Memory optimization method and device for network application firewall

Abstract

The invention relates to a memory optimization method and device for a network application firewall. The method comprises the following steps: establishing a session corresponding to a network request, and selecting a target memory pool from a memory pool linked list of a network application firewall instance according to a memory application request of the session in a process of carrying out risk detection on the network request; under the condition that the memory application space carried by the memory application request is smaller than or equal to the maximum memory block space of the target memory pool, selecting a target memory block from the target memory pool, and allocating the target memory block to the session; when a memory release request of the session is obtained and a memory release space carried by the memory release request is smaller than or equal to the maximum memory block space of the target memory pool, putting the target memory block back to the target memory pool; and when the session is finished, putting the target memory pool back into the memory pool linked list. By adopting the method, the memory management efficiency in the WAF request processing process can be improved, so that memory fragments in a system are reduced, and the performance loss of memory management is reduced.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a memory optimization method and device for a network application firewall. Background Art

[0002] As threats such as data leakage and denial of service attacks continue to evolve and grow, network security has become an increasingly important and urgent issue in cloud-native scenarios. Network applications require powerful defense mechanisms to protect user data and ensure the normal operation of the system. WAF (Web Application Firewall) is a commonly used security solution for detecting and preventing various risks in Web applications. With the continuous increase in network traffic and the continuous development of network attack technology, various forms of attacks are emerging in an endless stream, and the challenges faced by WAF are becoming increasingly greater. Therefore, the optimization and upgrade of WAF has become particularly important.

[0003] WAF generally detects and filters network request content through predefined rule matching, regular matching, or machine learning methods. These rules are very complex and require a lot of memory and computing resources during the matching process. When processing a request, WAF will match and detect multiple rules one by one. In this process, it frequently allocates and releases memory by calling system library functions. The memory management efficiency is not high and there is a lot of memory fragmentation. In a high-concurrency environment, the system load increases, which can easily lead to performance degradation, increased latency, and even service interruption, which ultimately directly affects user usage.

[0004] Traditional optimization methods generally consider increasing the rule cache, which can prevent multiple compilations of rules and reduce the computational cost of rule matching. However, as a high-concurrency network intermediate server, traditional optimization methods do not take into account the performance loss of memory management during request processing and cannot fully improve WAF performance. Summary of the invention

[0005] Based on this, it is necessary to provide a memory optimization method and device for a network application firewall that can improve the memory management efficiency of the WAF in the process of processing requests, thereby reducing memory fragmentation in the system and reducing the performance loss of memory management in response to the above technical problems.

[0006] In a first aspect, the present application provides a memory optimization method for a network application firewall, comprising:

[0007] Establishing a session corresponding to the network request, and in the process of performing risk detection on the network request, selecting a target memory pool from a memory pool linked list of the network application firewall instance according to the memory application request of the session;

[0008] In the case where the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool, a target memory block is selected from the target memory pool and allocated to the session; the target memory block is used to store data in the risk detection process;

[0009] When a memory release request of the session is obtained and the memory release space carried in the memory release request is less than or equal to the maximum memory block space of the target memory pool, the target memory block is put back into the target memory pool;

[0010] When the session ends, the target memory pool is put back into the memory pool linked list.

[0011] In one embodiment, the memory application request also carries a memory usage cycle, and the memory pool linked list includes an instance memory pool corresponding to the network application firewall instance and a newly created session memory pool; selecting a target memory pool from the memory pool linked list of the network application firewall instance according to the memory application request of the session includes:

[0012] When the memory usage cycle is outside the session storage cycle, selecting an instance memory pool in an idle state in the memory pool linked list of the network application firewall instance as the target memory pool;

[0013] When the memory usage period is within the session storage period, a session memory pool in an idle state is selected from the memory pool linked list of the network application firewall instance as the target memory pool.

[0014] In one of the embodiments, when the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool, selecting the target memory block from the target memory pool includes:

[0015] In a case where the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool, determining a first memory block linked list that satisfies the memory application space in the target memory pool;

[0016] In the case that there is an idle memory block in the first memory block linked list, a memory block is selected from the header of the first memory block linked list as the target memory block.

[0017] In one embodiment, the method further comprises:

[0018] In the case that there is no free memory block in the first memory block linked list, a new memory block is created in the first memory block linked list as the target memory block.

[0019] In one of the embodiments, the memory release request further carries a memory identification bit to be released; and placing the target memory block back into the target memory pool comprises:

[0020] Acquire the block space of the target memory block according to the memory identification bit to be released, and determine the block space as the memory release space of the session;

[0021] In a case where the memory release space is less than or equal to the maximum memory block space of the target memory pool, determining a target memory block linked list where the target memory block is located;

[0022] When the linked list length of the target memory block linked list does not reach the maximum memory block linked list length, the target memory block is put back to the head of the target memory block linked list.

[0023] In one embodiment, the method further comprises:

[0024] When the linked list length of the target memory block linked list reaches the maximum memory block linked list length, the target memory block is released.

[0025] In one embodiment, when the session ends, placing the target memory pool back into the memory pool linked list comprises:

[0026] When the session ends, if the linked list length of the memory pool linked list does not reach the maximum memory pool linked list length, putting the target memory pool back into the head of the memory pool linked list;

[0027] The method further comprises:

[0028] When the linked list length of the memory pool linked list reaches the maximum memory pool linked list length, the target memory pool is released.

[0029] In one embodiment, the method further comprises:

[0030] When establishing the session, identifying whether there is a memory pool in the memory pool linked list that is in an idle state;

[0031] When there is no idle memory pool, a session memory pool is created in the memory pool linked list.

[0032] In one of the embodiments, the network application firewall instance stores the memory pool linked list, which includes multiple memory pools and stores the number of memory pools, the maximum memory pool linked list length, and the identification bit of the first memory pool;

[0033] The multiple memory pools include an instance memory pool corresponding to the network application firewall instance, each memory pool includes multiple memory block linked lists, and stores a maximum memory block space, a number of memory block linked lists, a maximum number of memory blocks in the linked lists, and an identifier of a next memory pool;

[0034] Each memory block linked list includes multiple memory blocks with the same block space, and stores the current number of memory blocks, the memory block space of each memory block, and the identifier of the first memory block in the linked list;

[0035] Each memory block stores the memory block space, the identifier of the next memory block, and the memory space allocated to the user.

[0036] In a second aspect, the present application also provides a memory optimization device for a network application firewall, comprising:

[0037] A memory pool selection module is used to establish a session corresponding to a network request, and in the process of performing risk detection on the network request, select a target memory pool from a memory pool linked list of a network application firewall instance according to a memory application request of the session;

[0038] A memory block allocation module, configured to select a target memory block from the target memory pool and allocate it to the session when the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool; the target memory block is used to store data in the risk detection process;

[0039] A memory block release module, configured to put the target memory block back into the target memory pool when a memory release request of the session is obtained and the memory release space carried by the memory release request is less than or equal to the maximum memory block space of the target memory pool;

[0040] The memory pool release module is used to put the target memory pool back into the memory pool linked list when the session ends.

[0041] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0042] Establishing a session corresponding to the network request, and in the process of performing risk detection on the network request, selecting a target memory pool from a memory pool linked list of the network application firewall instance according to the memory application request of the session;

[0043] In the case where the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool, a target memory block is selected from the target memory pool and allocated to the session; the target memory block is used to store data in the risk detection process;

[0044] When a memory release request of the session is obtained and the memory release space carried in the memory release request is less than or equal to the maximum memory block space of the target memory pool, the target memory block is put back into the target memory pool;

[0045] When the session ends, the target memory pool is put back into the memory pool linked list.

[0046] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0047] Establishing a session corresponding to the network request, and in the process of performing risk detection on the network request, selecting a target memory pool from a memory pool linked list of the network application firewall instance according to the memory application request of the session;

[0048] In the case where the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool, a target memory block is selected from the target memory pool and allocated to the session; the target memory block is used to store data in the risk detection process;

[0049] When a memory release request of the session is obtained and the memory release space carried in the memory release request is less than or equal to the maximum memory block space of the target memory pool, the target memory block is put back into the target memory pool;

[0050] When the session ends, the target memory pool is put back into the memory pool linked list.

[0051] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0052] Establishing a session corresponding to the network request, and in the process of performing risk detection on the network request, selecting a target memory pool from a memory pool linked list of the network application firewall instance according to the memory application request of the session;

[0053] In the case where the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool, a target memory block is selected from the target memory pool and allocated to the session; the target memory block is used to store data in the risk detection process;

[0054] When a memory release request of the session is obtained and the memory release space carried in the memory release request is less than or equal to the maximum memory block space of the target memory pool, the target memory block is put back into the target memory pool;

[0055] When the session ends, the target memory pool is put back into the memory pool linked list.

[0056] The memory optimization method, device, computer equipment, storage medium and computer program product of the network application firewall are introduced into the memory pool, and the target memory pool is selected from the memory pool chain list of the network application firewall instance, and the memory pool is allocated to the network application firewall instance, so as to realize the cache of the resources commonly requested in the network application firewall. By dividing the process of processing a single network request by the network application firewall into an independent session, when the memory release request of the session is obtained, and the memory release space carried by the memory release request is less than or equal to the maximum memory block space of the target memory pool, the target memory block is put back into the target memory pool, and when the session ends, the target memory pool is put back into the memory pool chain list, so as to realize the memory pool being provided to multiple sessions for reuse. The memory pool designed in this way is adapted to the processing method of concurrent requests of the network application firewall, and by the method of multiplexing the memory pool by the session, the memory allocation and release efficiency is improved, the consumption of the session in constructing the memory pool and releasing the memory pool is reduced, and the proportion of memory fragments is reduced, so as to further improve the concurrent processing performance of the network application firewall. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 A flowchart of a method for optimizing the memory of a network application firewall in one embodiment;

[0059] Figure 2 This is a schematic diagram of the architecture of a WAF memory pool in one embodiment;

[0060] Figure 3 A schematic diagram of the structure of a memory pool in one embodiment;

[0061] Figure 4 A schematic diagram of a process of selecting a target memory block from a target memory pool in one embodiment;

[0062] Figure 5A schematic diagram of a process of putting a target memory block back into a target memory pool in one embodiment;

[0063] Figure 6 A schematic diagram of a process of applying for memory for a session in an embodiment;

[0064] Figure 7 A schematic diagram of a memory allocation process in one embodiment;

[0065] Figure 8 A schematic diagram of a memory release process in one embodiment;

[0066] Fig. 9 A schematic diagram of a process of releasing a memory pool for a session in an embodiment;

[0067] Fig.10 It is a structural block diagram of a memory optimization device of a network application firewall in one embodiment;

[0068] Fig.11 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0070] In an exemplary embodiment, Figure 1 As shown, a memory optimization method for a network application firewall is provided, and the method is applied to WAF as an example for explanation, including the following steps 102 to 108. Among them:

[0071] Step 102, establish a session corresponding to the network request, and in the process of performing risk detection on the network request, select a target memory pool from the memory pool linked list of the network application firewall instance according to the memory application request of the session.

[0072] Among them, network request refers to the http request obtained by WAF. Session refers to the context environment established by WAF when processing network requests, and some intermediate data generated when processing network requests are stored in the session. Risk detection of network requests refers to detecting whether there are attacks on network requests. Network application firewall instance refers to the newly created WAF instance when WAF is started. The memory pool linked list of the network application firewall instance refers to the linked list of multiple memory pools stored in the WAF instance. The target memory pool refers to the memory pool of the memory block to be allocated.

[0073] Optionally, when WAF is started, a new WAF instance is created: multiple configuration files are loaded, including system rules (to defend against common file inclusion, remote command injection and other attacks), user-defined rules (such as IP rules and geographic rules), etc., and multiple configuration files are parsed into a WAF instance for storage and backup. In addition, caches of various rules will be saved in this instance, and these caches are added and deleted by each request during processing. Therefore, an instance memory pool used by a WAF instance is initialized in each WAF instance, that is, each WAF instance maintains an instance memory pool, which is used to store configuration items and caches that all requests need to access and operate. Furthermore, a memory pool linked list used by a session is initialized, and the maximum number of memory pools in the memory pool linked list, that is, the maximum memory pool linked list length, is set according to the estimated concurrent processing capacity of the process.

[0074] When a network request is obtained, WAF establishes a session for the network request. The process of WAF performing risk detection on network requests involves a large amount of memory allocation and release processes. Therefore, for each network request session, a memory pool is allocated for memory management. Specifically, when a memory application request for a session is obtained, the memory application request has a memory usage cycle, and the target memory pool is selected from the memory pool list of the network application firewall instance according to the memory usage cycle.

[0075] In one of the embodiments, the architecture of the WAF memory pool is described. A memory pool linked list is stored in the network application firewall instance, and the memory pool linked list includes multiple memory pools, and stores the number of memory pools, the maximum memory pool linked list length, and the identification of the first memory pool; the multiple memory pools include the instance memory pool corresponding to the network application firewall instance, each memory pool includes multiple memory block linked lists, and stores the maximum memory block space, the number of memory block linked lists, the maximum memory block linked list length, and the identification of the next memory pool; each memory block linked list includes multiple memory blocks with the same block space, and stores the current number of memory blocks, the memory block space of each memory block, and the identification of the first memory block in the linked list; each memory block stores the memory block space, the identification of the next memory block, and the memory space allocated to the user.

[0076] The maximum memory pool linked list length refers to the maximum number of memory pools, which is used to prevent excessive memory usage.

[0077] The identification bit of the first memory pool refers to a pointer to the first memory pool in the memory pool list. The identification bit of the next memory pool may be the address of the next memory pool. The multiple memory block lists included in each memory pool may be represented in the form of a memory block list array. The maximum memory block list length refers to the maximum number of memory blocks in the list, which is used to prevent the memory block list from growing infinitely. The memory block space refers to the size of the memory block.

[0078] See also Figure 2 and Figure 3 , Figure 2 This is a schematic diagram of the WAF memory pool architecture. Figure 3 The figure is a schematic diagram of the structure of the memory pool. The WAF instance refers to the network application firewall instance, the memory pool used by the WAF instance refers to the instance memory pool corresponding to the network application firewall instance, and the memory pool linked list used by the session refers to the memory pool linked list of the network application firewall instance.

[0079] WAF performs risk detection by parsing the content of network requests and matching them with predefined rules. This detection process involves a large amount of memory allocation and release, and the payload size varies greatly for different network requests. Therefore, the memory pool implemented in this application contains memory blocks of multiple sizes, and memory blocks of the same size are organized into a linked list for backup.

[0080] For example, in order to adapt to the memory usage scenario of WAF, the memory pool contains memory blocks of 2B to 1KB in size. Memory blocks of the same size are placed in a linked list, that is, there are a total of 10 memory block linked lists, and the sizes of memory blocks stored in each linked list are 2B, 4B, 8B, ..., 512B, and 1KB. The memory block contains a flexible array memspace[0], which is used to point to the memory space allocated to the user. When the memory is released, the flexible array can be used to put the memory block back into the memory pool.

[0081] The memory pool architecture designed above includes memory blocks ranging from 2B small blocks to 1KB large blocks, organized in linked lists. WAF completes memory application and release with constant time complexity. By reusing memory blocks within a session, WAF effectively reduces the performance consumption of memory application and release, and effectively reduces memory fragmentation in the system.

[0082] Step 104, when the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool, select a target memory block from the target memory pool and allocate it to the session; the target memory block is used to store data in the risk detection process.

[0083] Optionally, the memory application request carries a memory application space. The memory application space is compared with the maximum memory block space of the target memory pool. If the memory application space is less than or equal to the maximum memory block space of the target memory pool, a memory block greater than or equal to the memory application space is located in the target memory pool as the target memory block. The target memory block is allocated to the session so that the session can store data in the risk detection process, that is, intermediate data generated when processing network requests.

[0084] When the memory application space is larger than the maximum memory block space of the target memory pool, the dynamic memory allocation library function malloc is directly called to allocate the target memory block.

[0085] Step 106: When a memory release request of the session is obtained and the memory release space carried in the memory release request is less than or equal to the maximum memory block space of the target memory pool, the target memory block is put back into the target memory pool.

[0086] Step 108: When the session ends, the target memory pool is put back into the memory pool linked list.

[0087] In the process of risk detection of network requests, if a memory release request of a session is obtained, and the memory release request carries a memory release space, the memory release space is compared with the maximum memory block space of the target memory pool. If the memory release space is less than or equal to the maximum memory block space of the target memory pool, a memory block linked list equal to the memory release space is located, and the target memory block is put back into the memory block linked list.

[0088] When the memory release space is larger than the maximum memory block space of the target memory pool, the release function free is directly called to release the target memory block.

[0089] Furthermore, when the session ends, WAF puts the target memory pool back into the memory pool list.

[0090] In the above-mentioned memory optimization method of the network application firewall, by introducing a memory pool, selecting a target memory pool from the memory pool linked list of the network application firewall instance, and allocating a memory pool for the network application firewall instance, the cache of resources common to requests in the network application firewall is realized. By dividing the process of processing a single network request by the network application firewall into an independent session, when a memory release request of the session is obtained, and the memory release space carried by the memory release request is less than or equal to the maximum memory block space of the target memory pool, the target memory block is put back into the target memory pool, and at the end of the session, the target memory pool is put back into the memory pool linked list, so as to provide the memory pool for multiple sessions for reuse. The memory pool designed in this way is adapted to the way the network application firewall handles concurrent requests, and by multiplexing the memory pool by the session, the efficiency of memory allocation and release is improved, the consumption of the session in constructing and releasing the memory pool is reduced, and the proportion of memory fragments is reduced, further improving the concurrent processing performance of the network application firewall.

[0091] In an exemplary embodiment, the memory application request also carries a memory usage cycle, and the memory pool linked list includes an instance memory pool corresponding to the network application firewall instance and a newly created session memory pool; selecting a target memory pool from the memory pool linked list of the network application firewall instance according to the memory application request of the session includes: when the memory usage cycle is outside the session storage cycle, selecting an instance memory pool in an idle state in the memory pool linked list of the network application firewall instance as the target memory pool; when the memory usage cycle is within the session storage cycle, selecting an idle session memory pool in the memory pool linked list of the network application firewall instance as the target memory pool.

[0092] Optionally, for memory blocks with different memory usage cycles, you need to apply from different memory pools. The memory pool list includes the instance memory pool corresponding to the network application firewall instance and the newly created session memory pool. The instance memory pool corresponding to the network application firewall instance refers to the memory pool maintained by the network application firewall instance. The newly created session memory pool is the memory pool expanded during the request processing process.

[0093] When the memory usage cycle is outside the session storage cycle, such as session application request content analysis, select an idle instance memory pool from the memory pool list of the network application firewall instance, and apply for a memory block from the idle instance memory pool.

[0094] When the memory usage cycle is within the session storage cycle, such as session application rule cache, select an idle session memory pool from the memory pool list of the network application firewall instance, and apply for a memory block from the idle session memory pool.

[0095] In this embodiment, applying from different memory pools for different application use periods of sessions can improve the accuracy of memory allocation.

[0096] In an exemplary embodiment, Figure 4 As shown, when the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool, selecting the target memory block from the target memory pool includes:

[0097] Step 402: when the memory application space carried in the memory application request is less than or equal to the maximum memory block space of the target memory pool, determine the first memory block linked list that satisfies the memory application space in the target memory pool.

[0098] Step 404: When there is a free memory block in the first memory block linked list, a memory block is selected from the header of the first memory block linked list as the target memory block.

[0099] Here, satisfying the memory application space means being greater than or equal to the memory application space.

[0100] Optionally, when the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool, determine the first memory block linked list that is greater than or equal to the memory application space in the target memory pool. Identify whether there is an idle memory block in the first memory block linked list. If there is an idle memory block in the first memory block linked list, directly select a memory block from the header of the first memory block linked list and allocate it to the session.

[0101] In this embodiment, when allocating memory, the first memory block is directly taken from the head of the first memory block linked list that satisfies the memory application space for allocation, thereby improving the memory allocation efficiency.

[0102] Furthermore, the method further includes: when there is no idle memory block in the first memory block linked list, creating a new memory block in the first memory block linked list as the target memory block.

[0103] If there is no free memory block in the first memory block list, a memory block of the size of the first memory block list is requested through the dynamic memory allocation library function malloc, that is, a new memory block is created. The newly created memory block is allocated to the session.

[0104] When the memory pool used by the session, that is, the target memory pool, is established, the number of memory blocks in its memory block linked lists of different sizes is zero. However, during the use of the session, the number of memory blocks in the memory pool will continue to expand. According to the actual memory requirements of the session, the number of memory blocks in the memory pool is adaptively adjusted, so that in the subsequent request processing process, there is basically no need to apply for new memory blocks through malloc, and there are basically no idle memory blocks that have not been used for a long time. This further reduces the number of times to apply for and release memory from the system, and effectively improves the performance of WAF.

[0105] In an exemplary embodiment, Figure 5 As shown, the memory release request also carries the memory identification bit to be released; putting the target memory block back into the target memory pool includes:

[0106] Step 502: Obtain the block space of the target memory block according to the memory identification bit to be released, and determine the block space as the memory release space of the session.

[0107] Step 504: when the memory release space is less than or equal to the maximum memory block space of the target memory pool, determine the target memory block linked list where the target memory block is located.

[0108] Step 506: When the linked list length of the target memory block linked list does not reach the maximum memory block linked list length, the target memory block is put back into the head of the target memory block linked list.

[0109] The memory identification bit to be released refers to the memory address to be released. The target memory block linked list refers to the memory block linked list equal to the memory release space.

[0110] Optionally, similar to the memory allocation process, the memory is released in the corresponding memory pool according to the memory usage cycle. According to the memory identification bit to be released, the starting address of the memory block where the memory identification bit is located is obtained through macro definition, and the block space of the memory block is obtained according to the starting address, and the block space is determined as the memory release space of the session.

[0111] When the memory release space is less than or equal to the maximum memory block space of the target memory pool, locate the memory block linked list equal to the memory release space. If the linked list length of the target memory block linked list is less than the maximum memory block linked list length, that is, the number of memory blocks in the target memory block linked list does not reach the maximum number of memory blocks, then insert the target memory block into the head of the target memory block linked list.

[0112] Furthermore, the method further includes: when the linked list length of the target memory block linked list reaches the maximum memory block linked list length, releasing the target memory block. If the linked list length of the target memory block linked list is greater than or equal to the maximum memory block linked list length, that is, the number of memory blocks in the target memory block linked list reaches the maximum number of memory blocks, then directly calling the release function to release the target memory block.

[0113] In this embodiment, when releasing memory, if the memory release space is less than or equal to the maximum memory block space of the target memory pool, the target memory block linked list where the target memory block is located is determined, and if the maximum memory block linked list length is not reached, the target memory block is directly put back to the header of the target memory block linked list. There is no need to call a library function to release memory, which can improve memory allocation efficiency.

[0114] In an exemplary embodiment, when the session ends, placing the target memory pool back into the memory pool linked list includes: when the session ends, if the linked list length of the memory pool linked list has not reached the maximum memory pool linked list length, placing the memory pool back into the head of the memory pool linked list; the above method also includes: if the linked list length of the memory pool linked list reaches the maximum memory pool linked list length, releasing the memory pool.

[0115] The length of the memory pool linked list refers to the number of memory pools, and the maximum memory pool linked list length refers to the maximum number of memory pools.

[0116] When the session ends, determine whether the number of memory pools in the memory pool list of the WAF instance has reached the maximum number of memory pools. If so, directly release the target memory pool. If not, put the target memory pool back into the memory pool list of the WAF instance for use by other sessions. By providing memory pools for multiple sessions to reuse, the consumption of sessions in constructing and releasing memory pools is reduced, further improving the concurrent processing performance of WAF.

[0117] In an exemplary embodiment, the method further includes: when establishing a session, identifying whether there is an idle memory pool in the memory pool list; when there is no idle memory pool, creating a session memory pool in the memory pool list. For a network request processing process, at the beginning of session establishment, try to get a memory pool from the memory pool list of the WAF instance. If there is no idle memory pool, create a new memory pool for the session. Able to provide an available memory pool for the session.

[0118] Exemplarily, when the WAF process is started, a new WAF instance is created, in which a memory pool waf_mempool used by the WAF instance is initialized, and then a memory pool linked list session_mempool_list used by a session is initialized, and the maximum number of memory pools in the linked list is set to max_mempool_num according to the estimated concurrent processing capacity of the process.

[0119] When a network request comes, the web application firewall creates a new session for the request processing. When creating a new session, the session memory application process is executed, such as Figure 6 As shown, try to get a memory pool from the memory pool list session_mempool_list. If there is no memory pool available, create a new memory pool. At this time, the session obtains a memory pool session_mempool.

[0120] When a session applies for memory: Memory blocks with different memory usage periods need to be applied from different memory pools. If the memory within the session life cycle is applied (such as request content parsing), it is applied from session_mempool; if the memory outside the session life cycle is applied (such as rule cache, etc.), it is applied from waf_mempool. After that, the memory allocation process is executed, such as Figure 7As shown in the figure, if the session applies for memory of size, it determines whether size is greater than the maximum memory block space max_size of the memory pool. If it is greater, it applies to the system, that is, directly calls malloc for allocation; if it is less, it locates the first memory block list memblock_list whose memory block space is greater than or equal to the size according to size. If there is no memory block available in the memblock_list, a new memory block is created; if there is a memory block available, a memory block is directly taken from the head of the list for allocation.

[0121] When the session releases memory: Similar to allocating memory, it releases it in the corresponding memory pool according to the memory usage cycle. After that, the memory release process is executed, such as Figure 8 As shown, if the session releases memory of size size, it determines whether size is greater than the maximum memory block space max_size of the memory pool. If it is greater, free is called directly to release it; if it is less, the memory block where the pointer is located is obtained through container_of according to the released pointer, that is, the memory address, and then the corresponding memory block list memblock_list is located according to the block size of the memory block. If the number of memory blocks in the memblock_list reaches the maximum number of memory blocks, free is called directly to release the memory block; otherwise, the memory block is put back to the head of memblock_list.

[0122] When the session ends, execute the session release memory pool process, such as Fig. 9 As shown, it is determined whether the number of memory pools in the memory pool list of the WAF instance reaches max_mempool_num. If it reaches it, session_mempool is directly released; if not, the memory pool is put back into the memory pool list session_mempool_list of the WAF instance for use by other sessions.

[0123] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0124] Based on the same inventive concept, the embodiment of the present application also provides a network application firewall memory optimization device for implementing the above-mentioned network application firewall memory optimization method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in the embodiments of one or more network application firewall memory optimization devices provided below can refer to the limitations of the network application firewall memory optimization method above, and will not be repeated here.

[0125] In an exemplary embodiment, Fig.10 As shown, a memory optimization device for a network application firewall is provided, including: a memory pool selection module 1002, a memory block allocation module 1004, a memory block release module 1006 and a memory pool release module 1008, wherein:

[0126] The memory pool selection module 1002 is used to establish a session corresponding to a network request, and in the process of performing risk detection on the network request, select a target memory pool from the memory pool linked list of the network application firewall instance according to the memory application request of the session.

[0127] The memory block allocation module 1004 is used to select a target memory block from the target memory pool and allocate it to the session when the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool; the target memory block is used to store data in the risk detection process.

[0128] The memory block releasing module 1006 is used to put the target memory block back into the target memory pool when a memory release request of the session is obtained and the memory release space carried in the memory release request is less than or equal to the maximum memory block space of the target memory pool.

[0129] The memory pool release module 1008 is used to put the target memory pool back into the memory pool linked list when the session ends.

[0130] In an exemplary embodiment, the memory application request also carries a memory usage cycle, and the memory pool linked list includes an instance memory pool corresponding to the network application firewall instance and a newly created session memory pool; the memory pool selection module 1002 is also used to select an instance memory pool in an idle state in the memory pool linked list of the network application firewall instance as the target memory pool when the memory usage cycle is outside the session storage cycle; when the memory usage cycle is within the session storage cycle, select an idle session memory pool in the memory pool linked list of the network application firewall instance as the target memory pool.

[0131] In an exemplary embodiment, the memory block allocation module 1004 is also used to determine the first memory block linked list that meets the memory application space in the target memory pool when the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool; when there is an idle memory block in the first memory block linked list, select a memory block from the header of the first memory block linked list as the target memory block.

[0132] In an exemplary embodiment, the memory block allocation module 1004 is further configured to create a new memory block in the first memory block linked list as a target memory block if there is no free memory block in the first memory block linked list.

[0133] In an exemplary embodiment, the memory release request also carries a memory identification bit to be released; the memory block release module 1006 is also used to obtain the block space of the target memory block according to the memory identification bit to be released, and determine the block space as the memory release space of the session; when the memory release space is less than or equal to the maximum memory block space of the target memory pool, determine the target memory block linked list where the target memory block is located; when the linked list length of the target memory block linked list does not reach the maximum memory block linked list length, put the target memory block back to the header of the target memory block linked list.

[0134] In an exemplary embodiment, the memory block releasing module 1006 is further configured to release the target memory block when the linked list length of the target memory block linked list reaches the maximum memory block linked list length.

[0135] In an exemplary embodiment, the memory pool release module 1008 is also used to put the target memory pool back to the head of the memory pool linked list when the session ends and the linked list length of the memory pool linked list has not reached the maximum memory pool linked list length; and to release the target memory pool when the linked list length of the memory pool linked list reaches the maximum memory pool linked list length.

[0136] In an exemplary embodiment, the above device further includes:

[0137] The memory pool creation module is used to identify whether there is an idle memory pool in the memory pool linked list when establishing a session; when there is no idle memory pool, create a session memory pool in the memory pool linked list.

[0138] In an exemplary embodiment, a network application firewall instance stores a memory pool linked list, which includes multiple memory pools, and stores the number of memory pools, the maximum memory pool linked list length, and the identification of the first memory pool; the multiple memory pools include an instance memory pool corresponding to the network application firewall instance, each memory pool includes multiple memory block linked lists, and stores the maximum memory block space, the number of memory block linked lists, the maximum number of memory blocks in the linked list, and the identification of the next memory pool; each memory block linked list includes multiple memory blocks with the same block space, and stores the current number of memory blocks, the memory block space of each memory block, and the identification of the first memory block in the linked list; each memory block stores the memory block space, the identification of the next memory block, and the memory space allocated to the user.

[0139] Each module in the memory optimization device of the network application firewall can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0140] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig.11 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store XX data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a memory optimization method for a network application firewall is implemented.

[0141] Those skilled in the art will understand that Fig.11 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0142] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0143] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0144] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0145] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0146] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0147] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0148] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A memory optimization method for a network application firewall, characterized in that: The method comprises: Establishing a session corresponding to the network request, and in the process of performing risk detection on the network request, selecting a target memory pool from a memory pool linked list of the network application firewall instance according to the memory application request of the session; In the case where the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool, a target memory block is selected from the target memory pool and allocated to the session; the target memory block is used to store data in the risk detection process; When a memory release request of the session is obtained and the memory release space carried in the memory release request is less than or equal to the maximum memory block space of the target memory pool, the target memory block is put back into the target memory pool; When the session ends, the target memory pool is put back into the memory pool linked list.

2. The method according to claim 1, characterized in that The memory application request also carries a memory usage cycle, and the memory pool linked list includes an instance memory pool corresponding to the network application firewall instance and a newly created session memory pool; Selecting a target memory pool from a memory pool linked list of a network application firewall instance according to the memory application request of the session includes: When the memory usage cycle is outside the session storage cycle, selecting an instance memory pool in an idle state in the memory pool linked list of the network application firewall instance as the target memory pool; When the memory usage period is within the session storage period, a session memory pool in an idle state is selected from the memory pool linked list of the network application firewall instance as the target memory pool.

3. The method according to claim 1, characterized in that When the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool, selecting the target memory block from the target memory pool includes: In a case where the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool, determining a first memory block linked list that satisfies the memory application space in the target memory pool; In the case that there is an idle memory block in the first memory block linked list, a memory block is selected from the header of the first memory block linked list as the target memory block.

4. The method according to claim 3, characterized in that The method further comprises: In the case that there is no free memory block in the first memory block linked list, a new memory block is created in the first memory block linked list as the target memory block.

5. The method according to claim 1, characterized in that The memory release request also carries a memory identification bit to be released; and placing the target memory block back into the target memory pool includes: Acquire the block space of the target memory block according to the memory identification bit to be released, and determine the block space as the memory release space of the session; In a case where the memory release space is less than or equal to the maximum memory block space of the target memory pool, determining a target memory block linked list where the target memory block is located; When the linked list length of the target memory block linked list does not reach the maximum memory block linked list length, the target memory block is put back to the head of the target memory block linked list.

6. The method according to claim 5, characterized in that The method further comprises: When the linked list length of the target memory block linked list reaches the maximum memory block linked list length, the target memory block is released.

7. The method according to claim 1, characterized in that When the session ends, placing the target memory pool back into the memory pool linked list comprises: When the session ends, if the linked list length of the memory pool linked list does not reach the maximum memory pool linked list length, putting the target memory pool back into the head of the memory pool linked list; The method further comprises: When the linked list length of the memory pool linked list reaches the maximum memory pool linked list length, the target memory pool is released.

8. The method according to claim 1, characterized in that The method further comprises: When establishing the session, identifying whether there is an idle memory pool in the memory pool linked list; When there is no idle memory pool, a session memory pool is created in the memory pool linked list.

9. The method according to claim 1, characterized in that: The network application firewall instance stores the memory pool linked list, which includes a plurality of memory pools, and stores the number of memory pools, the maximum memory pool linked list length, and the identification bit of the first memory pool; The multiple memory pools include an instance memory pool corresponding to the network application firewall instance, each memory pool includes multiple memory block linked lists, and stores a maximum memory block space, a number of memory block linked lists, a maximum number of memory blocks in the linked lists, and an identifier of a next memory pool; Each memory block linked list includes multiple memory blocks with the same block space, and stores the current number of memory blocks, the memory block space of each memory block, and the identifier of the first memory block in the linked list; Each memory block stores the memory block space, the identifier of the next memory block, and the memory space allocated to the user.

10. A memory optimization device for a network application firewall, characterized in that: The device comprises: A memory pool selection module is used to establish a session corresponding to a network request, and in the process of performing risk detection on the network request, select a target memory pool from a memory pool linked list of a network application firewall instance according to a memory application request of the session; A memory block allocation module, configured to select a target memory block from the target memory pool and allocate it to the session when the memory application space carried by the memory application request is less than or equal to the maximum memory block space of the target memory pool; the target memory block is used to store data in the risk detection process; A memory block release module, configured to put the target memory block back into the target memory pool when a memory release request of the session is obtained and the memory release space carried by the memory release request is less than or equal to the maximum memory block space of the target memory pool; The memory pool release module is used to put the target memory pool back into the memory pool linked list when the session ends.

Images