrive shortly afterwards are also likely to belong to the flow. Figure 3 As shown in the figure, there are many data packets on the line in a short period of time, but in fact there are only two flows (with two different five-tuple information), and the multiple data packets received continuously belong to the same flow. Figure 4 As shown, the search structure for optimizing the locality of flows in the locality-based message classification method of flows proposed by the present invention includes a shift register with a width of M bits, an arbiter and a cache table.

[0050] The specific search process is:

[0051] First, the quintuple to be searched is sent to M shift registers for parallel comparison to generate an M-bit comparison result register. The shift register stores the quintuple information of the M messages previously searched. The value of each bit in the result register indicates whether the quintuple of the current searched message matches the quintuple value of the previous message. "1" represents a successful match and "0" represents a failed match. A successful match means that the message has been processed before.

[0052] Then the M-bit result register is sent to the arbiter to obtain the lowest index in the result register (the lowest index represents the most recent identical message).

[0053] If there is no lowest index, the rule table is searched. Otherwise, the lowest index is used to calculate the corresponding offset address to access the cache table. The cache table stores the rule table entry R1 read from the rule set and the number of times the entry is used. After the entry is successfully matched, the number of times the entry is used is increased by 1 and updated to the next address of the cache table, and the result is output to complete a query.

[0054] like Figure 4 As shown, another aspect of the present invention provides a flow-based local message classification device, including a plurality of shift registers (Shift Register), an arbiter (Arbiter) and a dynamic cache table memory (Dynamic cache memory) arranged in an FPGA.

[0055] A shift register is used to compare the five-tuple information of the message to be classified with the stored table entry information to obtain a comparison result, wherein the stored table entry information is the table entry information of the most recent query cached in the dynamic cache table memory;

[0056] An arbiter is used to receive the comparison result and generate an index matching result; if the match is successful, the current query table item information is updated to the dynamic cache table; if the match is not successful, the dynamic cache table is searched and matched according to the offset address of the dynamic cache table to obtain the search result;

[0057] If the table entry is found, the search result is output and the query is completed; if the table entry is not found, the original rule table (ORIGINAL TABLE) is searched according to the index of the dynamic cache table, the search result is output, and the current query table entry information is updated to the dynamic cache table to complete the query.

[0058] Preferably, a comparison set memory is also included, for storing the index matching results.

[0059] Preferably, the number of the shift registers is specifically set as follows:

[0060]

[0061] Where M is the number of shift registers; T Consume The time it takes to write an entry into the cache table; T MinPacket It is the time required to process the shortest 64-byte Ethernet frame at line speed.

[0062] Preferably, the fixed order shift register of the dynamic cache table memory is stored in the shift register, which reduces the resource usage, realizes the fragmentation processing of the message, and ensures that the message with a flow length of 1 can be classified in each clock cycle, thereby reducing the delay and improving the performance; through the design of the arbitrator, when the cache rules and resources are limited, a first-in-first-out working mode is adopted to ensure the search rate; through the design of the dynamic cache table memory, when the cache rule capacity is limited, the most recently used rules can be cached, thereby ensuring that the message with a flow length of 1 can find the table entry in each clock cycle, effectively reducing the delay.

[0063] In an optional embodiment, the number of shift registers M is set to ensure that the time T from when a message sends a query table instruction to when the table entry is written into the cache table is Consume The message is still in the shift register, that is, the table lookup instruction will not be sent repeatedly.

[0064] M roughly satisfies the relationship (1),

[0065]

[0066] Among them, T MinPacket It is the time required to process the shortest 64-byte Ethernet frame at line speed.

[0067] In this embodiment, if Figure 5 As shown, the number of shift calculators M is 4, and the cache table can store 4 query results. The cache table has two pointers, namely, the update position pointer Ptraddr and the read entry pointer Ptrread. In the initial state, both Ptraddr and Ptrread point to address 0.

[0068] ① In the first search, the five-tuple of the four shift registers is empty (default is 0), no register matches H1, and a two-bit set {0,0} is returned, where the first bit of the set is valid, representing the valid bit, "1" represents the lowest index, "0" represents the absence, and the second bit is index, representing the lowest index obtained, in the range of [0,M-1]. In the example, there is no hit in the first search, and after accessing the dynamic rule table, the table entry information is updated to the address 0 pointed to by Ptraddr, and then Ptraddr is increased by 1;

[0069] ② During the second search, H2 matches the shift register after the first search in parallel. There is also no hit. The entry information after the search rule set is written to the address 1 pointed to by Ptraddr, and then Ptraddr is increased by 1;

[0070] ③ During the third search, H2 matches the shift register after the second search in parallel, and finds a hit, and returns the set {1,0}, with the lowest index being 0, that is, H2's most recent search was the previous one, and the current Ptraddr points to address 2. The offset address is calculated based on the lowest index, as shown in equation (2). The address 1 of Ptrread is calculated, and the cache table information pointed to by Ptrread is read out. After subsequent processing, the information is updated to address 2 pointed to by Ptraddr, and then Ptraddr is incremented by 1;

[0071] Ptr read =Ptr addr -(index+1) (2)

[0072] ④ The fourth search, H1 returns the set {1,2} after the search. At this time, Ptraddr points to address 3. The address of Ptrread is calculated to be 0 by formula (3.5). The table entry at address 0 is read out, and the table entry is updated to address 3 pointed to by Ptraddr. Ptraddr returns to address 0.

[0073] From the above analysis, we can see that the cache table will be updated in real time, using a first-in, first-out strategy. When a new message arrives, the earliest message information will be replaced. There may be multiple identical entries for the same flow in the cache table, but in fact only the location pointed to by Ptrread is the latest entry information.

[0074] It is worth noting that if Figure 6 As shown, the hardware platform of the module design in this embodiment is FPGA, wherein the design size of the cache table Cache and the size design of the shift register M in the flow locality processing need to be linked to the resources of FPGA. The size of the cache table should be the same as the size design of the shift register M, and the use of the FPGA's Simple DualPort RAM to achieve functional requirements is preferred, which is conducive to the convergence of the timing. The depth and bit width of the shift register M will occupy more FF resources, and the bit width can be optimized during design.

[0075] For example, some fields of the quintuple may be selected instead of all fields, and a hash algorithm may be used to compress the quintuple.

[0076] When the original rule table changes, for example, an entry is deleted, the Cache table needs to be updated.

[0077] There is no need to traverse the cache table to update it. Instead, the superior will send down a deletion of the dynamic table to enable local processing of the flow of the processing module and initialize the shift register without operating the cache table. This is because from the design principle, the cache table is essentially associated with the shift register.

[0078] The specific structural workflow is as follows:

[0079] The keyword quintuple enters the FIFO cache, and the locality principle of the flow is first processed based on the keyword to determine whether it is a new flow or an old flow. The new flow accesses the original rule set in parallel and linearly, and writes the invalid local match result into the comparison set FIFO, writes the result of searching the original rule set into the rule table entry FIFO, and then reads the table entry, outputs the search hit result, and updates the cache table. The old flow directly calculates the offset address index cache based on the matching result and outputs the search result.

[0080] As shown in Table 1, the packet classification time of the traditional parallel linear search scheme and the parallel linear search scheme with cache optimization is compared under 7 different numbers of rule sets. The test environment is a simulated small LAN. The scheme is deployed in the gateway device. The data streams of other devices will be processed by the device. Each rule set has an identical and passable IPv4 rule. The test time is 6 hours. The comparison shows that the scheme with cache optimization has good time performance under different rule set sizes.

[0081] Table 1

[0082]

[0083] The flow-based local message classification method of the present invention adopts fragment matching and the design of a dynamic cache table of the flow chip, which can ensure that the message can quickly find the table entry in each clock cycle, reduce the delay and improve the performance; through the design of the arbitrator, when the cache rules and resources are limited, a first-in-first-out working mode is adopted to ensure the search rate; through the design of the dynamic cache table memory, when the cache rule capacity is limited, the most recently used rules can be cached, which can improve the hit rate of the access rules, improve the matching efficiency, save storage resources, reduce processing delays, thereby reducing classification delays, simplifying the design, reducing implementation costs, and realizing real-time high-speed service classification of the data message plane.

[0084] The hardware resource utilization rate of the flow-based local message classification device of the present invention is much higher than that of the currently common message classification devices. At the same time, through the design of fragment matching, dynamic cache table memory and arbiter (first-in-first-out), the latency is greatly reduced, avoiding the latency of traditional multi-mode and multi-stage matching circuits. While realizing flow-based local message classification with a limited number of rules, the search speed is improved and the latency is reduced.

[0085] It should be noted here that the examples and scenarios implemented by the above-mentioned modules and corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned embodiments. It should be noted that the above-mentioned modules as part of the device can run in a hardware environment and can be implemented by software or hardware, wherein the hardware environment includes a network environment.

[0086] According to another aspect of the embodiments of the present application, a storage medium is further provided. Optionally, in this embodiment, the storage medium can be used to execute the program code of any of the flow-based local message classification methods in the embodiments of the present application.

[0087] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps:

[0088] S1, the shift register compares the keyword information of the message to be classified with the storage table entry information to obtain a comparison result, wherein the storage table entry information is the historical query table entry information cached in the dynamic cache table.

[0089] The keyword information may be, for example, a quintuple, a triplet, or a Hash value corresponding thereto, etc. The stored entry information is all the historically queried entry information cached in the dynamic cache table.

[0090] S2, the arbitrator receives the comparison result and generates an index matching result; if the index matching is successful, the table item result of the index dynamic cache table is indexed to complete the query;

[0091] S3: If the index does not match successfully, search in the original rule table, output the search result, and update the current query table item information to the dynamic cache table to complete the query.

[0092] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, which will not be described in detail in this embodiment.

[0093] Among them, computer-readable storage media may include, but are not limited to, any type of disk, including floppy disks, optical disks, DVDs, CD-ROMs, microdrives and magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, DRAMs, VRAMs, flash memory devices, magnetic or optical cards, nanosystems (including molecular memory ICs), or any type of medium or device suitable for storing instructions and / or data.

[0094] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0095] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0096] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0097] In the several embodiments provided in the present application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of the units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0098] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0099] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0100] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned memory includes: U disk, read-only memory (ROM), random access memory (RAM), mobile hard disk, disk or optical disk and other media that can store program code.

[0101] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable memory, which can include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0102] The above is only an exemplary embodiment of the present disclosure, and the scope of the present disclosure cannot be limited thereto. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the specification and practicing the disclosure here, those skilled in the art will easily think of the implementation scheme of the present disclosure. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field not recorded in the present disclosure. The description and examples are regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

[0103] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0104] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A flow-based local message classification method, characterized in that: include: The shift register compares the keyword information of the message to be classified with the storage table entry information to obtain a comparison result, wherein the storage table entry information is the historical query table entry information cached in the dynamic cache table; The arbitrator receives the comparison result and generates an index matching result; if the index matching is successful, the lowest index is obtained and the table item result of the dynamic cache table is indexed to complete the query; wherein the lowest index is the message most recently searched; If the index does not match successfully, a search is performed in the original rule table, the search result is output, and the current query table item information is updated to the dynamic cache table to complete the query.

2. The flow-based local message classification method according to claim 1, characterized in that: The dynamic cache table includes table entries read from the original rule set and the number of times the table entries are used.

3. The flow-based local message classification method according to claim 2, characterized in that: The updating of the current query table item information to the dynamic cache table includes: According to the index number of the current query table item information, the corresponding table item information in the dynamic cache table is updated to the current query table item information; The usage count of the entry is increased by 1 and updated to the next address of the corresponding address in the dynamic cache table.

4. The flow-based local message classification method according to claim 1, characterized in that: Also includes: The search result includes the corresponding bit of the current query table entry in the shift register and the index in the dynamic table memory.

5. The flow-based local message classification method according to claim 1, characterized in that: The dynamic cache table uses a first-in-first-out strategy to update the entry information.

6. A flow-based local message classification device, comprising a plurality of shift registers, an arbitrator and a dynamic cache table memory arranged in an FPGA; The shift register is used to compare the keyword information of the message to be classified with the storage entry information to obtain a comparison result, wherein: The storage entry information is the historical query entry information cached in the dynamic cache table; The arbitrator is used to receive the comparison result and generate an index matching result; if the index matching is successful, the lowest index is obtained and the table item result of the dynamic cache table is indexed to complete the query; wherein the lowest index is the message most recently searched; If the index does not match successfully, a search is performed in the original rule table, the search result is output, and the current query table item information is updated to the dynamic cache table to complete the query.

7. The flow-based local message classification device according to claim 6, wherein the number of the shift registers is specifically set as follows: M is an integer; in, M is the number of shift registers; T Consume The time it takes to write an entry into the cache table; T MinPacket It is the time required to process the shortest 64-byte Ethernet frame at line speed.

8. The flow-based local message classification device as described in claim 6 further includes a comparison set memory for storing the index matching result.

9. According to the flow-based local message classification device as described in claim 8, the value of each bit in the comparison set memory indicates whether the five-tuple information of the current search message successfully matches the five-tuple value of the stored table item information, and is determined to be 1 when the match is successful, and is determined to be 0 when the match is not successful.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program executes the method according to any one of claims 1 to 5 when executed.

Images